Security and Compliance

Before choosing any service, place the task on the AWS Shared Responsibility Model: AWS owns "security OF the cloud" (data centers, hardware, hypervisor, managed network) and the customer owns "security IN the cloud" (data, identity, configuration). That dividing line rises as the service becomes more managed (AWS absorbs more of the stack), so the customer's share shrinks across EC2 → RDS → Lambda: EC2 leaves the guest OS, patching, and firewall to the customer, RDS hands engine patching to AWS, and Lambda removes the OS entirely. What never shifts up the stack is data classification, IAM permissions, and client-side encryption: always the customer's. On the exam, the first move for any "who is responsible?" stem is to ask which side of this line the task falls on, then which abstraction tier the named service occupies.

Running on AWS lets you inherit the certifications AWS already holds for its infrastructure (SOC, ISO 27001, PCI DSS, FedRAMP, and more) instead of auditing data centers yourself, and you pull the audit evidence on demand from AWS Artifact at no additional cost. Inheritance is not blanket: which programs apply depends on geography, industry, and the specific service, so you must check the published "Services in Scope" rather than assume coverage. Artifact hands you AWS's reports. It does not assess whether your own buckets, security groups, or IAM policies are configured compliantly; that is your job, performed with services like AWS Config.

AWS exposes one service per audit question rather than one tool that does everything, so the exam tests whether you can pick by input. AWS CloudTrail records account activity (who made which API call, when, from where) while AWS Config records resource configuration over time and evaluates it against rules. Among detection services, Amazon GuardDuty analyzes logs for malicious activity, Amazon Inspector scans workloads for software vulnerabilities, Amazon Macie finds sensitive data in S3, and AWS Security Hub aggregates all of their findings; none of these detection services block traffic. They alert, and a separate enforcement layer (AWS WAF, security groups) does the blocking.

IAM (free and global) authenticates principals and authorizes their API actions, and because every cloud action flows through it, getting identity right matters more than any single network control. The exam-correct posture is least privilege (grant only what a task needs), IAM roles delivering short-lived auto-rotated credentials instead of long-lived access keys, IAM Identity Center for workforce sign-on across many accounts, and secrets kept in Secrets Manager or Parameter Store rather than in code. The account root user sits above IAM with unrestricted access, so it must be protected with MFA, stripped of access keys, and never used for daily work.

Once identity and detection are in place, the protective services map onto the layer they defend: AWS WAF inspects layer-7 HTTP/HTTPS requests and blocks web exploits such as SQL injection and cross-site scripting, while AWS Shield absorbs network/transport-layer (layer 3/4) DDoS floods, Shield Standard automatically and free for everyone. Encryption is its own pair of layers: KMS-backed encryption at rest protects stored data (S3 even applies SSE-S3 to every new bucket by default), and TLS protects data in transit on the wire. When breadth across many accounts is needed, Firewall Manager enforces WAF and Shield Advanced policies organization-wide, and Trusted Advisor and AWS Marketplace round out best-practice checks and third-party tooling.