The AWS Security Reference Architecture
The whole AWS security estate as one architecture you can walk through: which account owns which service, what a guardrail can and cannot take away, where a packet gets stopped, and the order to build it in. Ten chapters, drawn account by account.
After the book by Avik Mukherjee — Core architecture (AWS Prescriptive Guidance). An original animated retelling of a freely published AWS guidance document — every picture, every question and every word of narration is written here, and every service is drawn as an original glyph rather than an AWS product icon. Not endorsed by AWS, and not a substitute for the guidance itself, which is updated as services change.
Written for people who already have AWS accounts. It assumes IAM basics, VPC basics and what an account is, and explains multi-account structure and security operations from scratch.
10 of 10 chapters ready · 5.2 hours · 574 scenes · 76 questions
Foundations
What the thing is, and the account structure every later chapter stands on.
- What the SRA Is, and What It Is For — 30 min, 56 scenes, 7 questions
- Organizations, Accounts and Guardrails — 28 min, 48 scenes, 7 questions
Account by Account
The one-page architecture, one account at a time, in the source’s own order: five accounts and about sixty services.
- The Org Management Account — 28 min, 52 scenes, 7 questions
- Security Tooling: Seeing Everything — 39 min, 66 scenes, 7 questions
- Security Tooling: Proof, Keys and Response — 31 min, 60 scenes, 7 questions
- The Network Account — 32 min, 63 scenes, 7 questions
- Shared Services and the Application Account — 38 min, 69 scenes, 7 questions
At Scale, and in Practice
What changes across Regions, the order to build it in, and what to go and check.
- Multi-Region Architecture — 34 min, 59 scenes, 7 questions
- Building It, in Six Phases — 27 min, 48 scenes, 7 questions
- The Best-Practices Checklist — 27 min, 53 scenes, 13 questions
Before you start
- The AWS SRA is a living document and this is a dated snapshot of it. Where the source states a limit, a default or a service name, this telling uses the source’s own wording rather than generalising — but services move, so check the current guidance before acting on anything load-bearing.
- Two distinctions the source draws deliberately and that are kept here: Security Hub CSPM and Security Hub are treated as different things, and centralized root access and declarative policies are recent additions.
- The lessons cover the document’s guidance, pages 8 to 179. Its reference back matter — the IAM resource list, the code-repository walkthrough, the contributor list and the service appendix — is not taught.
- The narration is synthesised speech, not a human reading. Captions are a keystroke away in the player.