After doing these courses, I feel confident creating professional visualizations and dashboards
Shoebur RahmanProcurement Specialist, Giz Bangladesh
Course Description
When your code calls AWS, whose permissions are actually being checked? Get that wrong and you ship a role that can read every bucket in the account. Using AWS Security for Developers is built for developers shipping real workloads on AWS, walking through the security decisions the job actually requires. You'll replace long-lived keys with short-lived, role-based access, and read an IAM policy well enough to predict whether it allows or denies. You'll choose the right authorization for APIs and application users, keep secrets out of code and logs, and pick encryption an auditor can verify. Finally, you'll read CloudTrail evidence and tighten a role from what it actually did. With hands-on scenarios built around one running application, you'll leave with security decisions you can defend, and a practical foundation in the Security domain of the AWS Certified Developer - Associate exam.
Prerequisites
Curriculum
Course outline
1
Identity and least privilege on AWS
In this chapter, you'll build the mental model that keeps real AWS workloads safe: separating the actor from the principal AWS actually evaluates. You'll then learn to read an IAM policy the way AWS does, working out whether a call is allowed, denied, or silently blocked by nothing at all. Finally, you'll replace long-lived access keys with role assumption, temporary credentials, and pre-signed URLs, the pattern that removes a key from a repository for good.
- Introduction to AWS Security50 XP
- Identify over-permissioned access paths50 XP
- Give the function a narrow role50 XP
- Almost nothing runs as you50 XP
- IAM policy evaluation and explicit deny50 XP
- Map policy parts to their purpose100 XP
- See implicit deny in action50 XP
- Predict the evaluation outcome100 XP
- Roles, temporary credentials, and SigV450 XP
- Decide who may assume the role50 XP
- Scope a pre-signed URL50 XP
- Swap a stored key for a role50 XP
2
App authentication and authorization
In this chapter, you'll draw a clean line between Cognito user pools for sign-in and identity pools for AWS credentials, then verify a token's signature before you trust anything inside it. You'll then map where a permission really comes from among identity policies, resource policies, and the boundaries that cap them, and use that map to choose between IAM, Cognito, and Lambda authorizers for an API Gateway endpoint. Finally, you'll keep secrets out of code and logs, picking the store, the masking, and the rotation habits that survive an incident review.
3
Encryption and Receipts
In this chapter, you'll match encryption mode to requirement: the four ways to encrypt an S3 object, and the one policy line that enforces transit. You'll then work out who really controls a KMS key when a key policy and an IAM policy both have a say, and read CloudTrail closely enough to know when its silence means nobody was logging, not that nothing happened. Finally, you'll run the whole course's checklist against one service you are about to ship, and see where the same identity, secrets, and encryption decisions carry into pipelines and AI agents calling AWS on your behalf.
Using AWS Security for Developers
Course
Complete
