Security, Compliance, and Governance · Topic 6 of 8
Compliance Monitoring, Patching and Risk
Automate compliance with Config rules and Security Hub CSPM, patch with Inspector and Patch Manager, use AWS Artifact reports, and threat model.
- 5 min
- Config rules detect; remediation with SSM Automation fixes; conformance packs package both.
- Security Hub CSPM needs AWS Config recording for most controls.
- Inspector scans EC2, ECR images and Lambda continuously; no scan schedules to manage.
What it is
Compliance at scale means machines check the rules, not people. Resources are evaluated continuously, vulnerabilities are found as soon as they appear, patches go out on a schedule, and evidence for auditors is produced from the same data.
Risk assessment comes before all of that. Threat modeling decides which controls matter for an architecture, and the monitoring tools then prove those controls stay in place.
How it works
AWS Config rules and conformance packs
A Config rule evaluates resources against a desired setting. Managed rules cover common checks (encrypted EBS volumes, S3 public access blocked). Custom rules use Lambda or Guard policy syntax.
Rules run when a configuration changes, on a schedule, or both. A conformance pack bundles rules and remediation actions into one deployable unit, and organization conformance packs deploy it to every account.
Remediation uses Systems Manager Automation runbooks, either manually or automatically with retries. Automatic remediation suits low-risk fixes such as re-enabling bucket encryption.
AWS Security Hub CSPM
Security Hub CSPM runs security controls grouped into standards: AWS Foundational Security Best Practices (FSBP), CIS AWS Foundations Benchmark, PCI DSS and NIST. Most controls run as service-linked Config rules, so AWS Config must be recording resources.
A delegated administrator can use central configuration to turn on Security Hub CSPM, standards and controls across accounts and Regions. Automation rules update or suppress findings, and Amazon EventBridge sends findings to remediation workflows or ticketing.
| Need | Choose |
|---|---|
| Check against a named framework with a score | Security Hub CSPM standard |
| Organization-specific rule not in any standard | Custom Config rule |
| Same rule set in every account | Organization conformance pack |
| Fix drift automatically | Config remediation with an SSM Automation runbook |
Vulnerability scanning with Amazon Inspector
Amazon Inspector scans continuously, with no scheduled scan windows to manage.
- EC2 instances: software vulnerabilities and network reachability, agent based through the SSM Agent or agentless.
- Amazon ECR images: container images on push and again when new vulnerabilities are published.
- Lambda functions: package vulnerabilities, and optional code scanning for issues in the function code.
A delegated administrator enables Inspector for the whole organization. Findings carry an Inspector risk score and flow to Security Hub CSPM and EventBridge.
Patch management with Systems Manager Patch Manager
Patch Manager applies OS patches using patch baselines: rules that auto-approve patches by classification and severity after a delay, plus explicit approve or reject lists. Predefined baselines exist per operating system, and custom baselines fit stricter policies.
A patch policy, configured through Quick Setup, applies patching across accounts and Regions in the organization. It sets the baseline, schedule, and whether to scan only or scan and install. Patch compliance data shows which nodes are missing patches.
For immutable infrastructure, a better fix is to rebuild the AMI or container image with the patch and redeploy, rather than patching running instances.
Compliance evidence with AWS Artifact
AWS Artifact is a self-service portal for AWS's own compliance documents. Reports include SOC reports, PCI attestations and ISO certifications. Agreements, such as the Business Associate Addendum (BAA) for HIPAA, can be accepted for one account or for the whole organization from the management account.
Artifact proves what AWS does under the shared responsibility model. Evidence for your part comes from your own data: Config compliance history, Security Hub CSPM standard results, CloudTrail logs and patch compliance reports, kept in the Log Archive account.
Risk assessment and threat modeling
Threat modeling asks four questions: what are we building, what can go wrong, what are we going to do about it, and did we do a good enough job. STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) helps list threats for each data flow and trust boundary.
AWS Threat Composer, an open-source tool from AWS, guides teams through writing threat statements and linking them to mitigations. The AWS Well-Architected Tool reviews a workload against the Security pillar.
Map each threat to a mitigation and a detective check. For example, "a developer makes a bucket public" maps to an RCP or S3 Block Public Access (prevent), a Config rule (detect) and automatic remediation (respond). Test mitigations with AWS Fault Injection Service where failure scenarios apply.
How the exam asks about this
- "Every new and existing account must be checked against CIS benchmarks with a central score and minimal setup." -> Security Hub CSPM with central configuration from a delegated administrator and the CIS standard enabled.
- "Critical OS patches must reach EC2 fleets in all accounts each week, scanned daily otherwise." -> Patch Manager patch policy through Quick Setup across the organization.
- "Auditors ask for AWS's SOC 2 report and a signed HIPAA BAA." -> AWS Artifact reports and agreements.
What to remember for the exam
- Config rules detect; remediation with SSM Automation fixes; conformance packs package both.
- Security Hub CSPM needs AWS Config recording for most controls.
- Inspector scans EC2, ECR images and Lambda continuously; no scan schedules to manage.
- Patch baselines decide which patches are approved; patch policies roll patching across the organization.
- AWS Artifact holds AWS's audit reports and agreements, not your own evidence.
- Threat modeling maps each threat to preventive, detective and responsive controls.
AWS Artifact does not assess your resources. If a question asks for continuous evidence that your accounts are compliant, the answer is Config and Security Hub CSPM, with Artifact only for AWS's side.
Common mistakes
Enabling Security Hub CSPM without Config. Most controls depend on service-linked Config rules, so findings stay empty or incomplete without resource recording.
Patching by hand with Run Command. One-off commands leave no baseline and no compliance view. Patch Manager with baselines and patch policies gives repeatable patching and reporting.
Threat modeling once at launch. A threat model must be updated when the architecture changes, or new data flows go unprotected.
Check yourself
What does a conformance pack add over single Config rules?
It bundles rules and remediation actions into one unit that can be deployed to every account in the organization.
Which Inspector targets are scanned continuously?
EC2 instances, container images in Amazon ECR and Lambda functions.
What does AWS Artifact provide?
AWS's own compliance reports, such as SOC and ISO, and agreements such as the HIPAA BAA.
Topic 6 of 8 in Security, Compliance, and Governance
Test yourself on Security, Compliance, and Governance
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.