Chapter 2 of 5 · AWS SAP-C03

Security, Compliance, and Governance

Federation, least privilege, data perimeters, encryption, multi-account governance, compliance and AI controls.

  • 8topics
  • 46 minfast track
  • 1diagrams and exhibits
  • 25%of the exam
Start with Federation, Application Auth and Workload Identity

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Federation, Application Auth and Workload IdentityChoose IAM Identity Center with SAML and SCIM for staff, Cognito and OAuth for app users, and EKS Pod Identity or Roles Anywhere…6 min
  2. 2Least Privilege and Data PerimetersDesign least privilege with cross-account roles, external IDs, boundaries, session policies and ABAC, plus data perimeters and…6 min
  3. 3Organizations, Landing Zones, SCPs and RCPsStructure OUs, build a Control Tower landing zone with Account Factory, enforce SCPs and RCPs, and share subnets and Transit…Diagram6 min
  4. 4Encryption, Certificates, HSMs and Post-QuantumKMS customer managed keys and rotation, ACM and Private CA for TLS, CloudHSM for sole HSM control, and ML-DSA and ML-KEM for…6 min
  5. 5Centralized Logging and Audit TrailsCentralize CloudTrail organization trails, Config aggregation, GuardDuty and Security Lake, log AI invocations, and keep…6 min
  6. 6Compliance Monitoring, Patching and RiskAutomate compliance with Config rules and Security Hub CSPM, patch with Inspector and Patch Manager, use AWS Artifact reports…5 min
  7. 7Data Protection, Sovereignty and ResidencyLayer encryption, access control and audit logs to protect data, keep it in approved Regions with SCPs, and meet sovereignty…5 min
  8. 8Governance for Generative and Agentic AIFilter prompts and responses with Bedrock Guardrails, enforce them across accounts, secure agents with AgentCore Identity, and…6 min

About this chapter

What this chapter covers

Security, Compliance, and Governance is 25% of the AWS Certified Solutions Architect Professional SAP-C03 exam, tied for the largest domain. It asks you to secure and govern an estate of many AWS accounts, not a single workload.

The chapter covers identity (federation, application sign in, workload identity, least privilege and data perimeters), encryption (KMS, certificates, CloudHSM and post-quantum planning) and organization governance (Organizations, Control Tower, SCPs, RCPs and resource sharing). It also covers central logging, compliance monitoring, patching, regulatory controls such as data residency, and the newer controls for generative and agentic AI.

Questions are long multi-account scenarios. Most are single answer, and multiple-response questions state the count, such as "Which TWO".

Watch the discriminators: MOST secure, LEAST operational overhead, MOST cost-effective, or "without changing application code". There are no exhibits.

How the topics fit together

Think of the chapter as layers that build on each other, from who can act down to the proof that controls work.

Identityfederation, roles, perimetersprotectsDataKMS, TLS, HSMgoverned byOrganizationOUs, SCPs, RCPsobserved byLogging and complianceCloudTrail, Config, Security HubOrganizationguardrailsextends toAI workloadsGuardrails, AgentCore Identity, approvals
  • Identity decides who or what is calling, and least privilege keeps that access small.
  • Data protection keeps content safe at rest and in transit, with keys you control.
  • Organization guardrails set limits that no account administrator can override.
  • Logging and compliance prove the controls work and feed automated fixes.
  • AI controls apply the same ideas to model prompts, agents and human approval.
Exam tip

When two answers are both secure, the exam usually prefers the one that is enforced centrally (an SCP, RCP or organization policy) and runs automatically, over one that relies on every account team doing the right thing.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams and examples.
  • What to remember for the exam: the facts to memorize.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Read the pages in order. Identity concepts come first because later pages build on roles, policies and organization structure.

Ready for more practice?

The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.

Get Full AccessTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.