SCS-C03 Infrastructure Security Guide

Infrastructure security on SCS-C03 is about putting the right protection on the real traffic and workload path. AWS is not only testing whether you know the names of WAF, Shield Advanced, Network Firewall, Inspector, or Session Manager. It is testing whether you can choose the right control plane for edge exposure, compute hardening, and network segmentation without solving the wrong layer.

What AWS is explicitly testing

As of May 11, 2026, the current AWS Documentation exam guide splits this domain into three tasks:

• Task 3.1: design, implement, and troubleshoot security controls for network edge services
• Task 3.2: design, implement, and troubleshoot security controls for compute workloads
• Task 3.3: design and troubleshoot network security controls

That split matters on the exam. If the problem is about public entry points, WAF rules, CloudFront behavior, or edge integrations, it belongs in task 3.1. If it is about EC2, containers, Lambda, images, patching, workload roles, or administrative access, it belongs in task 3.2. If it is about security groups, network ACLs, Network Firewall, hybrid connectivity, Verified Access, or segmentation, it belongs in task 3.3.

Current weight in the exam guide

AWS currently weights this domain at 18% of scored content.

Work this domain in order

Start with 3.1 Edge Security Controls to lock down public entry points, WAF logic, Shield, edge protections, and third-party integration choices.

Then move to 3.2 Compute Workload Security Controls for hardened images, workload roles, patching, Inspector, Session Manager, and secure pipeline controls.

Finish with 3.3 Network Security Controls for security groups, network ACLs, Network Firewall, hybrid/multi-cloud connectivity, Verified Access, and segmentation.

Fast routing inside this chapter

What strong SCS-C03 answers usually do

• choose controls at the correct layer instead of piling multiple unrelated security tools onto the same problem
• harden the workload image and management path before focusing on incident-time cleanup
• distinguish edge-service protection from deeper network segmentation
• use temporary workload roles and managed administrative access instead of embedded credentials and open SSH
• remove unneeded paths rather than only adding more monitoring to already-exposed resources

Common infrastructure-security traps

• using security groups to solve an application-layer edge threat that really needs WAF
• relying on manual host access when Session Manager is the stronger administrative path
• assuming patching alone is enough when the image build and runtime controls are weak
• confusing network ACL behavior with security group behavior
• selecting “encrypted connectivity” when the real problem is over-broad reachability or missing segmentation

Best review order late in prep

Revisit this chapter when:

• edge-service questions and network-segmentation questions still blur together
• you know the services but still choose the wrong control layer
• compute hardening scenarios make you jump too fast to incident response instead of preventive controls
• hybrid network security questions still feel like pure connectivity questions

In this section

• SCS-C03 Edge Security Controls Guide
  Study SCS-C03 edge security for CloudFront, AWS WAF, Shield Advanced, rate limits, geography rules, and third-party edge integrations.
• SCS-C03 Compute Workload Security Controls Guide
  Study SCS-C03 compute security for hardened images, workload roles, Inspector, patching, Session Manager, and secure pipeline controls.
• SCS-C03 Network Security Controls Guide
  Study SCS-C03 network controls for security groups, network ACLs, Network Firewall, hybrid secure connectivity, Verified Access, and segmentation.