Domain 2 - Security and Compliance (30%)

Index of notes that fall under Domain 2 — the largest domain after Cloud Technology. Task statements come from the exam guide; a note can appear in more than one domain.

2.1 — Shared responsibility model

• AWS shared responsibility model — security of the cloud vs security in the cloud
• Security & Networking — the terminology this domain draws on
• Responsibility shifts by service model: Amazon EC2 (most customer) → Amazon RDS → AWS Lambda (most AWS)

2.2 — Security, governance, and compliance concepts

• Security, Identity, and Compliance — service category overview
• Compliance evidence: AWS Artifact (reports), AWS Audit Manager (continuous audit)
• Governance and logging
  • AWS CloudTrail — who called which API
  • AWS Config — resource state and drift
  • Amazon CloudWatch — metrics, logs, alarms
  • AWS Control Tower — governed multi-account landing zone
  • AWS Organizations — SCPs and account boundaries (billing side is Domain 4)
• Encryption
  • At rest: AWS Key Management Service (KMS), AWS CloudHSM (Hardware Security Module)
  • In transit: AWS Certificate Manager (ACM)
• Data sensitivity: Personally Identifiable Information (PII), Amazon Macie

2.3 — Access management

• AWS Identity and Access Management (IAM) — users, groups, roles, policies, least privilege, root protection
• AWS IAM Identity Center — SSO and federated identity
• Amazon Cognito — identity for application end users
• AWS Directory Service — managed Active Directory
• Credential storage: AWS Secrets Manager, AWS Systems Manager
• AWS Resource Access Manager (RAM) — sharing resources across accounts

2.4 — Components and resources for security

• Network controls: security groups (allow only, stateful), network ACLs (can deny, stateless)
• Perimeter: AWS WAF, AWS Shield, AWS Network Firewall, AWS Firewall Manager
• Detection: Amazon GuardDuty (threats), Amazon Inspector (vulnerabilities), Amazon Detective (investigation), AWS Security Hub (aggregation)
• AWS Trusted Advisor — flags security issues such as open security groups (also Domain 4)
• Third-party security products: AWS Marketplace
• Where security information lives: AWS Knowledge Center, AWS Security Center, AWS Security Blog