Governance, Compliance and Auditing

What it is

Governance means setting rules for how an organisation uses the cloud and checking that the rules are followed. Compliance means meeting laws, standards and contract requirements, such as those for payments or health data.

AWS supports both. It publishes evidence about its own controls, and it offers services that record activity, check configuration and apply rules across many accounts.

The exam asks which service answers a given governance or audit need. Most questions can be solved by knowing the one-line job of each service.

How it works

Compliance information from AWS

AWS Artifact is a portal that gives you on demand access to AWS compliance reports and agreements. Examples are audit reports and certain agreements you can accept for your account.

Use Artifact when an auditor asks for proof about AWS's own controls. It does not check your own resources.

AWS supports many compliance programmes, such as System and Organization Controls (SOC) reports, the Payment Card Industry Data Security Standard (PCI DSS) and ISO 27001. Meeting a standard for a workload is still a shared task, because the customer must configure their part correctly.

Compliance also varies by service. Each AWS service is covered by a different set of compliance programmes, and a newer service may not yet be in scope for a given standard. Before you put regulated data into a service, check the AWS list of services in scope by compliance programme, which you can reach through Artifact or the AWS compliance website.

Data location and Regions

Data stays in the Region you choose unless you move it. This helps with rules about where data may be stored.

Recording and checking activity

CloudTrail is about actions. Config is about the state of resources. CloudWatch is about performance and operational data.

Managing many accounts

AWS Organizations lets you group accounts, apply central billing and set policies. A service control policy (SCP) defines the maximum permissions that accounts in an organisation can use.

An SCP does not grant access by itself. It only limits what can be allowed.

AWS Control Tower sets up a well governed multi account environment, called a landing zone, and applies guardrails. Guardrails are rules that either prevent an action or detect it.

Putting the services together

Suppose a security group is changed and a server becomes reachable from the internet. CloudTrail shows who made the change and when, and Config shows the old and new settings and can flag the resource as non compliant.

A CloudWatch alarm can then notify the team, so the problem is fixed quickly. Each service answers a different part of the story.

Tags and resource grouping

Tags are labels on resources, such as a project or cost centre. Consistent tagging supports cost tracking, ownership and automation.

Security advice and findings

AWS Trusted Advisor checks your account against best practices in areas that include security and cost. AWS Security Hub gathers security findings in one place, and is described on the detection page.