1.2. Core Cloud Security First Principles
Without a foundation of security principles, every AWS service looks like an isolated tool — you know what each one does but not when to reach for it or why one is preferred over another. Think of first principles like the laws of physics for security: once you understand that gravity pulls everything down, you don't need to memorize what happens when you drop each individual object. Similarly, once you understand least privilege, you can derive the correct IAM configuration for any service without memorizing every possible policy statement. What happens when you skip principles and jump straight to services? You'll recognize every term on the exam but struggle to choose between two plausible answers that differ by a single architectural trade-off.
This section establishes three foundational security principles — defense-in-depth, zero trust, and security automation — that you'll apply repeatedly across all six exam domains.
Scenario: An exam question presents two architecturally valid solutions. Both achieve the security goal, but one applies defense-in-depth while the other relies on a single strong control. Without principle-based reasoning, both look correct.
Reflection Question: How do security first principles help you differentiate between "technically correct" and "architecturally optimal" answers on the exam?
