2.4 Compliance and Governance
Key Takeaways
- AWS Artifact provides on-demand access to AWS compliance reports and agreements (SOC, PCI DSS, ISO 27001, HIPAA BAA).
- AWS Config continuously records resource configurations and evaluates them against rules; AWS CloudTrail logs API calls — they serve different purposes.
- AWS Organizations centrally manages multiple accounts with consolidated billing, Organizational Units, and Service Control Policies.
- Service Control Policies set maximum permission guardrails and only restrict — they never grant permissions — and apply even to member-account root users.
- AWS Control Tower automates setup and governance of a secure multi-account environment using landing zones, guardrails, and Account Factory.
AWS Compliance Programs
AWS maintains compliance with a wide range of global security and compliance standards. The key mental model: AWS provides the compliant infrastructure, while the customer ensures their own usage of AWS is compliant — compliance is shared.
Common Compliance Standards
| Standard | Description | Relevance |
|---|---|---|
| SOC 1/2/3 | Service Organization Control reports | Financial reporting and security controls |
| PCI DSS | Payment Card Industry Data Security Standard | Processing credit card data |
| HIPAA | Health Insurance Portability and Accountability Act | US healthcare data |
| FedRAMP | Federal Risk and Authorization Management Program | US government workloads |
| GDPR | General Data Protection Regulation | EU personal data protection |
| ISO 27001 | International security standard | Information security management |
| ISO 27017 | Cloud-specific security controls | Cloud security practices |
| ISO 27018 | Protection of PII in the cloud | Personal data in cloud environments |
| CSA STAR | Cloud Security Alliance assessment | Cloud security posture |
Compliance Is a Shared Responsibility
| AWS's Compliance Responsibility | Customer's Compliance Responsibility |
|---|---|
| Physical data-center compliance | Configuring services to meet requirements |
| Infrastructure-level certifications | Data classification and protection |
| Maintaining compliance reports | User access management and auditing |
| Global infrastructure security | Application-level compliance controls |
AWS Artifact
AWS Artifact is a self-service portal providing on-demand access to AWS compliance documentation and agreements.
| Section | What It Provides |
|---|---|
| Artifact Reports | AWS compliance reports (SOC, PCI, ISO) to download and share with auditors |
| Artifact Agreements | Review and accept agreements such as the HIPAA Business Associate Addendum (BAA) |
On the Exam: "Where do I download AWS SOC/PCI compliance reports?" → AWS Artifact.
AWS Config
AWS Config continuously monitors and records your AWS resource configurations. It answers: "What did my environment look like at a specific point in time, and how did it change?"
Capabilities:
- Configuration recording — track how resources are configured and how they change
- Compliance evaluation — define rules (e.g., "all S3 buckets must be encrypted") and check compliance
- Configuration history — view a timeline of changes to any resource
- Remediation — automatically fix non-compliant resources
Common Config rules: ensure S3 buckets are not public, ensure EBS volumes are encrypted, ensure CloudTrail is enabled, ensure the root user has MFA.
On the Exam: Config = resource configuration tracking and compliance; CloudTrail = API call logging. Do not confuse them.
AWS Organizations
AWS Organizations centrally manages and governs multiple AWS accounts.
| Feature | Description |
|---|---|
| Consolidated Billing | One payment method for all accounts; volume discounts apply across accounts |
| Organizational Units (OUs) | Group accounts logically (Production, Development, Finance) |
| Service Control Policies (SCPs) | Set permission boundaries across accounts/OUs |
| Account Creation | Programmatically create new accounts |
| Tag Policies | Enforce standardized tagging across accounts |
Service Control Policies (SCPs)
SCPs are the central control mechanism in AWS Organizations and set the maximum permissions accounts can have.
- SCPs do NOT grant permissions — they only restrict what is allowed
- SCPs apply to all users and roles in affected accounts, including the root user of member accounts
- SCPs do not affect the management (payer) account
- The effective permission is the intersection of the SCP and the IAM policy
Example: an SCP denying all EC2 actions in the "Development" OU prevents any user in any Development account from launching EC2 instances, no matter their IAM permissions.
AWS Control Tower
AWS Control Tower automates the setup and governance of a secure, multi-account AWS environment, building on AWS Organizations.
- Landing Zone — automated multi-account setup with best practices
- Guardrails — pre-configured preventive and detective governance rules
- Account Factory — automated provisioning of new accounts with standard settings
- Dashboard — centralized compliance visibility
Governance Quick Reference
| Service | What It Does |
|---|---|
| AWS Organizations | Centrally manage multiple accounts |
| Service Control Policies | Set permission boundaries across accounts |
| AWS Control Tower | Automated multi-account governance setup |
| AWS Config | Track resource configuration and compliance |
| AWS Artifact | Access compliance reports and agreements |
| AWS CloudTrail | Log API activity for auditing |
| AWS Audit Manager | Automate evidence collection for audits |
Together these services let an organization prove that its AWS environment is configured securely and stays compliant over time — a frequent Domain 2 theme.
AWS Audit Manager and Putting It Together
AWS Audit Manager complements Artifact and Config by automating evidence collection for audits — it continuously gathers data and maps it to frameworks like SOC 2, PCI DSS, and HIPAA so you can assess your AWS usage against a standard and produce audit-ready reports. A useful way to remember the governance stack: Artifact gives you AWS's own compliance proof, Config proves your resources are configured correctly, CloudTrail proves who did what, Audit Manager assembles the evidence, and Organizations + Control Tower enforce guardrails so accounts stay compliant by design.
Knowing which of these to reach for in a given scenario is the heart of Domain 2's governance questions.
Where can a company download AWS compliance reports like SOC and PCI DSS reports?
A company wants to continuously verify that all S3 buckets across their accounts have encryption enabled. Which service should they use?
What is the purpose of Service Control Policies (SCPs) in AWS Organizations?
Which AWS service provides automated setup and governance of a secure, multi-account AWS environment?
What is a benefit of consolidated billing in AWS Organizations?