Domain 2: Security and Compliance

AWS Certified Cloud Practitioner (CLF-C02) — Domain 2: Security and Compliance

Exam Code: CLF-C02  |  Level: Foundational
Domain Weight: 30%  |  Total Domains: 4  |  Passing Score: 700 / 1000

---

Table of Contents

1. The Shared Responsibility Model
   • 1.1 Core Division
   • 1.2 Responsibility by Service Type
2. AWS Identity and Access Management (IAM)
   • 2.1 IAM Entities
   • 2.2 IAM Policies
   • 2.3 Policy Types
   • 2.4 Policy Evaluation Logic
   • 2.5 Multi-Factor Authentication
   • 2.6 Identity Federation and Amazon Cognito
   • 2.7 IAM Security Best Practices
3. AWS Organizations
   • 3.1 Structure and Components
   • 3.2 Service Control Policies
   • 3.3 Consolidated Billing
4. AWS Security Services
   • 4.1 Threat Detection and Investigation
   • 4.2 Vulnerability and Compliance Assessment
   • 4.3 Perimeter Protection
   • 4.4 Security Aggregation and Automation
5. Data Protection and Encryption
   • 5.1 Encryption Fundamentals
   • 5.2 AWS Key Management Service (KMS)
   • 5.3 AWS CloudHSM
   • 5.4 AWS Certificate Manager
   • 5.5 AWS Secrets Manager
6. Network Security
   • 6.1 Security Groups
   • 6.2 Network Access Control Lists (NACLs)
   • 6.3 Security Groups vs NACLs
   • 6.4 AWS VPN and Direct Connect
7. Logging, Monitoring, and Auditing
   • 7.1 AWS CloudTrail
   • 7.2 Amazon CloudWatch
   • 7.3 AWS Config
   • 7.4 Service Comparison
8. Compliance and Governance
   • 8.1 AWS Compliance Programs
   • 8.2 AWS Artifact
   • 8.3 AWS Control Tower
   • 8.4 AWS Audit Manager
9. Exam Tips and Quick Reference

---

1. The Shared Responsibility Model

1.1 Core Division

The Shared Responsibility Model defines what AWS secures versus what the customer secures. It is the single most tested concept in this domain.

AWS is responsible for — "Security OF the Cloud"

Customer is responsible for — "Security IN the Cloud"

Exam Tip: The dividing line shifts based on the service. For EC2 (IaaS) the customer manages the OS. For RDS (managed service) AWS manages the OS and DB engine patches — the customer manages the schema, data, and DB user access.

---

1.2 Responsibility by Service Type

---

2. AWS Identity and Access Management (IAM)

IAM controls authentication (who you are) and authorization (what you can do) in AWS. It is a global service with no additional cost. New IAM identities have zero permissions by default.

2.1 IAM Entities

Key Concept: Use roles instead of access keys for applications running on AWS (EC2, Lambda). Roles provide automatically rotated temporary credentials and eliminate the risk of credentials being hardcoded in application code or configuration files.

---

2.2 IAM Policies

An IAM policy is a JSON document that defines permissions. It specifies the Effect (Allow or Deny), the Action (what AWS API operation), and the Resource (which AWS resource, identified by ARN).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "*"
    }
  ]
}

---

2.3 Policy Types

---

2.4 Policy Evaluation Logic

When a request is made, IAM evaluates policies in this order:

1. Start with an implicit Deny (default)
2. Evaluate all applicable policies for an explicit Deny — if found, the request is denied immediately
3. Evaluate for an explicit Allow — if found, the request is allowed
4. If neither explicit Allow nor Deny is found, the implicit Deny applies

Exam Tip: An explicit Deny always overrides any Allow, regardless of which policy contains the Allow. This rule applies across all policy types including SCPs, IAM policies, and resource-based policies.

---

2.5 Multi-Factor Authentication

MFA requires something you know (password) plus something you have (MFA device) to authenticate.

Exam Tip: Enabling MFA on the root account is consistently cited as the first security action to take after creating a new AWS account.

---

2.6 Identity Federation and Amazon Cognito

Identity Federation allows users with existing external identities to access AWS resources without creating IAM users for each person.

Amazon Cognito provides identity management for web and mobile applications:

• User Pools — Authentication: handles sign-up, sign-in, and user profile management
• Identity Pools — Authorization: grants authenticated users temporary AWS credentials to access AWS services directly

---

2.7 IAM Security Best Practices

---

3. AWS Organizations

AWS Organizations allows central management of multiple AWS accounts from a single management account. It enables consolidated billing, policy enforcement, and automated account creation at scale.

