What's changed: Deepened SCS-C02 Chapter 6 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
6.3Operational Governance and Cost/Secret Control
Understand operational governance—tagging strategy, Trusted Advisor, cost anomaly detection, patch/config compliance, org-wide secret management, and backup policies. Balance security and operations.
Security is inseparable from operational governance. Keep consistency with tags and automated checks, and catch anomalies early.
6.3.1Operational governance
- Tagging strategy: classify by owner/environment/sensitivity for policy application and cost allocation.
- Trusted Advisor: check best practices across security/cost/fault tolerance.
- Cost anomaly detection: detect suspicious usage spikes (possible compromise signal).
- Org secret/backup management: Secrets Manager cross-account sharing, centralized AWS Backup policies.
Common on SCS-C02: classification/cost allocation/policy = tagging strategy, best-practice checks = Trusted Advisor, usage anomalies = cost anomaly detection (also a compromise signal), patch/config maintenance = Systems Manager. Tags also enable security (ABAC: attribute-based access control).
SCS-C02 operational governance probes "running security and operations together and governing by attributes." A tagging strategy applies consistent keys (owner, environment, sensitivity, cost center) for cost allocation, tag enforcement via Config/SCP (required tags), and ABAC (attribute-based access control)—matching aws:PrincipalTag with aws:ResourceTag in conditions to manage permissions scalably (e.g., "allow if the same department tag"). Versus RBAC (role-based), ABAC controls dynamically by tags and scales with resource growth. Trusted Advisor cross-checks best practices for security (open ports, root MFA, IAM usage), cost, fault tolerance, and service limits. Cost anomaly detection uses ML to flag abnormal usage spikes, which signal not just budget overruns but also compromise (e.g., crypto mining). Systems Manager maintains patch/config compliance via State Manager/Patch Manager and visualizes assets via Inventory. Govern secrets with Secrets Manager cross-account sharing/auto-rotation and backups with AWS Backup organization policies + separate-account protection. The key is to center on a tagging strategy (incl. ABAC) and continuously govern operations and security with Trusted Advisor / cost anomaly detection / Systems Manager.
| Goal | Means | Key point |
|---|---|---|
| Classify/permission/cost | Tagging strategy (ABAC) | Enforce required tags; dynamic control by attribute |
| Best-practice checks | Trusted Advisor | Security/cost/fault tolerance/limits |
| Detect usage anomalies | Cost anomaly detection | Budget overrun + compromise signal |
| Patch/config maintenance | Systems Manager | State/Patch Manager; Inventory |
Scenario: Separate resource access by department and manage it without adding policies as resources grow, while catching early compromise signals. → Tag resources and principals with a department tag and control access dynamically with ABAC (Allow conditioned on aws:PrincipalTag/Department matching aws:ResourceTag/Department), scaling without more roles. Detect suspicious usage spikes (mining and other compromise signs) with cost anomaly detection, check open ports and missing root MFA with Trusted Advisor, and maintain patch compliance with Systems Manager.
FAQ: RBAC vs ABAC? RBAC assigns permissions per role (job function)—clear, but roles proliferate as resources/teams grow. ABAC decides access dynamically using attributes like tags (e.g., allow if the principal’s and resource’s department tags match), scaling without adding policies as resources grow. ABAC is effective in large multi-team environments.
Exam trap: Treating cost anomaly detection as "just billing alerts" is shallow—usage spikes can signal compromise (rogue resource launches, mining) and serve security monitoring. Also, RBAC-only that adds roles for every new resource becomes unmanageable; tag-based ABAC for scalable permissions is the norm in large environments. Enforce required tags via Config/SCP.
6.3.2Section summary
- Governance = tagging strategy (incl. ABAC) + Trusted Advisor
- Detect/maintain = cost anomaly detection + Systems Manager (patch/config)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Classify resources by owner/environment/sensitivity for policy and cost allocation. What?
Q2. Auto-detect unusual usage spikes (a possible compromise signal). What?
Q3. Dynamically control access based on tag values (e.g., department). What is this called?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.