SCS-C03 Domain 5: Data Protection (18%)

Data Protection is 18% of the SCS-C03 exam. You will see encryption in transit and at rest, key management with AWS KMS or CloudHSM, secret rotation, data integrity and retention, and how to mask sensitive information.

Weight on the exam: 18%. It is one of the six domains of the AWS Certified Security – Specialty SCS-C03 exam. Below is a summary of its tasks and skills according to the official AWS guide.

Tasks and skills tested

Services and tools to master

• AWS KMS
• AWS CloudHSM
• AWS Secrets Manager
• AWS Private CA
• S3 Object Lock and Glacier Vault Lock
• AWS Backup
• Amazon Data Lifecycle Manager
• AWS PrivateLink and VPC endpoints
• AWS Client VPN
• CloudWatch Logs data protection

Key facts for domain 5

Short summaries; each links to the study topic with the full note and its official source.

• The key policy grants no automatic access — Unlike other resource policies, a KMS key policy does NOT automatically grant permissions to the account.
• Unmanageable key — If a key policy gives access to only one user and you delete that user, the key becomes unmanageable and you must contact AWS Support.
• Key administrators vs key users — Key administrators manage the key but CANNOT use it in cryptographic operations.
• Grants for AWS services — Key users get CreateGrant, ListGrants and RevokeGrant only when the request comes from an integrated AWS service (condition kms:GrantIsForAWSResource).
• Automatic rotation — Automatic rotation only applies to symmetric encryption keys with key material generated by KMS (AWS_KMS origin).
• Rotating does not re-encrypt data — Rotation only changes the current key material: it does not rotate data keys or re-encrypt data already protected, and it does not mitigate a compromised data key.
• Manual vs automatic rotation — Asymmetric keys, HMAC keys and keys in custom key stores support neither automatic nor on-demand rotation: rotate them manually by creating a new key (and switching the alias).
• AWS managed keys — KMS automatically rotates AWS managed keys every year (about 365 days) and you cannot enable or disable that rotation.
• Multi-Region keys and rotation — In multi-Region keys, rotation is a shared property: you enable it and trigger it only on the primary key, and KMS copies the new material to the replicas before using it to encrypt.
• Key deletion — Deleting a KMS key requires a waiting period of 7 to 30 days (30 by default) and is irreversible once it ends.
• Alarm on use during deletion — During the waiting period you can cancel the deletion and create a CloudWatch alarm that warns you if someone or something tries to use the key.
• Deleting an asymmetric encryption key — With an asymmetric ENCRYPT_DECRYPT key, anyone holding the public key can keep encrypting outside KMS without notice, and that data cannot be decrypted after deletion.
• Imported key material (BYOK) — With imported key material you remain responsible for the material, but KMS uses a copy.
• Deleting imported material vs deleting the key — Deleting imported key material is temporary and reversible: you import it again.
• Symmetric ciphertext can't be recreated — A symmetric ciphertext is cryptographically bound to its KMS key: even if you recreate a key with the same material, it cannot decrypt it.
• Alarm for imported material expiration — Create a CloudWatch alarm that warns you when imported material is about to expire: when any material expires or is deleted, the KMS key stops working.
• Compliance vs Governance — In Compliance mode nobody can overwrite or delete the protected version, not even root, and the period cannot be shortened.
• Object Lock requirements and scope — Object Lock only works on buckets with versioning and protects the specified VERSION: it does not prevent new versions or delete markers.
• Legal hold — A legal hold protects like a retention period but has no expiration date and is independent of the retention period.
• Limit retention periods — With the s3:object-lock-remaining-retention-days condition key in the bucket policy you can set the minimum and maximum allowed retention.
• Types of rotation — Secrets Manager rotates secrets in three ways: managed rotation (no Lambda), managed external secrets rotation for partners (no Lambda), and rotation by Lambda function for everything else.
• What Macie is and what it analyzes — Macie discovers sensitive data in S3 buckets using machine learning and pattern matching, and evaluates bucket security.
• Automated discovery vs jobs — Macie's automated sensitive data discovery continually samples representative objects; sensitive data discovery jobs are deeper and targeted (one-time or recurring).
• Macie findings integration — Macie publishes findings to Amazon EventBridge (to automate with Lambda or SNS) and can send them to Security Hub.