3.1 Structure and Components

Root
└── Management Account (Payer Account)
    ├── OU: Production
    │   ├── Member Account: prod-app
    │   └── Member Account: prod-data
    ├── OU: Development
    │   └── Member Account: dev-team
    └── OU: Security
        └── Member Account: security-logs

---

3.2 Service Control Policies

SCPs are permission guardrails applied to OUs or member accounts. They define the maximum permissions that any IAM identity within those accounts can have.

• SCPs do not grant permissions — they only restrict
• SCPs affect all principals in the account, including the account root user
• The management account is not subject to SCPs
• Effective permissions = intersection of SCP allowances and IAM policy allowances

Common SCP use cases:

Exam Tip: If a question asks what can restrict what the root user of a member account can do, the answer is Service Control Policies (SCPs). IAM policies cannot restrict the root user within an account, but SCPs can.

---

3.3 Consolidated Billing

All member accounts in an organization are billed to a single consolidated bill sent to the management account.

---

4. AWS Security Services

4.1 Threat Detection and Investigation

Key Concept: GuardDuty detects active threats. Detective investigates findings after detection. They are complementary services used together.

---

4.2 Vulnerability and Compliance Assessment

Key Concept: Inspector finds vulnerabilities in your workloads before they are exploited. GuardDuty detects active threats and attacks in progress. These are the two most commonly confused services on the exam.

---

4.3 Perimeter Protection

AWS WAF (Web Application Firewall)

Protects web applications from common exploits by filtering HTTP/HTTPS traffic based on rules defined in Web ACLs.

AWS Shield — DDoS Protection

Exam Tip: Shield Standard protects against SYN floods, UDP floods, and DNS amplification. Shield Advanced adds application-layer protection (HTTP floods), requires WAF integration, and provides access to the AWS DDoS Response Team.

---

4.4 Security Aggregation and Automation

AWS Security Hub

Aggregates, normalizes, and prioritizes security findings from multiple AWS services and third-party tools into a single dashboard. Runs automated checks against security standards including CIS AWS Foundations Benchmark.

Sources Security Hub aggregates:

• Amazon GuardDuty
• Amazon Inspector
• Amazon Macie
• AWS IAM Access Analyzer
• AWS Firewall Manager
• Third-party tools from AWS Marketplace

Amazon Macie

Uses machine learning to automatically discover, classify, and report on sensitive data stored in Amazon S3 buckets — including PII, financial data, and credentials. Generates findings when sensitive data is found or when bucket permissions become overly permissive.

---

5. Data Protection and Encryption

5.1 Encryption Fundamentals

AWS services support both types. S3, EBS, RDS, DynamoDB, and most other storage and database services support encryption at rest. All AWS service APIs use HTTPS (TLS) by default for encryption in transit.

---

5.2 AWS Key Management Service (KMS)

KMS is a managed service for creating and controlling cryptographic keys used to encrypt and decrypt data across AWS services.

KMS Key Types:

Key features:

• All key usage is logged in AWS CloudTrail for audit purposes
• Keys never leave KMS in unencrypted form
• Automatic annual rotation is available for Customer Managed Keys
• Envelope Encryption: For large data, KMS generates a Data Encryption Key (DEK); data is encrypted with the DEK; the DEK itself is encrypted with the KMS key and stored alongside the data

---

5.3 AWS CloudHSM

A dedicated Hardware Security Module in the AWS Cloud, providing FIPS 140-2 Level 3 validated cryptographic operations.

---

5.4 AWS Certificate Manager

ACM provisions, manages, and deploys SSL/TLS certificates for use with AWS services. Public certificates for use with AWS services (CloudFront, ELB, API Gateway) are free. ACM handles automatic certificate renewal, eliminating manual expiration management.

---

5.5 AWS Secrets Manager

A service for storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens.

---

6. Network Security

6.1 Security Groups

A Security Group acts as a virtual firewall for EC2 instances (and other resources) at the network interface level, controlling inbound and outbound traffic.

Characteristics:

• Stateful — if an inbound request is allowed, the response traffic is automatically allowed regardless of outbound rules
• Rules are allow-only — you cannot explicitly deny; traffic not matching an allow rule is implicitly denied
• Applied at the instance level (network interface)
• Multiple Security Groups can be attached to a single instance
• Security Groups can reference other Security Groups by ID as rule sources

Example inbound rules:

---

6.2 Network Access Control Lists (NACLs)

A NACL is an optional, stateless firewall applied at the subnet level within a VPC.

