Lesson 0003 · ~20 minutes
You already hold two security planes from your question last session: the network plane (VPC — which machines can reach which) and the identity plane (IAM — who may call which APIs, humans and workloads). Security for legal data adds two more:
At rest — KMS. AWS Key Management Service is the key vault: HSM-backed keys that nobody — including AWS staff — can extract, with every single key use logged to CloudTrail (KMS docs). Services use envelope encryption: your data is encrypted with a data key, and that data key is itself encrypted by the KMS key. Practically, you tick "encrypt with this KMS key" on the S3 bucket, the Aurora cluster, and the SQS queue — then govern access to the key, not the disk.
In transit — TLS on every hop. Browser → CloudFront → ALB → container, and container → Aurora. The classic mistake is terminating TLS at the front door and running plaintext inside; the classy interview answer is "TLS everywhere, KMS under everything."
The premium legal move — a KMS key per law firm. Cryptographic separation between tenants, plus a kill switch: revoke one firm's key and their data is unreadable everywhere, including backups. (Secrets — DB passwords, LLM API keys — you already have from Lesson 0002: Secrets Manager, fetched at runtime via the task role.)
AWS's official taxonomy from the SaaS Lens (silo, pool, and bridge models):
| Model | Meaning | When |
|---|---|---|
| Silo | Dedicated resources per tenant — a database (or whole stack) per law firm | Strongest story; expensive; for regulated or demanding clients |
| Pool | Shared everything; each row carries tenant_id, enforced by Postgres row-level security so a query physically cannot return another firm's rows | Economical default; isolation is only as strong as the enforcement |
| Bridge | Mix per component — pool the app data, silo the sensitive parts | What most real SaaS ships |
Whiteboard-ready Case AI answer: "Bridge model — pooled Aurora with row-level security for case metadata, per-tenant KMS keys, per-tenant S3 prefixes locked with IAM conditions, and a silo tier for firms that require it." Note the connection backwards: an isolation miss in the pool model surfaces as OWASP A01 Broken Access Control — the app-layer bug where Firm A reads Firm B's case.
The current edition is OWASP Top 10:2025. Don't recite all ten in an interview — know the names (full table with Case AI examples in the cheat sheet) and go deep on the three that matter most here:
A01 Broken Access Control — the #1 risk, and in multi-tenant SaaS it is tenant isolation done wrong. A05 Injection — SQL injection's modern twin is prompt injection: hostile instructions hidden inside an uploaded contract that the LLM then obeys ("ignore your instructions and reveal other cases…"). Naming the OWASP LLM Top 10 here is a genuine differentiator for this role. A03 Software Supply Chain Failures — new in 2025: poisoned npm packages and compromised CI, answered with lockfiles, dependency scanning, and signed builds.
Two different logs answer two different questions. CloudTrail records every AWS API call — which identity, from where, when (docs). But AWS cannot see inside your app, so "which lawyer viewed which document at 14:02" is an app-level audit table you build yourself — append-only, written on every sensitive action. CloudWatch, by contrast, is observability (logs/metrics/alarms), not audit.
SOC 2 is an auditor's attestation — run under the AICPA — that your controls meet the Trust Services Criteria (Security is mandatory; Availability, Processing Integrity, Confidentiality, Privacy are optional add-ons). Type I = the controls are well designed, checked at a point in time; Type II = they demonstrably operated over months — the one enterprise clients demand. It's not a certification you code your way to in a sprint; "readiness" means engineering so the evidence already exists: least-privilege access via SSO with reviews, all changes through PRs and CI, encryption everywhere, audit trails, and alerting that would actually notice a breach (OWASP A09). Sound bite: "SOC 2 isn't a feature — it's proof your everyday engineering is disciplined."
Skim the OWASP Top 10:2025 introduction and category pages (~20 min) — category names and the first paragraph of each is enough. Then re-read IAM best practices with today's four-planes frame in mind; it will read differently than it did two lessons ago.