How to use this handbook
Scenario-first notes for SCS-C03. Each page is a security decision, not a service data sheet.
SCS-C03 rarely asks what a service does. It describes an account, an organization or an incident, and asks for the control that meets the requirement with the least privilege, least exposure or least effort. These notes are built around those decisions: which control wins under which constraint, and which option looks secure but isn't.
Reading a page
Each page follows the same shape:
The decision. One line on the security question the topic answers.
The picture. A diagram or comparison table that shows the moving parts, such as where a log lands, which policy is evaluated first, or which key encrypts what.
Signals and traps. The wording that points to an answer, and the tempting options that are wrong.
Scenarios. Short exam-style questions you can answer on the page. Your answer is checked right away.
The callouts
Exam signal
A keyword or constraint that usually decides the answer.
Trap
A common wrong answer, and why it's wrong.
Legacy: use the newer service or feature instead
Something older study guides still teach that AWS has retired or renamed.
The domains
| Domain | Weight | Start here |
|---|---|---|
| 1 · Detection | 16% | Finding threats and misconfigurations, and logging everything you'll need later |
| 2 · Incident response | 14% | Planning for incidents, then containing and investigating them |
| 3 · Infrastructure security | 18% | Edge, network and compute controls |
| 4 · Identity and access management | 20% | Who can sign in, and what they can do once they have |
| 5 · Data protection | 18% | Encryption in transit and at rest, keys, secrets and sensitive data |
| 6 · Security foundations and governance | 14% | Multi-account structure, secure deployment and compliance |
The domains overlap on purpose. A leaked access key touches detection (GuardDuty finds it), incident response (you revoke it), IAM (you scope what it could do) and governance (an SCP limits the damage). Pages link to each other where that happens.
Sections follow the six domains of the official SCS-C03 exam guide, and each page lists the exam tasks it covers. Start with the exam itself.
Independent notes
This is an independent study resource. It is not affiliated with or endorsed by Amazon Web Services. Service behaviour changes over time, so check the linked AWS documentation for current limits and pricing.