AWS Certified Cloud Practitioner Security and Compliance Summary

AWS is responsible for security *of* the cloud: the buildings, hardware, and global network. Physical data center security is fully AWS's job.

Wrong choices

• The customer: Customers cannot enter AWS data centers, so they cannot protect them.
• The customer and AWS equally: Physical security is entirely AWS's job.
• The customer's internet provider: Internet providers have no role in AWS data center security.

With Amazon EC2 (IaaS), the customer manages the guest operating system, including security patches, plus the applications and data on it.

Wrong choices

• AWS: AWS patches the host and hardware, not the guest operating system on EC2.
• AWS Professional Services: Professional Services can be hired for projects, but patching is not automatically their job.
• The AWS Marketplace seller of the instance type: Instance types are not sold by Marketplace sellers, and they do not patch your servers.

AWS Artifact is a self-service portal for downloading AWS security and compliance reports and reviewing certain agreements with AWS.

Wrong choices

• AWS Config: AWS Config tracks the settings of your own resources, not AWS's audit reports.
• AWS Security Hub: Security Hub collects security findings about your account.
• Amazon Inspector: Inspector scans your workloads for software vulnerabilities.

The root user has full access to the account. Protect it with multi-factor authentication (MFA) and use it only for tasks that only the root user can do.

Wrong choices

• Use it for daily administration work: Daily work should use IAM identities with limited permissions.
• Create access keys for it so scripts can use it: Root access keys are a big risk and should not be created.
• Share its password with all administrators: Sharing credentials removes accountability and raises risk.

An IAM role gives temporary credentials that rotate automatically. Attaching a role to the instance means no long-term keys are stored on the server.

Wrong choices

• Store an IAM user's access keys on the instance: Long-term keys stored on a server can be stolen.
• Put the instance in an IAM group: IAM groups hold users, not EC2 instances.
• Use the root user's credentials: The root user should never be used by applications.

AWS CloudTrail records actions taken in an AWS account, including API calls, the identity that made them, the time, and the source address. It is key for auditing.

Wrong choices

• Amazon CloudWatch: CloudWatch collects performance metrics and logs, not a record of who called each API.
• AWS Config: Config records resource settings over time, not every API call by user.
• Amazon Inspector: Inspector scans for software vulnerabilities.

AWS Shield Standard is turned on for all customers automatically at no extra charge. It protects against common network and transport layer DDoS attacks.

Wrong choices

• AWS Shield Advanced: Shield Advanced adds more protection and support, but it is a paid service.
• AWS WAF: AWS WAF filters web requests with rules you set, and it is charged by use.
• Amazon GuardDuty: GuardDuty detects threats from account activity; it is a paid service.

AWS WAF is a web application firewall. You set rules that look at web requests and block common attacks such as SQL injection and cross-site scripting.

Wrong choices

• AWS Shield Standard: Shield Standard protects against DDoS attacks, not SQL injection in web requests.
• Security groups: Security groups allow or block traffic by port and address, not by what is inside a web request.
• Amazon Inspector: Inspector finds vulnerabilities but does not block web requests.

Amazon GuardDuty is a threat detection service. It analyzes sources such as AWS CloudTrail events, VPC Flow Logs, and DNS logs to spot suspicious behavior.

Wrong choices

• Amazon Inspector: Inspector looks for software vulnerabilities, not suspicious activity.
• Amazon Detective: Detective helps investigate findings after they are found.
• Amazon Macie: Macie finds sensitive data in Amazon S3.

Amazon Inspector automatically scans workloads such as Amazon EC2 instances for known software vulnerabilities and unintended network exposure.

Wrong choices

• Amazon GuardDuty: GuardDuty watches for threat activity, not missing software patches.
• AWS Trusted Advisor: Trusted Advisor gives best-practice checks, not software vulnerability scans.
• Amazon Macie: Macie finds sensitive data in S3.