1.4Governance, Security, and End-User Services

SAP-C02 also tests separating the roles of supporting services that underpin organizational security and governance, not just the core ones. Each service here is summarized by definition, role, and when to choose it.

1.4.1Certificates, keys, identity, and directories

• AWS Certificate Manager (ACM): managed issuance and auto-renewal of TLS/SSL certificates. Choose it to attach free certificates to ELB, CloudFront, or API Gateway; auto-renewal prevents expiry incidents.
• AWS CloudHSM: a dedicated single-tenant HSM (hardware security module). Choose it when regulations require FIPS 140-3 Level 3 or full, exclusive control of keys; use KMS when a shared service suffices, CloudHSM when exclusivity is mandated.
• Amazon Cognito: user sign-up/sign-in (user pools) for web/mobile apps and temporary AWS credentials (identity pools). Choose it for app end-user authentication (use IAM Identity Center for workforce SSO).
• AWS Directory Service: managed Microsoft Active Directory (AWS Managed AD). Choose it for Windows workloads or domain joins that need AD integration with an existing directory.

1.4.2Network defense, audit, and compliance

• AWS Network Firewall: a managed stateful firewall (IPS/domain filtering) for VPCs. Choose it to inspect and control VPC traffic at L3-L7 in detail.
• AWS Firewall Manager: centrally applies WAF/Shield/Network Firewall/security-group rules across an Organization. Choose it to govern firewall policy across many accounts.
• AWS Artifact: a portal to download AWS compliance reports (SOC, ISO, PCI, etc.) and agreements on demand. Choose it when you need third-party attestations for auditors.
• AWS Audit Manager: automates evidence collection, continuously gathering audit evidence and mapping it to frameworks (CIS, PCI, etc.). Choose it to reduce manual audit-preparation effort.

1.4.3Cost, governance, and operations tooling

• AWS Cost and Usage Report (CUR): exports the most granular billing/usage data to S3 by hour and resource. Choose it for deep cost analysis or allocation via Athena/QuickSight (use Cost Explorer for overviews).
• AWS License Manager: tracks software licenses (cores/sockets, etc.) and enforces limits. Choose it to govern license compliance for BYOL or Dedicated Hosts.
• AWS Service Catalog: catalogs approved IaC products for self-service and controls who can deploy what. Choose it to distribute only standardized, approved configurations to users.
• AWS Well-Architected Tool: reviews workloads against the six pillars and surfaces risks and improvements. Choose it to record and track design reviews regularly.
• AWS Health Dashboard: notifies you of AWS-side events, planned maintenance, and outages affecting your account. Choose it to react to AWS events on your resources via EventBridge.
• AWS Management Console: the browser GUI for operating AWS. Use it for manual checks and initial setup (move repetitive work to CLI/IaC).
• AWS CLI: a command-line interface to call AWS APIs from a shell. Choose it to operate AWS from scripts, automation, or CI/CD.

1.4.4End-user computing

• Amazon WorkSpaces: managed virtual desktops (DaaS). Choose it to provide persistent cloud PCs to remote/contract staff without leaving data on devices.
• Amazon AppStream 2.0: streams individual applications. Choose it to deliver specific apps (not a full desktop) securely via a browser.

1.4.5Section summary

• Certs/keys/identity = ACM, CloudHSM, Cognito, Directory Service
• Defense/audit/governance = Network Firewall, Firewall Manager, Artifact, Audit Manager, Service Catalog, CUR