Content Domain 2: Security and Compliance

Task Statement 2.2: Understand AWS Cloud security, governance, and compliance concepts

Let's get started with the second task statement to understand AWS Cloud security, governance, and compliance concepts. When you're working with AWS, you need to ensure security and compliance are considered when making design decisions. We mentioned this earlier under domain 1 when we talked about choosing AWS Regions to understand compliance needs among geographic locations and industries. AWS compliance helps you understand the controls in place at AWS to maintain security and data protection in AWS along with assurance programs that provide templates and control mappings to help customers establish the compliance of their environments running on AWS. Even if you're not the person who would actually be building the solutions on AWS, you should be aware of how to find information about security and compliance and what services exist to support a security and compliance plan. The first thing you should know about compliance on AWS is where to find compliance information. We just mentioned AWS Compliance programs. Let's say you are building out a solution on AWS that requires a General Data Protection Regulation or GDPR compliant status and you want to use the service Amazon DynamoDB to store your data. How do you know if DynamoDB is GDPR compliant? Where could you find this information? You can find compliance information through the service AWS Artifact which gives you on-demand access to the AWS security and compliance documents and reports. Now, notice how the question I asked was about how to find compliance information for DynamoDB. I didn't ask, "Is it GDPR complaint?" There is a reason for this. Each individual AWS service has differences in regards to compliance. One service may require one set of actions to be taken to be compliant with a compliance standard whereas another AWS service would require a different set of actions to be taken to reach the same compliance standards. So, am I saying you need to memorize every single compliance program and which AWS services meet those requirements? Luckily, that level of detail won't be on the exam. Instead, you should understand where to find compliance information and be able to identify that compliance requirements do vary from service to service. Beyond recognizing where to find compliance information, you should also be prepared to answer questions around the different ways compliance and security can be achieved on AWS from a high level. When you are thinking about compliance and security, the main thing you are trying to do is protect systems and information. How do you secure resources on AWS? What if you want to add more security to your network beyond security groups and network access control lists? What other AWS service can you use? AWS WAF and Amazon GuardDuty are AWS security services. GuardDuty is a threat detection service to monitor for malicious activity and unauthorized behavior. AWS WAF is a web application firewall to help protect your applications from common exploits that could impact your application availability, compromise your security or consume excessive resources. What AWS service helps to protect your resources from common distributed denial of service or DDoS attacks? AWS Shield is a managed DDoS protections service to help safeguard your applications running on AWS. There are other security services too such as Amazon Inspector, AWS Security Hub, and more. Another way to secure data on AWS is through encryption. Encryption is a definite fundamental you need to know for this certification and the real world. Let me know if you want to take a deeper dive, I have some encryption fundamentals I can share. Encryption isn't a singular thing that you do one time. There are many different ways you can use encryption techniques. For example, there is encryption of data in transit and encryption of data at rest. Data in transit refers to data as it moves between two different places and data at rest refers to stored data. As a cloud practitioner, you should know the difference between encrypting data in transit and at rest because this will help you select AWS services that support the level of encryption you need. In regards to encryption, you should also be able to identify who enables encryption for different AWS services, which leads us back to the AWS shared responsibility model, but also requires AWS service specific knowledge. You can find information on encryption in the AWS whitepapers and documentation too if this task statement is something you aren't familiar with. Another part of working with AWS is being able to identify services that enable you to log, audit, and create reports on the activity happening in your AWS account. Activity in an AWS account could be AWS users creating and modifying AWS resources or it could be an external user accessing and using your AWS resources, like sending a request to a backend web server for example. You should understand what logs are and that they can be used to troubleshoot or audit the activity in your AWS account. You should be able to make distinctions between the services like Amazon CloudWatch which is used for monitoring and collecting operational data versus AWS CloudTrail which is used to log events related to AWS resource creation and management versus AWS Config which is used to take inventory of current configurations and audit resources to ensure they maintain correct configurations. What AWS service do you choose to identify an IAM user who deleted an Amazon EC2 instance in your production environment? CloudTrail is a service for governance, compliance, operational auditing, and risk auditing of your AWS account that continuously monitors and retains account activity related to actions across your AWS infrastructure. Let's dive deeper into CloudTrail. What is the best way to keep track of all of your activities in your AWS account with CloudTrail? You can create a CloudTrail trail for multi-Regions. There is also another service, AWS Audit Manager. You don't need to understand the logs or data that these services create, but you should be able to explain what the services do, explain their use cases, and understand the difference between them. One final point for this task statement is that not every person using an AWS account should have the same level of permissions. Instead, you should be following the concept of least-privileged access where you only give people the level of access they need and nothing more. Let's get started with the third task statement and talk about access management.