Congratulations
1. Congratulations
Welcome back, and congratulations. That is the whole course. You started with a deploy that failed for the wrong reason. You finish able to say which identity AWS checked, what it could reach, and where the receipt lives. Let's walk back through the three chapters.2. Which identity AWS checks
Chapter one settled whose permissions get checked. You are the actor, but AWS checks the principal: the role your code runs as. Then you read a policy the way the engine does, explicit deny first.3. Which identity AWS checks
Then you swapped the stored key for a role, for credentials that expire on their own and get signed with SigV4 on every request. A pre-signed URL hands over one object, not the keys.4. Who may reach what
Chapter two moved to your application. Cognito is two services in one name: a user pool signs people in, and an identity pool hands out AWS credentials. Verify the token, then doubt the claims.5. Who may reach what
Then three layers: identity policy, resource policy, and a permissions boundary that caps what either grants. You narrowed one tenant to its own rows in a shared table, learned which request walks straight past that condition, and kept the password in Secrets Manager, out of the log.6. Prove it, then ship it
Chapter three was about proof. S3 encrypts every new object by default, so whether something is encrypted tells you little. Which mode, and who holds the key, do. And a KMS key has two gates, key policy and IAM, that both must open.7. Prove it, then ship it
The trail names the principal, but data events stay off until you ask. Then a role gets right-sized from what it used, and you run six questions over the service before you ship it.8. Where this takes you
Those six questions are the part that travels. Identity, authorization, keys, and evidence are what every service you build will ask about, whatever the provider.9. Where this takes you
It also counts toward a certification. Security is a large part of the AWS Certified Developer Associate exam, and this course covers that domain. Beyond it sits AWS Certified Security Specialty, a security-only exam for people who do this full time. This course is a real start on it, not a substitute.10. Where to go next
Thank you, and congratulations once again! Next time you create a role, ask what its worst day would look like.Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.