Domain 2 review: security and compliance

Domain 2 carries a weight of 30, nearly a third of the scored exam, and Gwen asks Hannah Weiss, the clinic group's privacy and security lead, to join the review. Hannah has spent the autumn writing the access rules for the new AWS accounts, and she has a list of questions from the board about client data. "The board wants to know who is responsible if something goes wrong," she says. "Is it us or Amazon?" Gwen smiles. "That is the first idea in this domain, and the exam asks about it in a dozen ways."

This lesson reviews the four task statements in Domain 2: the shared responsibility model, security, governance and compliance concepts, access management, and the components and resources for security. AWS-102 covered all of these in full. Here the aim is to sharpen the distinctions the exam tests and to practise on scenarios from the Cascade Ridge migration.

The shared responsibility model

AWS describes security as a shared responsibility. AWS is responsible for security of the cloud: the physical data centres, the hardware, the global network, and the software that runs the infrastructure, such as the hypervisor. The customer is responsible for security in the cloud: their data, who can access it, how it is encrypted, how their applications and operating systems are configured, and how their network rules are set. The dividing line moves depending on the service. For Amazon EC2, an infrastructure service, the customer manages the guest operating system, patches, installed software and security groups. For a managed service such as Amazon RDS, AWS also patches the database engine and the underlying operating system, while the customer still controls access, network settings and data. For services such as Amazon S3 or AWS Lambda, AWS manages even more, but the customer always remains responsible for their data and for who can access it.

Some controls are shared or inherited. Patch management is shared: AWS patches the infrastructure, the customer patches their guest systems and applications. Configuration management is shared: AWS configures its infrastructure, the customer configures their resources. Awareness and training is shared: AWS trains its staff, the customer trains theirs. Physical and environmental controls are inherited by the customer from AWS. For the exam, read each responsibility question for two things: which side the question asks about, and which service is involved.

Security, governance and compliance concepts

Compliance questions usually ask where to find evidence or how to keep records. AWS Artifact is the self-service portal for AWS's compliance reports, such as SOC reports and ISO certifications, and for agreements such as a business associate addendum. Hannah uses it to answer the board's question about what certifications AWS holds. AWS Audit Manager helps a customer collect evidence about their own use of AWS for audits. AWS Config records the configuration of resources over time and can check them against rules, such as "every S3 bucket must block public access". AWS CloudTrail records API calls and account activity: who did what, when and from where. Amazon CloudWatch collects metrics and logs and raises alarms. The exam likes to test these by description, so learn the one-line job of each.

Encryption appears in Domain 2 as a concept. Data can be encrypted at rest, when stored, and in transit, when moving over a network. AWS Key Management Service, AWS KMS, creates and controls encryption keys and integrates with many services. AWS CloudHSM provides dedicated hardware security modules for customers who need direct control of the hardware that stores their keys. Compliance requirements differ by place and industry. Cascade Ridge chose ca-central-1 with a copy in ca-west-1 so that client records stay in Canada, which simplifies its obligations under PIPEDA and Alberta's and British Columbia's private-sector privacy laws. The exam does not test specific laws, but it does test the idea that the customer chooses the Region and is responsible for meeting its own compliance needs.

Access management

AWS Identity and Access Management, IAM, controls who can do what in an AWS account. The root user is created with the account and has full access to everything; AWS recommends protecting it with multi-factor authentication, not creating access keys for it, and using it only for the few tasks that require it, such as changing the account's support plan or closing the account. Day-to-day work should use other identities. IAM users represent people or applications with long-term credentials. IAM groups collect users so permissions can be granted once. IAM roles provide temporary credentials that a person, application or AWS service assumes when needed; roles are preferred over long-term keys for applications and services. IAM policies are documents that allow or deny actions on resources. The principle of least privilege means granting only the permissions needed for a task.

