ESEN

← Fine print by exam

Amazon Web Services · Specialty

SCS-C03 · AWS Certified Security - Specialty (SCS-C03)

AWS Certified Security - Specialty

Current↗ Official guide🃏 Practice these gotchas

Secretless CI/CD deployments (OIDC federation)

Security● verified 34 days ago◌ no external reviewer

IAM requires a sub condition, but accepts one that still leaves the door open

GitHub's issuer is the same for every organization: without scoping sub, any GitHub repository could assume your role. That's why IAM rejects creating or updating a trust policy for that provider when the sub (or job_workflow_ref) condition is missing or is just a wildcard. But "repo:*" or "repo:my-org/*" pass validation. The real boundary is yours to set: this module uses StringEquals with one sub per environment.

Helps with:SCS-C03SAA-C03
⚑ Report outdated

See it in the pattern →

IAM● verified 34 days ago◌ no external reviewer

If the job declares an environment, the sub no longer contains the branch

GitHub includes the environment in the sub when the job references one; pull_request and the ref only appear if the job doesn't reference an environment. A job on main with environment production presents repo:org/repo:environment:production, so a trust policy expecting repo:org/repo:ref:refs/heads/main rejects AssumeRoleWithWebIdentity.

Helps with:SCS-C03
⚑ Report outdated

See it in the pattern →

Operations● verified 34 days ago◌ no external reviewer

There's only one OIDC provider per URL per account

Creating a second provider for token.actions.githubusercontent.com in the same account fails: IAM doesn't let you register the same URL twice in an account. If each repo ships its own Terraform stack with the provider inside, the second apply breaks. Create it once (in the account stack) and reference it with the data source; the module supports that with create_oidc_provider = false.

Helps with:SCS-C03
⚑ Report outdated

See it in the pattern →

Operations● verified 34 days ago◌ no external reviewer

For GitHub, IAM doesn't use the thumbprint to verify (and you don't need to set it)

IAM validates GitHub's certificate against its library of trusted root CAs, so thumbprint_list is optional and, in the Terraform provider, for IdPs like GitHub it's stored but not used for verification. Thumbprints only come into play if the IdP uses a certificate not signed by one of those CAs, or if AWS can't retrieve the TLS certificate or TLS v1.3 is required.

Helps with:SCS-C03
⚑ Report outdated

See it in the pattern →

Reliability● verified 34 days ago◌ no external reviewer

The session lasts 1 hour by default, and role chaining caps it at 1 hour regardless

AssumeRoleWithWebIdentity grants 3600 s by default; you can request up to the role's MaxSessionDuration (12 h max), and asking for more makes the call fail. If you assume another role from it (role chaining, common in multi-account), the session is capped at 1 hour. A long apply that runs past the limit fails mid-way with a half-written state.

Helps with:SCS-C03SAA-C03
⚑ Report outdated

See it in the pattern →

Private object ingestion with expiration (TTL)

IAM● verified 34 days ago◌ no external reviewer

A Deny on aws:SourceVpce locks you out too

An explicit Deny beats any Allow, including the admin's. If the policy denies all s3:* outside the endpoint, the console and the CI pipeline (outside the VPC) lose access, and you can end up unable to edit the bucket policy itself. This module limits the Deny to object operations and lets you exclude break-glass principals via aws:PrincipalArn.

Helps with:SAA-C03SCS-C03
⚑ Report outdated

See it in the pattern →

Zero Trust private web API with passwordless PostgreSQL

Security● verified 34 days ago◌ no external reviewer

HTTPS on an internal ALB still needs an SSL server certificate

To create an HTTPS listener you must deploy at least one SSL server certificate (from ACM or IAM). ACM cannot validate resources in a VPC private hosted zone or any other private domain, even if the ALB is internal. ACM does not validate domain ownership for imported certificates or for certificates signed by a private CA.

Helps with:SAA-C03SCS-C03
⚑ Report outdated

See it in the pattern →

Security● verified 34 days ago◌ no external reviewer

Let Secrets Manager manage the master user password

With manage_master_user_password = true, RDS generates the master password and stores it in Secrets Manager. The Terraform provider doesn't allow combining it with password, and RDS doesn't support it in some scenarios (for example Blue/Green deployments), so decide upfront.

Helps with:SAA-C03SCS-C03
⚑ Report outdated

See it in the pattern →