What's changed: Deepened SCS-C02 Chapter 6 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
6.2Configuration Compliance and Auto-Remediation
Understand continuous compliance—AWS Config (rules/conformance packs), auto-remediation, Security Hub standards, Audit Manager, and Systems Manager. Continuously assess compliance and auto-fix drift.
Compliance is continuously assessed and corrected. AWS Config evaluates rules and auto-remediates drift.
6.2.1Compliance automation
- AWS Config: continuously evaluate configuration against rules, detecting drift (public S3, missing encryption).
- Auto-remediation: attach remediation actions (SSM Automation) to Config rules to auto-fix drift.
- Security Hub standards/conformance packs: score and bundle CIS/AWS Foundational Best Practices.
- Audit Manager: continuously collect audit evidence to support compliance reports.
Common on SCS-C02: continuous config compliance = AWS Config (rules/conformance packs), auto-fix drift = Config remediation/SSM Automation, best-practice scoring = Security Hub standards, audit evidence = Audit Manager. "Detect public S3 → auto-make private" is a classic Config rule + remediation.
SCS-C02 compliance automation probes the closed loop of "continuously evaluating desired configuration, auto-remediating drift, and retaining audit evidence." AWS Config records resources as configuration items, evaluates compliance via managed rules (s3-bucket-server-side-encryption-enabled, restricted-ssh, ec2-instance-no-public-ip) or Lambda custom rules, and distributes rule sets for PCI DSS/HIPAA/CIS via Conformance Packs. Attach remediation actions (SSM Automation documents) to violations for auto-fix on detection (e.g., block public S3, tag unencrypted volumes). Across an org, a Config aggregator centralizes compliance from all accounts/regions. Security Hub aggregates findings from GuardDuty/Inspector/Macie/Config in ASFF, scores posture against CIS / AWS Foundational Security Best Practices / PCI DSS, and streamlines response via automation rules. Audit Manager continuously collects and organizes audit evidence against regulatory frameworks (PCI DSS, HIPAA, SOC 2) to support audit reporting. Combine auto-remediation with EventBridge → Lambda/SSM, safely via idempotency and guardrails (thresholds/approvals). The key is to build the closed loop: continuous evaluation with Config + regulatory coverage via conformance packs, auto-fix via remediation actions, scoring via Security Hub, and evidence via Audit Manager.
| Role | Service | Key point |
|---|---|---|
| Continuous config eval | AWS Config (rules/conformance packs) | Config items; bundled regulatory rules |
| Auto-fix drift | Remediation (SSM Automation) | Attach to rules; auto-fix on detection |
| Posture scoring | Security Hub standards | Aggregate score vs CIS/FSBP/PCI DSS |
| Audit evidence | Audit Manager | Continuous collection per framework |
Scenario: For PCI DSS, you must "apply rules like mandatory encryption and no public access company-wide, auto-remediate violations, and retain audit evidence." → Distribute PCI DSS-related rules to all accounts via an AWS Config conformance pack (aggregated via the aggregator). Auto-fix violations with remediation actions (SSM Automation) (e.g., make public S3 private). Visualize compliance with the Security Hub PCI DSS standard, and continuously collect audit evidence with Audit Manager to produce audit reports.
FAQ: AWS Config vs Security Hub vs Audit Manager? Config continuously evaluates/records whether resource configuration complies with rules and can auto-remediate. Security Hub is the dashboard/hub that aggregates and scores findings across services to visualize posture. Audit Manager collects and organizes audit evidence against regulatory frameworks to support audits. Config for configuration compliance, Security Hub for cross-cutting scoring, Audit Manager for audit evidence.
Exam trap: Thinking "continuously collect audit evidence" is Security Hub is wrong—that is Audit Manager. Security Hub aggregates and scores findings (dashboard). Also, merely creating a Config rule does not auto-remediate—only with an attached remediation action does auto-fix happen. Don’t confuse "config compliance = Config / cross-cutting score = Security Hub / audit evidence = Audit Manager."
6.2.2Section summary
- Assess = AWS Config (rules/conformance packs) / fix = auto-remediation (SSM)
- Standards = Security Hub / audit evidence = Audit Manager
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Continuously evaluate config compliance (e.g., S3 must be encrypted) and detect drift. What?
Q2. Auto-fix Config rule violations (e.g., public S3) without extra code. What?
Q3. Score posture against CIS / AWS Foundational Security Best Practices. What?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.