← Whitepapers and FAQs

▶ Play from here · 318 min

Starts this lesson and continues through 29 more to the end of certification prep.

The Security Pillar

A note on which document this is

The exam prep reading list names a whitepaper called AWS Security Best Practices. When I went looking for it (2026-09-21), what surfaced were archived PDFs — July 2018 and July 2020 versions carrying AWS's historical-reference notice.

AWS's current, maintained document for this material is the Security Pillar of the Well-Architected Framework, publication date November 6, 2024. That is what this lesson is built on.

⚠️ I could not verify that a current standalone whitepaper titled "AWS Security Best Practices" exists. If your copy of the reading list links to a PDF, check its date before you study from it — several of the archived versions predate IAM Identity Center's current name, resource control policies, and the S3 default-encryption change, all of which are examinable now.

Why this pillar carries the most weight

Security is 30% of the scored exam — the largest domain. So the Security Pillar isn't one whitepaper among six; it's the reading for nearly a third of the paper.

What the pillar is, verbatim from Security (verified 2026-09-21):

"The Security pillar encompasses the ability to protect data, systems, and assets to take advantage of cloud technologies to improve your security."

And the whitepaper's own statement of purpose:

"This will help you meet your business and regulatory requirements by following current AWS recommendations. … After reading this paper, you will understand AWS current recommendations and strategies to use when designing cloud architectures with security in mind."

Note who it says it's for: "chief technology officers (CTOs), chief information security officers (CSOs/CISOs), architects, developers, and operations team members." And note what it explicitly is not: "This paper doesn't provide implementation details or architectural patterns."

That last point is the honest framing for how to use it. The Security Pillar tells you what good looks like and why. It does not tell you which service to click. Module SAA1 does that.

The seven design principles

Verbatim from Design principles, verified 2026-09-21. These are worth memorising — not for a recall question, but because they are the reasons that make a design defensible in an exam answer or an interview.

1. Implement a strong identity foundation

"Implement the principle of least privilege and enforce separation of duties with appropriate authorization for each interaction with your AWS resources. Centralize identity management, and aim to eliminate reliance on long-term static credentials."

Three commitments in one principle, and the third is the sharp one: eliminate reliance on long-term static credentials. That is AWS telling you, in the framework document, that an IAM user with access keys is the wrong answer. Roles, instance profiles, IAM Identity Center.

2. Maintain traceability

"Monitor, alert, and audit actions and changes to your environment in real time. Integrate log and metric collection with systems to automatically investigate and take action."

"Automatically investigate and take action" — not just collect. Which is why EventBridge-driven remediation is the framework-aligned answer, not a dashboard someone checks.

3. Apply security at all layers

"Apply a defense in depth approach with multiple security controls. Apply to all layers (for example, edge of network, VPC, load balancing, every instance and compute service, operating system, application, and code)."

The bracketed list is the layer stack from SAA1 lesson 3, in AWS's own words. It's also the reason a single control is rarely the complete answer.

4. Automate security best practices

"Automated software-based security mechanisms improve your ability to securely scale more rapidly and cost-effectively. Create secure architectures, including the implementation of controls that are defined and managed as code in version-controlled templates."

5. Protect data in transit and at rest

"Classify your data into sensitivity levels and use mechanisms, such as encryption, tokenization, and access control where appropriate."

⚠️ Read the order: classify first, then apply mechanisms. Encryption is not the first step in this principle — classification is. That's why Macie exists, and it's why "encrypt everything" is a weaker answer than "classify, then protect according to sensitivity".

6. Keep people away from data

"Use mechanisms and tools to reduce or eliminate the need for direct access or manual processing of data. This reduces the risk of mishandling or modification and human error when handling sensitive data."

This is the most under-used principle on the exam and it's a tie-breaker. Between "engineers SSH in to run a script" and "an automated job with no human access", the second wins on this principle and on operational excellence. Systems Manager Session Manager and Run Command exist for exactly this.

7. Prepare for security events

"Prepare for an incident by having incident management and investigation policy and processes that align to your organizational requirements. Run incident response simulations and use tools with automation to increase your speed for detection, investigation, and recovery."

"Run incident response simulations" — the game-days principle from lesson 1, applied to security. Having a plan is not preparation; rehearsing it is.

The seven best practice areas

Verbatim from Best practices, verified 2026-09-21:

Seven principles, seven areas — they are not the same seven, and they don't pair off. The principles are why; the areas are where the questions live.

Here's the useful part: those seven areas map cleanly onto SAA-C03 Domain 1's three task statements and the SAA1 module's lessons, which is a good way to check your coverage.

⚠️ Incident response has no direct SAA-C03 task statement. It's in the pillar and it matters professionally, but don't over-invest in it for this exam. This is the kind of thing that only becomes visible when you read the pillar and the exam guide side by side — which is why you should.

Using the principles as exam reasoning

The principles are how you turn "I think it's B" into "it's B because…". Four worked mappings:

And the meta-point: in this exam, "why" is the answer. Two options can both be secure; the one the Framework's principles endorse is the one AWS scored as correct.

Check yourself

1. Which document should you actually read for "AWS Security Best Practices", and why?
2. The fifth design principle names a step before encryption. What is it, and which AWS service supports it?
3. Which principle argues against engineers SSHing into production, and what's the AWS answer?
4. Name the seven best practice areas. Which one has no direct SAA-C03 task statement?
5. What does the Security Pillar explicitly say it does not provide?

Answers

1. The Security Pillar of the Well-Architected Framework (publication date November 6, 2024). The standalone "AWS Security Best Practices" PDFs that surface are archived 2018 and 2020 versions carrying AWS's historical-reference notice, and they predate several examinable changes.
2. Classification. "Classify your data into sensitivity levels and use mechanisms, such as encryption, tokenization, and access control where appropriate." Amazon Macie is the service for discovering and classifying sensitive data in S3.
3. "Keep people away from data" — "reduce or eliminate the need for direct access or manual processing of data." AWS Systems Manager Session Manager (and Run Command) rather than SSH keys and a bastion host.
4. Security foundations, identity and access management, detection, infrastructure protection, data protection, incident response, application security. Incident response has no direct SAA-C03 task statement.
5. "This paper doesn't provide implementation details or architectural patterns." It tells you what good looks like and why — not which button to press.

Teaching this section

• Open with the archived-whitepaper problem. It's a live, checkable example of why every fact in this course carries a source and a date. Show them the 2018 PDF's header.
• Demo: read principle 5 aloud and ask the room what the first step is. Almost everyone says "encrypt". The word is classify. That reordering is the lesson.
• Best discussion prompt: "Which principle would you cite to stop a team from creating an IAM user with access keys for their CI pipeline?" (Principle 1, and specifically "eliminate reliance on long-term static credentials" — quoting AWS beats arguing.)
• Watch for: learners memorising the seven principles as a list to recite. They're reasoning tools. Make them use one on a real question before moving on.
• Timing: 20 min presented, 15 on the principle-to-question mapping table. Build that table with the room rather than showing it.