Chapter 6 of 6 · AWS DOP-C02
Security and Compliance
IAM at scale, federation, KMS and secrets, automated controls, threat detection and audit proof.
- 6topics
- 31 minfast track
- 2diagrams and exhibits
- 17%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1IAM Policies, Roles and EvaluationMaster IAM policy evaluation, roles and STS, trust policies, external IDs, permission boundaries, attribute based access control…5 min
- 2Multi Account Access and FederationManage access across many accounts with IAM Identity Center, cross account roles, SAML and OIDC federation, workload identity and…Diagram5 min
- 3Encryption, KMS Keys and SecretsProtect data with KMS keys, key policies, grants, envelope encryption, multi Region keys, Secrets Manager rotation, Parameter…Diagram6 min
- 4Automated Security ControlsAutomate preventive, detective and corrective security controls with SCPs, CloudFormation Guard and Hooks, Config packs, Firewall…5 min
- 5Threat Detection and Security FindingsMonitor security with GuardDuty, Security Hub, Inspector, Macie, Detective and Access Analyzer, aggregate findings across…5 min
- 6Auditing and Compliance EvidenceBuild an audit ready AWS environment with organization trails, Object Lock archives, Config aggregators, Audit Manager, Artifact…5 min
About this chapter
What this chapter covers
Security on AWS works best when it is automated and built into the pipeline and the account structure. This chapter covers who can do what, how data is protected, how controls are enforced by code, and how problems and evidence are collected.
It follows the sixth domain of the AWS Certified DevOps Engineer Professional DOP-C02 outline. The three outline topics are identity and access management at scale, automation for security controls and data protection, and security monitoring and auditing solutions.
How the topics fit together
The pages move from identity to data, then to controls and evidence.
- IAM policies and roles decide every request, and the evaluation rules explain the outcome.
- Multi account access and federation give people and pipelines short lived access without long lived keys.
- KMS and secrets protect data at rest, in transit and in configuration.
- Automated controls prevent, detect and fix unsafe states across all accounts.
- Detection and audit find threats and produce evidence that controls worked.
Most security scenarios have three parts to match: who is acting, what resource is touched, and which layer should enforce the rule.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the policy examples line by line and predict whether each request is allowed. That habit is the best preparation for the long scenario questions at this level.
Ready for more practice?
The full AWS DOP-C02 question bank has 844 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.