Security, compliance, and governance
AWS Services for Governance and Compliance
Six services, six jobs
The story: An office building has six people keeping it in order:
- A photographer who photographs every room each day, so you can see exactly how the room was set up last Tuesday.
- A building inspector who keeps checking for faulty wiring and doors left open to the street.
- An audit assistant who collects receipts and signed forms automatically, so the yearly audit is ready.
- A records office where you can pick up the building's official certificates to show a client.
- A security desk logbook that records who entered which room, did what, and when.
- A consultant who walks around and suggests how to save money, run faster, and be safer.
In AI/AWS terms:
| Office role | Service | What it does | Pick it when the question says... |
|---|---|---|---|
| Photographer | AWS Config | Records resource configurations and their history, detects misconfigurations | "Track configuration changes", "show historical configuration for an audit" |
| Building inspector | Amazon Inspector | Continuously scans for software vulnerabilities (CVEs) and unintended network exposure in EC2, container images, and Lambda, with risk scores from the NVD | "Find vulnerabilities" |
| Audit assistant | AWS Audit Manager | Automates evidence collection to assess whether controls work, and manages audit reviews | "Continuously audit", "collect evidence" |
| Records office | AWS Artifact | On-demand downloads of AWS compliance reports (ISO, PCI, SOC) and ISV reports from AWS Marketplace | "Download compliance reports for auditors", "due diligence on Marketplace vendors" |
| Security logbook | AWS CloudTrail | Logs API activity: who did what, to which resource, and when | "Who made this change?", "audit account activity" |
| Consultant | AWS Trusted Advisor | Best-practice checks for cost, performance, resilience, security, operational excellence, and service limits | "Recommendations to optimize and secure the account" |
For the exam: Match the question's wording to the service in the last column.
Easy to mix up
The story: The photographer shows how a room looked; the logbook shows who did something in it. The records office hands you certificates someone else earned; the audit assistant helps you run your own audit. The building inspector finds weak spots; a security guard (next lessons) catches actual intruders.
In AI/AWS terms:
- Config tracks resource state. CloudTrail tracks user and API actions.
- Artifact gives you reports. Audit Manager helps you run your own audits.
- Inspector finds vulnerabilities. GuardDuty finds threats.
For the exam: "What did it look like?" = Config. "Who did it?" = CloudTrail. "Give me AWS's compliance report" = Artifact.