Blog · Exam
SCS-C03: Security - Specialty
5 articles, each explaining one topic from the documentation and ending at a stage you can play.
SCS-C03 · Security
How AWS decides a request: why an explicit deny always wins
Every request starts denied. An Allow lets it through, and one Deny in any policy ends it. The order AWS reads policies in, and how to find the Deny.
Ends at Deny WinsFree5 min read · video coming
SCS-C03 · Security
Identity policy or bucket policy: which one has to allow?
In one account, either side can allow. Across accounts, both must. An account principal only delegates, and Block Public Access overrides a public policy.
Ends at Deny WinsFree6 min read · video coming
SAA-C03 · Networking
Security group or network ACL: which one dropped the packet?
Security groups are stateful and only allow. Network ACLs are stateless, numbered and can deny. Follow one HTTPS request to see which layer drops what.
Ends at Guard Rails Paid5 min read · video coming
SAP-C02 · Networking
Transit gateway route tables: association and propagation, with one packet
Association picks the table a packet is looked up in. Propagation picks which tables know a VPC. Follow one packet to see how a transit gateway segments.
Ends at Routing Domains Paid5 min read · video coming
SAA-C03 · Networking
What actually makes a subnet public
Not its name, not a public IP, not the gateway alone. The subnet's route table decides, and the main route table decides for every subnet you forgot.
Ends at Open for BusinessFree5 min read · video coming