Characteristics:

• Stateless — you must explicitly allow both inbound traffic and the corresponding outbound return traffic
• Can have both Allow and Deny rules (unlike Security Groups)
• Rules are evaluated in ascending numeric order; the first matching rule is applied
• The default NACL allows all inbound and outbound traffic
• Custom NACLs deny all traffic by default until rules are added

---

6.3 Security Groups vs NACLs

Exam Tip: Security Groups are the first line of defense at the instance level. NACLs provide a second layer of defense at the subnet level. In most architectures, Security Groups are sufficient — NACLs are added for broad subnet-level blocking requirements such as blocking a range of IP addresses.

---

6.4 AWS VPN and Direct Connect

---

7. Logging, Monitoring, and Auditing

7.1 AWS CloudTrail

CloudTrail records API calls and account activity across your AWS account. It answers: who made an API call, from where, at what time, and on which resource.

What CloudTrail logs:

Key facts:

• CloudTrail logs are stored in Amazon S3 for long-term retention
• Logs can be sent to CloudWatch Logs for alerting on specific API activity
• A single multi-region trail captures activity from all Regions in one configuration
• CloudTrail cannot be disabled if properly configured with S3 Object Lock

---

7.2 Amazon CloudWatch

CloudWatch is the AWS monitoring and observability service. It collects metrics, logs, and events from AWS resources and applications to give you operational visibility.

Core capabilities:

CloudWatch Alarm states:

• OK — metric is within the defined threshold
• ALARM — metric has breached the threshold
• INSUFFICIENT_DATA — not enough data points to evaluate the metric

---

7.3 AWS Config

AWS Config records the configuration state of your AWS resources over time and evaluates them against desired configurations using Config Rules.

What Config does:

• Records configuration changes to supported resources (EC2, S3, RDS, Security Groups, IAM, etc.)
• Answers: "What did this resource look like at a specific point in time?" and "Has it changed?"
• Evaluates resources against Config Rules and marks them as Compliant or Non-compliant
• Can trigger remediation automatically via AWS Systems Manager Automation

Config Rule sources:

• AWS Managed Rules — pre-built rules for common compliance checks (e.g., s3-bucket-public-read-prohibited, root-account-mfa-enabled, encrypted-volumes)
• Custom Rules — written in Lambda, evaluated against your specific requirements

---

7.4 Service Comparison

---

8. Compliance and Governance

8.1 AWS Compliance Programs

AWS maintains certifications and attestations for its global infrastructure. Customers inherit many of these controls for their portion of the shared responsibility.

Key Concept: AWS maintains compliance certifications for its infrastructure. Customers are responsible for the compliance of their applications and data. The Shared Responsibility Model applies to compliance exactly as it applies to security.

---

8.2 AWS Artifact

AWS Artifact is a self-service portal providing on-demand access to AWS compliance reports and agreements.

Available through Artifact:

• Audit reports: SOC 1, SOC 2, SOC 3, ISO certifications, PCI DSS Attestation of Compliance
• AWS Agreements: Business Associate Agreement (BAA) for HIPAA; GDPR Data Processing Addendum

Key facts:

• Free to access
• Reports can be downloaded and shared with auditors and regulators
• No need to contact AWS directly — all available on-demand

Exam Tip: If a question asks "how can a customer download AWS compliance reports and certifications", the answer is AWS Artifact.

---

8.3 AWS Control Tower

Control Tower provides the easiest way to set up and govern a secure, multi-account AWS environment based on AWS best practices.

What Control Tower provides:

• Preventive guardrails — SCPs that block non-compliant actions (e.g., prevent disabling CloudTrail)
• Detective guardrails — Config Rules that detect non-compliance (e.g., detect whether MFA is enabled on root)

---

8.4 AWS Audit Manager

Audit Manager helps continuously audit AWS usage to simplify risk assessment and compliance with regulations and industry standards.

• Provides pre-built frameworks: PCI DSS, HIPAA, SOC 2, GDPR, CIS Benchmarks
• Automatically collects and organizes evidence from AWS services
• Generates audit-ready reports mapped to specific compliance requirements

---

9. Exam Tips and Quick Reference

Security Service Differentiation

---

Scenario-to-Answer Mapping

---

Common Exam Traps

• CloudTrail vs CloudWatch: CloudTrail = API activity audit (who did what). CloudWatch = performance monitoring (how is it performing). They are frequently confused.
• Config vs CloudTrail: Config shows what a resource looks like now and historically. CloudTrail shows which API call changed it and who made the call.
• SCPs grant permissions: False — SCPs only restrict; they cannot grant permissions. The management account is not affected by SCPs.
• GuardDuty vs Inspector: GuardDuty = active threats happening now. Inspector = potential vulnerabilities that could be exploited.

---

Key Terms — Domain 2

---

End of Domain 2. Continue to Domain 3: Cloud Technology and Services →