What's changed: In-scope coverage: added a security/identity in-scope services block to Ch5 (IAM Identity Center/Cognito/Directory Service/Certificate Manager/CloudHSM/Firewall Manager/Detective/Audit Manager)
5.2Security and Compliance Services
Organize key AWS security services by purpose (detect/audit, protect, protect data, identity) and understand AWS Artifact for compliance information.
AWS has many security services, and memorizing names alone gets confusing. The trick is to group them by purpose into five buckets—detect/audit, protect, protect data, identity, compliance. With this map, you can place any new service name into the right bucket.
5.2.1Detect and audit
- CloudTrail: records an audit log of API activity (who did what, and when).
- AWS Config: records resource configuration and evaluates compliance with rules (tracks config changes).
- Amazon GuardDuty: analyzes logs to detect threats automatically. Also in "detect": Security Hub (aggregates findings), Amazon Inspector (vulnerability scanning), Amazon Macie (sensitive-data discovery in S3, etc.).
5.2.2Protect and protect data
- AWS WAF: protects web apps from malicious requests (e.g., SQL injection). AWS Shield: protects against DDoS attacks.
- AWS KMS: create/manage encryption keys (encrypt data at rest/in transit). AWS Secrets Manager: manage secrets like API keys and passwords (with rotation).
5.2.3Identity and compliance
- IAM (previous section): identity and access management (who can do what).
- AWS Artifact: obtain AWS compliance reports and agreements (ISO/SOC audit artifacts) on demand.
- AWS Trusted Advisor: recommends best practices across cost, security, reliability, performance, and service limits (useful for security checks too).
| Purpose | Key services |
|---|---|
| Detect/audit | CloudTrail / Config / GuardDuty / Inspector / Macie |
| Protect | WAF / Shield |
| Protect data | KMS / Secrets Manager |
| Identity | IAM / IAM Identity Center |
| Compliance/advice | Artifact / Trusted Advisor |
Scenario: audit and incident investigation. "Who changed this setting?" → CloudTrail (API logs). "Are we compliant right now?" → Config. "Any suspicious access?" → GuardDuty. Defend web attacks with WAF/Shield, encrypt data with KMS, and provide audit artifacts via Artifact. Pick services by working backward from the purpose.
Three easily confused: logs/audit = CloudTrail, configuration recording/compliance = Config, threat detection = GuardDuty. Also distinguish WAF (malicious web requests) ≠ Shield (DDoS), KMS (key management) ≠ Secrets Manager (secrets), and Artifact (get documents) ≠ Config (evaluate your own config).
Q. Does AWS encrypt data for me automatically? Many services make encryption easy to enable, with keys managed by KMS, but enabling/configuring encryption is your responsibility ("in the cloud"). Some defaults exist, but you should set and verify it per your requirements.
Common points: CloudTrail = API audit logs / Config = configuration & compliance / GuardDuty = threat detection / WAF = web protection / Shield = DDoS / KMS = key management / Secrets Manager = secrets / Artifact = compliance docs / Trusted Advisor = best-practice recommendations.
5.2.4Additional in-scope security and identity services
CLF-C02’s security scope also includes these. Identity: AWS IAM Identity Center for single sign-on (SSO) across accounts and apps, Amazon Cognito for end-user authentication (sign-up/sign-in) of web/mobile apps, and AWS Directory Service for managed Active Directory. Protection/encryption: AWS Certificate Manager to issue and auto-renew HTTPS certificates for free, AWS CloudHSM to manage encryption keys in dedicated hardware, and AWS Firewall Manager to centrally manage WAF/firewall rules across many accounts. Detection/audit: Amazon Detective to investigate threats and analyze root causes, and AWS Audit Manager to continuously collect evidence and streamline compliance audits. Distinguish by role: "SSO = IAM Identity Center / app user auth = Cognito / AD = Directory Service / certificates = Certificate Manager / dedicated key HW = CloudHSM / central firewall = Firewall Manager / investigation = Detective / audit automation = Audit Manager."
5.2.5Section summary
- Detect/audit: CloudTrail (API) / Config (configuration) / GuardDuty (threats) / Inspector, Macie, Detective, Audit Manager
- Protect: WAF (web) / Shield (DDoS) / Firewall Manager (central); data: KMS / CloudHSM / Secrets Manager / Certificate Manager
- Identity: IAM / IAM Identity Center (SSO) / Cognito (app auth) / Directory Service (AD); compliance: Artifact / Trusted Advisor
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which service records an audit log of API activity (who did what)?
Q2. Which AWS service protects against DDoS attacks?
Q3. Which service lets you obtain AWS compliance reports and agreements?
Q4. Which service records resource configuration and evaluates compliance with rules?
Q5. Which AWS service creates and manages encryption keys?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.