Design Principles of the Security

Welcome back — Michael Forrester here. This article summarizes core security design principles you should apply when designing systems on AWS or preparing for the exam. These principles act as decision filters: they help you determine whether a proposed change increases security, decreases it, or has no effect. They also shape how you structure protection, detection, and response across services and accounts. Fundamentally ask three questions for every design decision:

• What are we trying to protect?
• How will we know the controls are working?
• How will we respond if something goes wrong?

The brief guidance below is actionable across architectures and cloud services.

---

​

1. Strong identity management

Identity and access management (IAM) is the foundation of good security. Use a central identity authority to manage users, groups, roles, and policies. Define clear processes for granting and revoking access, duration of access, and contextual conditions (e.g., MFA, source IP). On cloud platforms this usually means:

• Centralized identity (IAM, Organizations, or an external IdP).
• Least-privilege policies and short-lived credentials.
• Service roles for automation and managed groups for people.
• Using identity as the primary mechanism for authorization and for auditing actions.

---

​

2. Apply security at all layers (defense in depth)

Use multiple protective controls across the stack so a single failure does not lead to full compromise. Typical layers include:

• Perimeter and edge protections (WAF, CDN, perimeter firewalls).
• Network controls (VPC segmentation, network ACLs, security groups).
• Host/instance hardening (OS patches, host-based firewalls, secure baselines).
• Application-level defenses (input validation, auth/authorization checks, secure coding).

Defense in depth reduces blast radius and gives you more opportunities to detect and block threats.

---

​

3. Prepare for security events (incident response)

Have a documented incident response (IR) plan before an event. The plan should define:

• Detection and alerting.
• Containment and isolation steps.
• Investigation and evidence preservation.
• Recovery and business continuity actions.
• Post-incident review and remediation.

Preserve evidence (logs, snapshots, forensic images). Avoid ad hoc removals of compromised systems — follow your IR playbooks to enable root-cause analysis and reduce recurrence.

---

​

4. Track everything relevant (logging and monitoring)

Collect and centralize logs that matter: authentication events, API calls, system and app logs, configuration changes, and network flows. Centralized, immutable storage and strict access controls make audits and investigations feasible. Best practices:

• Send logs to a centralized, protected store with retention policies.
• Ensure logs are tamper-evident or write-once where appropriate.
• Monitor and alert on key signals (suspicious API calls, anomalous login patterns, configuration drift).

---

​

5. Reduce direct human access

Minimize manual, interactive access to production systems. Prefer automated, auditable workflows and service-based access. When humans must access systems:

• Use just-in-time (JIT) access and time-limited approvals.
• Employ session recording and privileged access workflows.
• Route access through bastions or session managers rather than broad SSH keys.

Reducing direct access lowers the risk of accidental or malicious changes.

---

​

6. Automate best practices

Automate repetitive security tasks to reduce human error and ensure consistency:

• Patching, configuration checks, compliance scanning, and reporting.
• CI/CD integration: static analysis, dependency scanning, and automated security tests.
• Policy enforcement using automation (policy-as-code, guardrails).

Automation enables scale and reduces time-to-remediation.

---

​

7. Protect data in all states

Protect data at rest, in transit, and where possible in use. Consider:

• Encryption at rest (server-side or client-side) and in transit (TLS).
• Centralized key management (managed KMS) and rotation policies.
• Minimizing plaintext exposure in logs, backups, or memory.
• Treating configuration, backups, repos, and keys as sensitive data.

Use proven cryptographic primitives and align your key management strategy with regulatory requirements.

---

​

SAPTRAP — a mnemonic to remember the seven principles

• S — Strong Identity Management
• A — Apply Security at All Layers
• P — Prepare for Security Events
• T — Track Everything Relevant
• R — Reduce Direct Contact
• A — Automate Best Practices
• P — Protect Data in All States

---

​

Example: Applying SAPTRAP to an object storage bucket

• Protect data in all states: Enable object encryption (server-side encryption with KMS, provider-managed SSE, or client-side encryption). Also ensure backups and replicas are encrypted.
• Track everything relevant: Enable server access logging or API audit logging to capture who accessed objects and from which IPs; centralize and protect these logs.
• Strong identity management: Use identity-based IAM policies and roles for fine-grained access. Prefer identity and resource policies over legacy ACLs unless you require ACLs for a specific scenario.

Note: service features and defaults vary by account and region. Verify account and region settings and enable controls such as default encryption, block public access, and centralized logging according to your security requirements.

---

​

Quick reference table

---

Summary

• Use these design principles as decision guides to balance security, reliability, and cost.
• Focus on identity, defense in depth, incident response, centralized logging, minimized direct human access, automation, and data protection.
• Memorize SAPTRAP and map service capabilities to these principles when designing systems or answering architecture questions on the exam.

Thanks for reading this section. We’ll move on to the next section next. Further reading and references:

• AWS Identity and Access Management Documentation
• AWS Well-Architected — Security Pillar