Skip to main content
Welcome back, Solutions Architects — Michael Forrester here.
In this lesson we focus on designing reliability for AWS security services: which services expose reliability controls you can manage, and which are fully managed by AWS. You’ll learn practical reliability levers (multi-AZ, cross‑Region replication, clustering), and where to rely on AWS-managed resilience.
Many AWS security services are fully managed and built for high availability. Your primary responsibility is to integrate their telemetry and findings into resilient detection, incident response, and recovery workflows rather than changing the core service resilience.

​
Identity, authentication, and authorization

  • IAM (AWS Identity and Access Management): AWS manages availability and resilience for IAM. Design decisions you make around permission models (least privilege, role chaining, delegation, policy scoping) impact security posture and operational reliability but are not availability knobs.
  • IAM Identity Center (AWS SSO): Integrate with trusted identity providers and configure SSO, but the service’s underlying availability is AWS-managed.
  • Amazon Cognito: A highly managed authentication solution (user pools, federated sign-in, tokens). Cognito follows AWS resiliency best practices (multi‑AZ, managed failover).
An AWS IAM infographic showing "AWS Identity and Access Management" with three panels: Who (workforce users and workloads), Can access (permissions with IAM policies), and What (resources within your AWS organization). It summarizes that IAM applies fine‑grained permissions to AWS services and resources.
A flow diagram illustrating Amazon Cognito User Pools: it shows interactions between a user, the Cognito user pool, an identity provider, an app, and an API/database with arrows for sign-in, redirects, challenges, token issuance, and data retrieval. The slide also includes a caption noting Cognito is a highly managed AWS authentication service.
  • Directory Service (AWS Managed Microsoft AD): Deployed Multi‑AZ in a Region by default. For cross‑Region disaster recovery, configure AD replication or deploy additional directory instances in other Regions.
A diagram titled "Directory Service" showing AWS Directory Service/Active Directory deployed across multiple AWS accounts and regions with VPCs, Transit Gateways, VPC peering and AD replication. It also shows domain member instances in several VPCs and indicates directory sharing and DR/multi‑AZ considerations.
  • Verified Permissions (policy-as-code): Focuses on correctness, governance, and runtime authorization integration. Reliability considerations are about ensuring authorization workflows and policy evaluation scale and are observable; the service itself is managed.
A diagram titled "Verified Permissions" showing the Amazon Verified Permissions workflow: create your schema, manage and govern policies, and authorize access. It also shows integrations with identity providers and AWS services (Amazon API Gateway, AWS Lambda, AWS AppSync) for runtime authorization.

​
Auditing, monitoring, and telemetry

  • CloudTrail: Captures API activity. Service resilience is AWS-managed. You should design alerts, EventBridge rules, and CloudWatch alarms to surface important API events and automate responses.
  • AWS Config: Managed, redundant service for configuration monitoring and compliance detection — use its outputs to detect drift and automate remediation.
  • AWS Artifact: Provides compliance documents — no customer-managed availability knobs.
Design guidance: centralize logs and findings, create automated detection pipelines, and ensure monitoring outputs are replicated or archived if you require longer retention or cross‑Region redundancy.

​
Threat detection and scanning

  • Amazon GuardDuty: Managed threat detection that ingests CloudTrail, VPC Flow Logs, DNS logs, S3 data events, and more. Highly available and designed for continuous detection.
  • Amazon Inspector, Amazon Macie: Managed scanning and data classification services. Focus on integrating findings into automated remediation and incident response playbooks.
An infographic showing AWS GuardDuty’s workflow: data sources (CloudTrail, VPC flow logs, DNS, S3, EKS, Aurora) feed security analytics (ML, threat intelligence, continuous learning) which produce actionable security findings. The findings are then sent to integrations like Amazon Detective, AWS Security Hub, EventBridge and partner solutions.
  • Resilience Hub: Centralizes resiliency posture assessments. It aggregates data to help you improve detection and response but does not expose availability knobs for the underlying security tools.

​
Encryption and key management

  • AWS Key Management Service (KMS): Regional, highly available, AWS‑managed HSM-backed key service. AWS manages availability; design around key usage patterns and cross‑Region replication of encrypted data rather than KMS internals.
  • AWS CloudHSM: Customer-controlled HSM cluster. Use multi‑AZ deployment and cluster configurations for redundancy. You manage cluster lifecycle, backups, and recovery operations.
A presentation slide titled "AWS Encryptions" showing a KMS key and a diagram where an encrypted data key is run through a decryption algorithm to produce a plaintext data key. The left-side text notes that KMS and CloudHSM provide data encryption keys on software or physical appliances.
A slide titled "DKMS/CloudHSM" showing an AWS architecture diagram. It depicts an application in a customer VPC connecting via ENIs to a CloudHSM cluster of HSMs, with backup and restore to an S3 bucket.
If you choose CloudHSM to retain full control of key material, plan for operational overhead: multi‑AZ cluster design, automated backups (to encrypted S3), monitoring for node health, and documented recovery procedures.

