AWS Cloud Practitioner Essentials T2.2

AWS Cloud Security, Governance, and Compliance Concepts

• Compliance in AWS means adhering to industry, geographic, and organizational regulations, standards, or frameworks. AWS provides tools for meeting these requirements (e.g., HIPAA for healthcare data).

AWS Governance

• Governance involves setting policies, procedures, and controls to manage cloud resources securely and efficiently.
• AWS Organizations facilitate centralized management of multiple accounts.
• Service Control Policies (SCPs) define access permissions across accounts.

Cloud Security Benefits

• Encryption: Protects data in transit (e.g., HTTPS, TLS) and at rest (e.g., encrypting S3 buckets).
• Built-in Security: AWS secures its global infrastructure and provides tools like AWS WAF and AWS Shield.
• Scalability and Automation: Security services like AWS Security Hub and Amazon GuardDuty are scalable and provide continuous monitoring.

Logs Associated with Cloud Security

• AWS CloudTrail: Tracks all API activity in an account (e.g., instance creation).
• Amazon CloudWatch Logs: Monitors application and service log files (e.g., app performance).
• VPC Flow Logs: Captures network traffic to and from a VPC (e.g., network connections).
• AWS Config: Records configuration changes to resources (e.g., S3 bucket access).

Identifying AWS Compliance Information

• AWS Artifact: Self-service portal for compliance reports and certifications (e.g., ISO certifications, SOC reports).
• AWS Compliance Center: Resource hub for compliance details organized by region and industry.

Compliance Needs by Location or Industry

• Geographic Compliance: GDPR for EU data, C5 (Germany) for cloud security in Germany.
• Industry Compliance: HIPAA for healthcare, PCI DSS for payment cards.
• Multi-Region Services: Deploy resources in specific regions for local compliance needs.

Securing Resources on AWS

• Amazon Inspector: Assesses application vulnerabilities running on EC2 (e.g., unpatched software).
• AWS Security Hub: Centralizes security alerts and provides a unified security view (e.g., misconfigured S3 buckets).
• Amazon GuardDuty: Detects threats using machine learning and anomaly detection (e.g., unusual login activity).
• AWS Shield: Protects against DDoS attacks (e.g., blocks malicious traffic).
• AWS WAF: Protects web applications by filtering malicious traffic (e.g., blocks fake requests).

Encryption Options

• Encryption in Transit: Data protection during transfer (e.g., HTTPS).
• Encryption at Rest: Data protection in storage (e.g., encrypting S3 objects).
• Customer-Managed Encryption Keys (CMEK): Customers manage their encryption keys using AWS KMS.

Services for Governance and Compliance

• Amazon CloudWatch: Monitors resources and applications for security and performance.
• AWS CloudTrail: Audits user activity and API calls.
• AWS Config: Records and tracks resource configuration changes.
• AWS Audit Manager: Automates audit evidence collection.
• Access Reports: Summarizes user permissions and identifies excessive access.

Compliance Requirements Vary by Service

• Responsibilities differ depending on the service (e.g., EC2 - customer secures OS/applications, AWS manages physical infrastructure; Lambda - AWS manages most security, customers ensure function code security).