Compliance and governance: AWS Artifact, regional and industry requirements, and the services that monitor and audit

Why this matters

Sooner or later someone outside the technical team asks a hard question about the cloud. An auditor wants proof that the data centres are controlled. A hospital's legal team wants to know whether patient records can live on AWS at all. A regulator asks where personal data is stored, and who changed a firewall rule last Tuesday. None of these is answered by launching a server. They are answered by knowing where AWS publishes its evidence, which services keep a record of what happened, and which controls stop a mistake before it is made.

For a manager or a salesperson, this is the difference between "I think we are compliant" and "here is the report, and here is the log". For a junior engineer, it is knowing which of three similar-sounding services to switch on: one that watches performance, one that records actions, and one that records how resources are configured. Mixing them up is an easy way to lose marks, and an expensive mistake in real life, because a log that was never turned on cannot be produced later.

The lesson

AWS compliance and governance concepts

Compliance means meeting a rule that someone else sets: a law, an industry standard or a contract. Governance means the rules an organisation sets for itself, and the means of enforcing and checking them: who may create resources, in which Regions, with which settings.

On AWS both follow the shared responsibility model from lesson 6. AWS is audited by independent third parties against many standards, covering its facilities, hardware and the services it runs. A customer inherits those controls for the parts AWS operates, so it does not need to audit an AWS data centre itself. What it does not inherit is compliance for its own workload. Putting an application on a certified platform does not certify the application. The customer remains responsible for how it configures services, who it lets in, and how it handles its data, and AWS does not audit each customer's workload for it.

Governance tools fall into two families, and the exam often turns on the difference:

• Preventive controls stop an action before it happens. A service control policy (SCP) in AWS Organizations sets the maximum permissions available to the member accounts of an organisation, so it can deny, for example, any action in a Region outside an approved list.
• Detective controls notice a problem after it exists. An AWS Config rule reports a resource that breaks a rule, but it does not prevent the resource being created.

AWS Control Tower brings these together for companies with many accounts. It sets up a governed multi-account environment, called a landing zone, and applies preventive and detective controls to the accounts from the start. A question that says "many accounts" and "governed from the start" points to Control Tower; one that says "stop any account using these Regions" points to SCPs.

Security logs: where they are captured and where to find them

A log is only useful if it was switched on before the event, and if you know where it went. Four sources matter at this level.

• AWS CloudTrail records API calls made in an account. Almost everything on AWS, from a console click to a script, is an API call underneath, so CloudTrail answers "who did what, when, and from where". Recent activity can be viewed in its event history. To keep a long-term record, a company creates a trail, which delivers log files to an Amazon S3 bucket the company chooses, where they can be kept for as long as its rules require.
• Amazon CloudWatch Logs collects, stores and lets you search log data from EC2 instances, applications and AWS services in one place. It is where application logs from many servers are gathered so they can be searched together.
• VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC, the private network covered in lesson 17. They can be published to CloudWatch Logs or to Amazon S3. They describe network traffic, not API calls.
• S3 server access logging records the requests made to a bucket, which is useful when the question is about one bucket rather than the whole account.

The usual trap is to answer a network-traffic question with CloudTrail, or an API-caller question with CloudWatch. Ask what the log describes: API actions, application output, or network traffic.

Finding AWS compliance information: AWS Artifact

AWS Artifact is a self-service portal in the AWS Management Console. It has two parts.

• Artifact Reports gives on-demand access to AWS's own security and compliance documents, such as SOC reports, ISO certifications and PCI reports. When an auditor asks for evidence about AWS, this is where the customer downloads it.
• Artifact Agreements lets a customer review and accept agreements with AWS. The best-known example is the Business Associate Addendum (BAA), which a US healthcare customer accepts before it processes protected health information under HIPAA.

Be precise about what Artifact is not. It does not scan your workload, and it does not write a report about your resources. It holds documents about AWS. It is also not where your logs go: CloudTrail logs go to your own S3 bucket. If an answer option describes a service that checks your resources for compliance gaps, that is AWS Config or AWS Security Hub, never Artifact.

Compliance needs by country and by industry

Rules differ by place and by sector. A European company handling personal data has obligations under the EU's GDPR. A US hospital deals with HIPAA. A shop that takes card payments meets PCI DSS. Public-sector bodies in many countries have their own frameworks.

The AWS Compliance pages are where AWS describes the assurance programmes it takes part in, grouped by country and by industry, with links to the services in scope for each. This is the place to start when someone asks "does AWS support our regulator's standard?"

Geography is mostly about data residency: where data is stored and processed. On AWS the customer controls this by choosing Regions. AWS does not move customer content out of the Regions a customer has chosen without the customer's agreement, except where the law requires it. So the answer to "personal data must stay in the EU" is to store and process it in EU Regions. Asking AWS Support to keep it somewhere is not a control. Be careful with content delivery: Amazon CloudFront caches copies at edge locations near users, wherever they are, so caching does not satisfy a residency rule. Regions and edge locations are explained in lesson 13.

Monitoring, auditing and reporting: CloudWatch, CloudTrail, Config and access reports

Learn these as three verbs.

Monitoring: Amazon CloudWatch. CloudWatch collects metrics, such as CPU utilisation on an EC2 instance, along with logs, and raises alarms when a metric crosses a threshold you set. It answers "how is it performing right now?"

Auditing: AWS CloudTrail and AWS Config. Both keep a record, but of different things.

• CloudTrail records actions: which identity called which API, and when. "Who deleted the bucket?" is a CloudTrail question.
• AWS Config records state: how each resource is configured, and how that configuration has changed over time. "How have this security group's rules changed this month?" is a Config question. Config rules then evaluate whether resources match the settings you want and flag the ones that do not. Groups of rules can be deployed together as conformance packs.

A compact way to hold the difference: CloudWatch watches resource metrics, CloudTrail records API calls, and Config records configuration.

Reporting: access reports. IAM produces reports that show who holds which credentials and which permissions are really used.

• The IAM credential report lists every IAM user in the account with the status of their passwords, access keys and MFA devices. It suits an audit of credential hygiene.
• IAM last accessed information, shown in the access advisor view, reports when an identity last used each service. Permissions that have never been used can then be removed with confidence, which is least privilege in practice (lesson 9).

Why compliance scope differs from one service to another

Compliance is not a property of "AWS" as a whole. It is assessed service by service, and a service that is in scope for one programme may not be in scope for another. AWS publishes which services fall within each programme, and for HIPAA it publishes a list of HIPAA eligible services. A company handling health data must check that each service it plans to use is on that list before using it, and must still configure it correctly.

Scope can also differ by Region, because not every service is offered everywhere. So the right habit is to check the current in-scope list for the programme, the service and the Region together, rather than assume that one certified service makes everything certified. A service's free-tier offer, its number of Regions or its presence in AWS Marketplace tells you nothing about its compliance scope.

What the exam is really asking

Most questions in this area are a matching exercise. Read the noun in the scenario:

• a report about AWS, or an agreement with AWS: AWS Artifact;
• a person or identity performing an action: CloudTrail;
• a setting, and how it changed: AWS Config;
• a metric, a threshold or an alarm: CloudWatch;
• IP traffic in a VPC: VPC Flow Logs;
• the state of every user's credentials: the IAM credential report;
• unused permissions: IAM last accessed information;
• a standard by country or industry: the AWS Compliance pages;
• stopping an action across accounts: SCPs; setting up governed accounts: Control Tower.