Agenda and Introduction for Designing for Security

Welcome back, future solutions architects. I’m Michael Forrester. In this lesson/article we focus on designing for security — what I sometimes call the “Citadel of Security.” We’ll anchor concepts with stories, diagrams, and practice questions to build both conceptual understanding and exam readiness. This security section follows a clear sequence:

• General design principles for security
• The seven foundations of Security (aligned to the Well-Architected Framework)
• The shared responsibility model (what AWS manages vs. what you manage)
• Design patterns that increase security across nine major service areas
• A final Design for Security Design Challenge (applied exercise near the end)

We teach with diagrams, question analysis, and mock exam-style questions so you practice both architecture and exam techniques.

​

Design principles and the seven foundations

Key design principles we’ll apply throughout this section:

• Maintain traceability: document decisions, assumptions, and trade-offs so designs are auditable.
• Defense-in-depth: apply layered controls at network, host, application, and data layers.
• Automate security: use Infrastructure as Code, CI/CD gates, and continuous scanning to enforce standards.
• Least privilege: grant the minimum rights required and audit those privileges regularly.
• Observability and response: design for detection, alerts, and rapid automated or manual response.

The seven foundations of Security align to the AWS Well-Architected Framework and provide the attributes we use to evaluate designs. We’ll reference these foundations as organizing principles while mapping controls to services and patterns.

​

Categories for security actions

We group security controls into four fundamental categories. Every control typically maps to one or more of these areas: Use this table as a quick lookup when deciding where a control fits in a design or exam scenario.

​

Shared responsibility model

Understanding the shared responsibility model is critical: AWS manages the security of the cloud (hardware, global network, hypervisor, managed service infrastructure) while you manage security in the cloud (customer data, application configuration, identity, OS/network configuration, encryption). The boundary can shift depending on the service model (IaaS vs. managed services vs. SaaS). See the AWS documentation for the canonical explanation:

• AWS Shared Responsibility Model

​

Turning up security on services

Sections 4 through 11 review exam-style security questions and show how to “turn up” security across major service categories: network, compute, storage, databases, application integration, management, and data/machine learning. For many fully managed services, AWS handles lower-level security controls, but you must still configure service-specific settings (encryption, access policies, VPC integration). For compute and network (for example, EC2 or VPC), explicit configuration is often required. Below is a compact mapping to help during design and exams:

​

Design for Security Design Challenge

After the “Design for X” sections, you’ll encounter a Design for Security Design Challenge. The challenge presents an architecture diagram with missing components. Your task is to choose services or features that satisfy functional and security requirements and place them correctly in the diagram. Interaction tips:

• Read the requirement carefully and map it to one of the four security categories (IAM, Detect, Protect, Respond).
• Narrow choices by service capabilities (for example, does the option provide DDoS protection or web filtering?).
• Consider the shared responsibility boundary for each service before assuming a control is handled by AWS.

​

Example picks you might make while solving a challenge

• Internet name resolution: place Route 53.
• Rule-based web application filtering: place AWS WAF.
• Serverless, high-scale key-value store: place Amazon DynamoDB.
• Virtual machine requirement: place EC2.
• Serverless compute for event-driven tasks: place AWS Lambda.

​

Summary

• This security section is the first of four “Design for X” modules. We begin with AWS security fundamentals tied to the Well-Architected Framework, then apply security principles and reference architectures you’ll encounter on the exam.
• You will practice exam-style questions to sharpen architectural reasoning and exam technique.
• The Design for Security Design Challenge reinforces learning through a practical, applied exercise.

Thanks for joining this lesson/article — I’m Michael Forrester, and I look forward to guiding you through the rest of the security content.

​

Links and references

• AWS Well-Architected Framework
• AWS Shared Responsibility Model
• AWS WAF
• Amazon DynamoDB