​
Certificates and private PKI

  • AWS Certificate Manager (ACM): Fully managed certificate issuance and renewal. Availability is managed by AWS.
  • AWS Private Certificate Authority (Private CA): Managed private PKI. High availability is provided by AWS; focus on certificate lifecycles and automation.
A slide titled "Certificate Manager" showing a client connecting to AWS Certificate Manager and a Certificate Manager that issues certificates to Amazon EC2 and an Application Load Balancer. The caption notes it manages SSL/TLS certificates but offers few reliability levers.
A diagram titled "Private Certificate Authority" illustrating AWS Private Certificate Authority issuing and managing private certificates. It shows integration with AWS Certificate Manager and AWS services (Amazon MSK, EKS, IoT Core) and consumers like VPN users, service meshes, IoT devices, and on‑premises systems.

​
Secrets and cross‑Region resilience

  • AWS Secrets Manager: Stores, rotates, and optionally replicates secrets. Default operation is highly available within a Region; Secrets Manager supports automatic cross‑Region replication to create standby copies for DR scenarios.
An infographic question about failing over database access if us-east-1 goes down, asking which AWS Secrets Manager capability meets the requirement. The correct answer shown is that Secrets Manager supports automatic cross-region replication of secrets to create standby copies, while other services don’t replicate secrets across regions.

​
Networking security: groups, NACLs, firewalls, and DDoS

  • Security Groups and Network ACLs: Native VPC controls; AWS manages their resilience as part of the VPC control plane.
  • AWS Firewall Manager: Centralized enforcement for security groups, WAF rules, Network Firewall policies, and Shield protections—helps improve operational reliability by maintaining consistency across accounts and resources.
  • AWS Network Firewall: Managed stateful inspection for VPC traffic. Deploy across AZs in active‑active for redundancy; use Firewall Manager for centralized policy.
  • AWS WAF: Highly available, globally distributed; deploy at CloudFront edge for global coverage, or in front of regional endpoints (ALB, API Gateway).
  • AWS Shield: Shield Standard provides baseline DDoS protection at no cost; Shield Advanced is a paid service with enhanced mitigations, DRT access, and Firewall Manager/WAF integrations for high‑risk workloads.
A slide titled "Security Groups" showing an AWS VPC diagram with two availability zones, each containing public and private subnets that host web and database servers. Red lines indicate security group boundaries and left-side text notes that SecGroups and NACLs are essential to AWS operation.
A slide titled "Designing for Reliability – Web Application Firewall (WAF)" showing an architecture diagram where AWS WAF sits in front of an Application Load Balancer in a public subnet and protects traffic to an Amazon Lightsail WordPress application in a private subnet via VPC peering. The left text notes that "AWS WAF is a global highly managed service" with reliability built in.
A diagram of AWS Shield architecture showing users connecting through Amazon Route 53, Amazon CloudFront and AWS WAF within AWS Edge Services. Traffic is protected by AWS Shield Standard and can be routed to AWS Cloud infrastructure or external/on‑premises servers.
A presentation slide titled "Shield Advanced" showing an AWS Shield Advanced architecture diagram. It highlights components like AWS Shield, AWS WAF, AWS Firewall Manager, Global Accelerator/ELB/CloudFront/Route53 and custom mitigations for DDoS protection.
A diagram of a network firewall architecture showing four protected VPCs (A–D), each containing a firewall subnet with a firewall endpoint and a protected workload subnet. A virtual network firewall endpoint (cloud icon) points to the per-VPC firewall endpoints for redundant routing.
A slide-style infographic titled "Firewall Manager" that explains AWS Firewall Manager and its role in centrally applying firewall rules. It shows components like AWS Security Hub and AWS Firewall Manager and lists supported services (AWS WAF, Network Firewall, Shield, Route 53 Resolver DNS Firewall, security groups, and third-party firewalls).

​
Centralized telemetry and investigations

  • Amazon Security Lake: Aggregates security telemetry into an S3-based data lake for analytics (Athena, OpenSearch, SageMaker) and security tools. Security Lake is managed and provides centralized data to improve detection, investigation, and recovery workflows.
A slide diagram titled "Reliability Lake" illustrating the Amazon Security Lake architecture. It shows security data from sources (VPC, S3, CloudTrail, Lambda, Route 53, etc.) being centralized into an S3-based data lake and analyzed with tools like Amazon Athena, OpenSearch, and SageMaker.

​
Quick reference table — Service reliability models and customer controls

​
Key takeaways

  • Many AWS security services are fully managed and designed for availability — you often won’t have direct “reliability knobs.”
  • When controls exist, they usually involve: enabling multi‑AZ or cross‑Region replication, deploying clustered hardware (CloudHSM), or creating standby copies (Secrets Manager).
  • Focus on integration: centralize telemetry into CloudTrail, CloudWatch, Security Hub, and Security Lake; build event-driven detection/remediation using EventBridge, Lambda, and automated runbooks.
  • Use centralized policy and governance tools (Firewall Manager, Verified Permissions) to improve operational consistency and reliability across accounts.
A presentation slide titled "Summary" with four numbered points about reliability services, mentioning replication/Multi‑AZ, a Reliability Hub, and logging into CloudWatch and CloudTrail. The slide has a blue gradient left panel and colorful numbered icons next to each bullet.
Thanks for reading this lesson — the last section on reliability for the AWS Solutions Architect Associate Certification. If you have questions, catch me on the forums or email michael@kodekloud.com.

Watch Video