AWS Security · Domain 6
Security Foundations and Governance
About 14% of the exam
Shared responsibility across service models
AWS always owns
- Physical facilities and hardware
- Hypervisor and host operating system
- Global network and Region isolation
- Managed service software patching
You always own
- Identity, permissions and credentials
- Data classification and encryption choices
- Configuration of the resources you create
- Who you share resources with
Where it shifts
- IaaS leaves guest patching to you
- PaaS moves the runtime to AWS
- Serverless leaves code and permissions
- Managed databases still need your grants
AWS secures the cloud and you secure what you put in it, with the line moving toward AWS as abstraction rises
The multi-account landing zone
- Management account
- billing and organization root only
- Log archive account
- immutable central log storage
- Security tooling account
- delegated administrator for detectors
- Workload account
- one blast radius per workload
- Sandbox OU
- loose guardrails, no production data
- Control Tower
- landing zone with managed guardrails
- Account Factory
- new accounts with the baseline
- Organizational unit
- grouping that carries guardrails
Guardrail types
- Preventive guardrails deny the action
- Detective guardrails report the drift
- Proactive checks run before deployment
- Service control policies deny organization wide
- Config rules detect after the fact
- CloudFormation hooks block bad stacks
- Guard validates templates in the pipeline
Config as a governance engine
- Managed rules cover common baselines
- Custom rules run Lambda or Guard
- Conformance packs bundle a framework
- Pack parameters vary per deployment
- Auto remediation calls Systems Manager
- Retry window limits repeated attempts
- Aggregator reports across the organization
Security Hub as the control plane
- Standards score the whole account
- Consolidated control findings reduce duplicates
- Automation rules set severity and workflow
- Partner products integrate their findings
- Custom findings arrive through ASFF
- The aggregation Region gives one view
Automation building blocks
Events
- EventBridge rules match finding patterns
- Content filters on prefix and numbers
- Schema registry documents the payloads
- Cross-Region forwarding to a central bus
Actions
- Lambda for small remediations
- Step Functions for longer workflows
- Systems Manager Automation runbooks
- Runbooks assume a remediation role
Safety
- Make every remediation idempotent
- Reserved concurrency caps runaway functions
- Dry run before you enforce
- Log every automated action
Compliance and audit evidence
- AWS Artifact
- download provider audit reports
- Audit Manager
- collects evidence against frameworks
- Config timeline
- proves configuration at a date
- CloudTrail Lake
- queryable history of API calls
- Security Hub standards
- control by control pass rate
- Trusted Advisor
- checks against common best practices
- Well-Architected Tool
- reviews workloads against the pillars
- Tag policies
- consistent tags for reporting
Inherited controls come from Artifact reports while your own controls are evidenced by Config, CloudTrail and Security Hub
Tagging and the cost of security
- Tag policies define allowed keys
- An SCP denies launches without tags
- Tags drive attribute based access
- An owner tag routes the finding
- Data events and Macie drive spend
- Scope logging to what matters
Secure the delivery pipeline
- Commit
- Static policy check
- Build and sign
- Deploy with a role
- Detect drift
Shift the check left with Guard and Access Analyzer, then leave Config watching for whatever slipped past
Resilience and continuity
- Multi-Region for a Region wide failure
- Backups held in a separate account
- Recovery objectives agreed with the business
- Test the failover, never assume it
- Service quotas checked well in advance
- Key material present where you recover
Governance failures
- Guardrails only in production accounts
- New accounts missing the baseline
- Remediation fighting the deployment pipeline
- Findings with no owner tag
- Exceptions granted and never reviewed
- Management account used for workloads
Service names to know
- Provider audit reports
- AWS Artifact
- Evidence collection
- AWS Audit Manager
- Template policy checks
- CloudFormation Guard
- Landing zone setup
- AWS Control Tower
- Firewall policy at scale
- AWS Firewall Manager
- Patch compliance
- Systems Manager Patch Manager
- Organization guardrails
- service control policies
Know the order
- Define the guardrail
- Prevent in the pipeline
- Prevent at the API
- Detect drift
- Remediate and report
Prevention that runs before deployment is always cheaper than remediation that runs after it
Reference strip: accounts, prevent, detect, automate, evidence
Accounts
- Management, log archive, security tooling
- Workload accounts per blast radius
- Organizational units carry guardrails
- Control Tower builds the baseline
Prevent
- Service and resource control policies
- Permissions boundaries on delegation
- CloudFormation hooks and Guard
- Block Public Access account wide
Detect
- Config rules and conformance packs
- Security Hub standards
- GuardDuty across the organization
- Access Analyzer external findings
Automate
- EventBridge into Lambda
- Systems Manager Automation runbooks
- Step Functions for workflows
- Idempotent and rate limited
Evidence
- Artifact for inherited controls
- Audit Manager assessments
- Config timeline per resource
- CloudTrail Lake queries
Quick exam traps
- Trap: Service control policies also restrict the organization management account
- Trap: AWS patches the guest operating system on your EC2 instances
- Trap: AWS Artifact provides evidence for the controls you operate yourself
- Trap: Enabling a Config rule stops a non-compliant resource being created
- Trap: Control Tower guardrails reach accounts created outside Account Factory
- Trap: Trusted Advisor is a substitute for a formal compliance assessment
- Trap: One account per team is always the right blast radius
cybercertprep.com · original revision sheet written from the public body of knowledge