Chapter 6 of 6 · AWS SCS-C03
Security Foundations and Governance
Multi account strategy, Control Tower, secure deployment and compliance checks.
- 6topics
- 31 minfast track
- 1diagrams and exhibits
- 14%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Organizations and Policy TypesStructure a multi account Organization with OUs and separate accounts, and apply SCPs, RCPs, tag policies and delegated admins as…5 min
- 2Control Tower and Landing ZonesSet up a governed multi account environment with AWS Control Tower landing zones, controls, Account Factory, customization…5 min
- 3Central Security Account PatternsDesign security tooling, log archive and shared services accounts, use delegated administrators, cross account roles and RAM, and…Diagram6 min
- 4Secure Deployment with IaCDeploy resources securely and consistently with CloudFormation, StackSets, Service Catalog, policy as code checks, least…5 min
- 5AWS Config Rules and AggregationEvaluate compliance with AWS Config recorders, managed and custom rules, conformance packs, organization aggregators, advanced…5 min
- 6Compliance Reporting and Audit EvidenceReport on compliance with Security Hub standards, Audit Manager, AWS Artifact, Trusted Advisor and Access Analyzer, and pick the…5 min
About this chapter
What this chapter covers
Governance is how an organization keeps many accounts and teams secure and consistent without checking each resource by hand.
The chapter has three parts that follow the exam outline.
The first is the strategy for deploying and managing accounts centrally, with Organizations, Control Tower and dedicated security accounts. The second is secure and consistent deployment of resources, using infrastructure as code and approved products. The third is evaluating compliance, with AWS Config, Security Hub, Audit Manager and related tools.
The chapter follows the Security Foundations and Governance domain of the AWS Certified Security Specialty SCS-C03 exam. Six pages cover its three outline topics.
How the topics fit together
Prevent first, deploy consistently, then check and prove.
- Organizations and Control Tower create the account structure and the preventive guardrails.
- Central security accounts hold logs and run the security services for everyone.
- Infrastructure as code makes each deployment match the approved design.
- Config and Security Hub check that live resources still match the standard.
- Audit Manager and Artifact supply the evidence an auditor asks for.
Think in three layers when choosing an answer: prevent with SCPs and Hooks, detect with Config and Security Hub, and prove with Audit Manager and logs.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Several services here are easy to confuse, such as Config and CloudTrail or Audit Manager and Artifact. Use the comparison tables to practise telling them apart.
Ready for more practice?
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.