Security Pillars of the Well-Architected Framework

The Well-Architected Framework is AWS's set of best practices, grouped into pillars. The Security pillar shapes how the exam wants you to think.

The framework has six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. The exam focuses on Security.

The first principle: build a strong identity foundation. Apply least privilege, separate duties, centralize identity, and prefer temporary credentials.

Second principle: enable traceability — monitor, alert, and audit changes in real time. That is why CloudTrail, Config, and CloudWatch matter so much.

Next: apply security at all layers, not just one outer boundary — edge, VPC, subnet, instance, OS, and app. It is defense in depth as a design rule.

The framework urges you to automate security. Define controls as code so secure setups are repeatable, and responses to events are fast and consistent.

Protect data with encryption, tokenization, and access control — at rest and in transit. Classify it by sensitivity and limit who can touch it directly.

A key practice: keep people away from data. Use tools and automation so humans rarely touch it raw — fewer hands means fewer chances for exposure.

The last principle: prepare for security events. Assume incidents will happen, keep runbooks ready, and run simulations. Preparation is itself a control.

When two answers both work, the principles break the tie: prefer least privilege, more automation, more traceability, and encryption by default.

Each principle maps to real services: identity to IAM and STS, traceability to logging, layered security to network defenses, data protection to KMS.

Recall the Security pillar principles.

The Security pillar sets the principles: strong identity, traceability, security at all layers, automation, data protection, and preparing for events. Use them as a tie-breaker.