AWS Certified Cloud Practitioner: Security and Compliance Concepts
Importance ★★★★★ · 30% (estimate)
Overview
This chapter is about who protects what in AWS and which tools help. It covers the shared responsibility model, identity and access with IAM, encryption, and the security services that detect, block, and report problems. Many questions ask whether a task belongs to AWS or the customer, or which security service fits a need.
Under the shared responsibility model, AWS is responsible for security of the cloud, such as data centers, hardware, and the global network. The customer is responsible for security in the cloud, such as its data, who can access it, and settings like security groups. On Amazon EC2 the customer patches the guest operating system, while on managed services such as Amazon RDS and AWS Lambda, AWS handles more of the work. Patch management is a shared control.
IAM is a global service with no additional charge. Use groups to give many users the same permissions, roles to give temporary credentials to applications and other accounts, and policies written in JSON to define permissions. Follow least privilege, protect the root user with MFA, and use it only for tasks that need it. Service control policies in AWS Organizations limit what whole accounts can do.
Several services split up the security work. CloudTrail records API calls, Config tracks resource settings, GuardDuty detects threats, Inspector finds vulnerabilities, Macie finds sensitive data in S3, Detective investigates findings, and Security Hub brings findings together. Shield Standard gives free DDoS protection, Shield Advanced adds more, and AWS WAF blocks harmful web requests. KMS manages encryption keys, Secrets Manager stores and rotates secrets, and AWS Artifact provides AWS compliance reports.
Key concepts
Shared responsibility model
AWS secures the cloud itself (buildings, hardware, network). The customer secures what it puts in the cloud (data, access, settings).
Memory tipOF the cloud = AWS, IN the cloud = you
IAM users, groups, roles, policies
Users are people or tools, groups hold users, roles give temporary credentials, and policies are JSON permission documents.
Memory tipApp on EC2 needs access = role
Root user
The identity that created the account, with full access. Protect it with MFA and use it only for tasks that require it.
Memory tipNo root access keys
Security group vs network ACL
A security group is a stateful firewall for an instance with allow rules only. A network ACL is a stateless firewall for a subnet with allow and deny rules.
Memory tipNeed a deny rule = network ACL
Threat and vulnerability services
GuardDuty detects threats, Inspector scans for vulnerabilities, Macie finds sensitive data, Detective investigates, and Security Hub collects findings.
Memory tipThreats = GuardDuty, CVEs = Inspector
Shield and WAF
Shield Standard is free automatic DDoS protection, Shield Advanced is paid with a response team, and AWS WAF filters web requests.
Memory tipSQL injection = AWS WAF
AWS Artifact
A self-service portal for downloading AWS security and compliance reports and reviewing certain agreements.
Memory tipAuditor wants AWS reports = Artifact
Often tested
- Who called which API, and when = CloudTrail.
- How resource settings changed over time = AWS Config.
- Store and rotate database passwords = Secrets Manager.
- Employees sign in once to many accounts = IAM Identity Center; app customers = Cognito.
- The customer chooses the Region where its data is stored.
Easy to confuse: Who is responsible?
| Task | Amazon EC2 | Amazon RDS / AWS Lambda |
|---|---|---|
| Physical data centers and hardware | AWS | AWS |
| Operating system patches | Customer | AWS |
| Customer data and who can access it | Customer | Customer |
| IAM permissions for users and roles | Customer | Customer |
3 sample questions
Verified practice questions from this unit.
Question 1. Under the AWS shared responsibility model, who is responsible for the physical security of AWS data centers?
- ① The customer and AWS equally
- ② The customer
- ③ The customer's internet provider
- ④ AWS
▼ Show answer and explanation▲ Hide answer and explanation
Answer: ④ AWS
Key point: Security OF the cloud (buildings, hardware) = AWS
AWS is responsible for security *of* the cloud: the buildings, hardware, and global network. Physical data center security is fully AWS's job.
Wrong choices
- The customer: Customers cannot enter AWS data centers, so they cannot protect them.
- The customer and AWS equally: Physical security is entirely AWS's job.
- The customer's internet provider: Internet providers have no role in AWS data center security.
Question 2. A company runs Amazon EC2 instances. Who is responsible for installing security patches on the guest operating system of these instances?
- ① The AWS Marketplace seller of the instance type
- ② AWS Professional Services
- ③ The customer
- ④ AWS
▼ Show answer and explanation▲ Hide answer and explanation
Answer: ③ The customer
Key point: EC2 guest OS patching = customer
With Amazon EC2 (IaaS), the customer manages the guest operating system, including security patches, plus the applications and data on it.
Wrong choices
- AWS: AWS patches the host and hardware, not the guest operating system on EC2.
- AWS Professional Services: Professional Services can be hired for projects, but patching is not automatically their job.
- The AWS Marketplace seller of the instance type: Instance types are not sold by Marketplace sellers, and they do not patch your servers.
Question 3. An auditor asks a company for AWS's security and compliance reports, such as SOC reports. Where can the company download them?
- ① AWS Artifact
- ② Amazon Inspector
- ③ AWS Config
- ④ AWS Security Hub
▼ Show answer and explanation▲ Hide answer and explanation
Answer: ① AWS Artifact
Key point: AWS compliance reports on demand = AWS Artifact
AWS Artifact is a self-service portal for downloading AWS security and compliance reports and reviewing certain agreements with AWS.
Wrong choices
- AWS Config: AWS Config tracks the settings of your own resources, not AWS's audit reports.
- AWS Security Hub: Security Hub collects security findings about your account.
- Amazon Inspector: Inspector scans your workloads for software vulnerabilities.
AI-written · Verified · Written by AI. Only units that passed a separate AI check (re-reading facts and numbers) are published. Tell us if you find a mistake.