For people, AWS recommends IAM Identity Center, which provides single sign-on across multiple AWS accounts and can connect to an existing identity provider. Cascade Ridge plans to connect it to the group's Microsoft 365 directory so staff sign in once. Secrets such as database passwords belong in AWS Secrets Manager, which stores and rotates them, rather than in application code. The exam may also mention the IAM credential report, which lists users and the status of their credentials, and access keys, which are for programmatic access and should be rotated and never shared.

Security habits that appear as questions

Many Domain 2 questions are really about good habits, phrased as "which is a best practice" or "what should the company do first". Gwen lists the ones Hannah has already put into Cascade Ridge's plan, because each is a likely exam answer. Enable multi-factor authentication on the root user and on every person with console access. Do not create access keys for the root user, and lock its credentials away. Create individual identities for people rather than sharing one login. Grant permissions to groups and roles rather than to individual users, and start with the least privilege needed, adding more only when a real task requires it. Use roles, not long-term keys, for applications and AWS services. Rotate any credentials that must exist, and remove those no longer used, which the IAM credential report and access advisor help with. Turn on CloudTrail in every Region and keep the logs in a separate account where few people can change them. Encrypt data at rest and in transit, using AWS KMS keys where possible.

Governance across accounts is part of the same picture. AWS Organizations groups accounts and lets an administrator apply service control policies, which set the maximum permissions any identity in an account can have, even an administrator. Cascade Ridge plans to use one to block the use of Regions outside its chosen pair, which keeps client data where the board decided it should live. AWS Control Tower can set up a well-governed multi-account environment with guardrails already in place. For the exam, remember the direction of control: service control policies limit what is possible in an account; IAM policies grant permissions within those limits.

Hannah also asks about incident response. If a security problem happens, the customer investigates its own resources, using services such as CloudTrail, GuardDuty and Detective, while AWS handles anything affecting the underlying infrastructure. If AWS resources are being used to attack others, the AWS Trust and Safety team takes reports. Knowing which side handles what is, once again, the shared responsibility model in action.

Hannah writes one more line in her notes for the board: AWS is responsible for the security of the cloud, and Cascade Ridge is responsible for security in the cloud, which means the group's own settings, data and people. The board's question about who is responsible if something goes wrong has a precise answer: it depends on which layer failed. A flood in an AWS data centre is AWS's problem; a bucket left open to the public by a staff member is the clinic group's. That distinction, she realizes, is exactly what the exam keeps testing.

Security services and resources

Task statement 2.4 lists security components and resources. At the network level, security groups act as virtual firewalls for instances and are stateful, so return traffic is allowed automatically. Network access control lists act at the subnet level and are stateless, so inbound and outbound rules are evaluated separately. AWS WAF is a web application firewall that filters web requests to services such as CloudFront and load balancers. AWS Shield protects against distributed denial-of-service attacks; Shield Standard is included at no extra cost, and Shield Advanced adds more protection and response support for a fee. AWS Network Firewall and AWS Firewall Manager help manage firewall rules at scale.

For detection and assessment, Amazon GuardDuty detects threats by analysing account and network activity. Amazon Inspector scans workloads such as EC2 instances and container images for software vulnerabilities. Amazon Macie discovers and protects sensitive data in S3. AWS Security Hub collects findings from these services in one place and checks against security standards. Amazon Detective helps investigate the root cause of findings. AWS Trusted Advisor includes security checks, such as whether the root user has multi-factor authentication. Beyond services, AWS provides resources: the AWS Security Center and security blog, the AWS Knowledge Center, AWS re:Post for community answers, and the AWS Marketplace for third-party security products. If someone uses AWS resources for abuse, such as spam or attacks, the AWS Trust and Safety team is the place to report it.

# A tiny least-privilege check: which requested actions are not allowed?
allowed = {"s3:GetObject", "s3:ListBucket"}
requested = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
for action in requested:
    print(action, "->", "allowed" if action in allowed else "denied")

s3:GetObject -> allowed
s3:PutObject -> denied
s3:DeleteObject -> denied

The example mirrors how IAM evaluates a simple policy: anything not explicitly allowed is denied by default. Real IAM evaluation also considers explicit denies, resource policies and other layers, but the default-deny idea is what the exam expects you to know.