3.5 Management and Governance Services

Quick Answer: AWS management and governance tools let you define infrastructure as code (CloudFormation/CDK), monitor resources (CloudWatch), audit activity (CloudTrail), get recommendations (Trusted Advisor), manage at scale (Systems Manager), and track service status (AWS Health). The CLF-C02 leans hard on distinguishing CloudWatch from CloudTrail and knowing Trusted Advisor's check categories.

Infrastructure as Code (IaC)

AWS CloudFormation

AWS CloudFormation models and provisions AWS resources from declarative templates written in JSON or YAML.

Key benefits:

• Repeatable deployments — the same template builds identical environments every time
• Version control — store templates in Git to track infrastructure changes
• Automatic rollback — if creation fails, CloudFormation rolls the stack back
• Free — you pay only for the resources a template creates
• Stacks — a collection of resources managed as one unit; delete the stack to remove everything

Example: define a full web app (VPC, EC2, RDS, S3, CloudFront) in one template, deploy it to dev/staging/prod identically, then tear it all down by deleting the stack.

AWS CDK (Cloud Development Kit)

The AWS CDK lets you define infrastructure using real programming languages (TypeScript, Python, Java, C#, Go); it synthesizes CloudFormation templates under the hood — ideal for developers who prefer code over YAML.

---

Monitoring and Observability

Amazon CloudWatch

Amazon CloudWatch is the primary monitoring and observability service.

Common uses: drive Auto Scaling from CPU utilization, set billing alarms to catch runaway spend, centralize logs for troubleshooting, and build operational dashboards.

On the Exam: CloudWatch = monitoring (metrics, alarms, logs, dashboards — "how are my resources performing?"). CloudTrail = auditing (who made which API call, when, from where). Do not confuse them; this exact pairing appears repeatedly.

AWS X-Ray

AWS X-Ray traces and debugs distributed applications and microservices, giving an end-to-end view of a request as it crosses services to pinpoint bottlenecks and errors.

---

Advisory and Optimization

AWS Trusted Advisor

Trusted Advisor gives recommendations across six categories:

On the Exam: Know the six categories: cost optimization, performance, security, fault tolerance, service limits, and operational excellence. The full set of checks requires Business Support+ or higher.

AWS Compute Optimizer

Uses machine learning to recommend optimal compute resources (EC2 instances, Auto Scaling groups, EBS volumes, Lambda functions, ECS on Fargate) based on actual utilization.

---

Account and Resource Management

AWS Systems Manager

Systems Manager is a unified interface for operating resources at scale:

AWS Config

AWS Config records resource configurations over time and evaluates them against rules for compliance — answering "what did this resource look like last Tuesday, and is it compliant?" It complements CloudTrail (which records the API calls themselves).

AWS Health Dashboard

On the Exam: The account-specific (personal) view of AWS Health shows events affecting your resources; the service view shows general AWS status.

---

Deployment and Developer Tools

Quick Reference

---

Governing Multiple Accounts

Larger organizations rarely run everything in one account. AWS Organizations groups many accounts under one management account, enabling consolidated billing, centralized policy, and grouping accounts into organizational units. Service Control Policies (SCPs) then set permission guardrails across those accounts — they cap what any identity in an account can do, even an administrator, regardless of individual IAM permissions.

For new multi-account setups, AWS Control Tower automates a secure, well-architected landing zone using Organizations, SCPs, and best-practice configurations out of the box. On the exam, "enforce guardrails across many accounts" points to SCPs in Organizations, and "set up a governed multi-account environment quickly" points to Control Tower.