Compliance and Governance

AWS Config

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records resource configurations, letting you automate the evaluation of recorded configurations against desired configurations.

What AWS Config Does

Operational Notes

• Regional service: Enable it in every Region you use. Alerts and rules are Region-scoped.
• Aggregator: Optional feature that provides an aggregated view across multiple Regions and multiple accounts — useful for large organizations.
• Config rules: Use AWS-managed rules (pre-built) or custom rules (Lambda-based).
• Use cases: Compliance auditing, security analysis, change management, operational troubleshooting.

AWS CloudTrail (Governance Review)

CloudTrail tracks user activity and API usage. It logs all API requests to resources in all supported services — who did what, when, and from which IP address.

Key Points for Governance

• Enabled by default: 90 days of management event history, free, viewable in Event history.
• Create a Trail for retention: Send logs to an S3 bucket for permanent storage. Optionally deliver to CloudWatch Logs for alerting.
• Apply to all Regions: A single Trail can cover all Regions. Or you can scope it per Region.
• Governance value: Provides the audit trail required for compliance — proves what actions were taken and by whom.
• Organizational Trails: For AWS Organizations, create a Trail that logs all activity across all member accounts.

AWS Artifact

AWS Artifact provides on-demand downloads of AWS security and compliance documents. You submit these audit artifacts to your auditors or regulators to demonstrate the security and compliance of the AWS infrastructure you use.

What You Get from Artifact

• Compliance reports: ISO certifications (27001, 27017, 27018), PCI DSS, SOC 1/2/3 reports.
• Agreements: Review, accept, and manage AWS agreements such as the Business Associate Agreement (BAA) for HIPAA compliance.
• Multi-account: Accept an agreement once on behalf of all accounts in an AWS Organization.

AWS Compliance Programs

AWS engages with external certifying bodies and independent auditors to provide customers with information about the policies, processes, and controls established and operated by AWS. These programs fall into three categories:

Data Protection: Encryption and S3 Security

Encryption at Rest

Data stored physically on disk or tape can be encrypted using AWS KMS with the AES-256 algorithm. Services that support KMS encryption at rest include S3, EBS, EFS, RDS, DynamoDB, and Redshift. Encryption and decryption are handled automatically and transparently — no application changes needed.

Encryption in Transit

Data moving across the network is encrypted using TLS 1.2 (formerly SSL). AWS Certificate Manager provisions, manages, and deploys SSL/TLS certificates — and handles automatic renewal — for use with load balancers, CloudFront distributions, and API Gateway. HTTPS (HTTP over TLS) protects against eavesdropping and man-in-the-middle attacks.

Securing S3 Buckets and Objects

• Default private: Newly created S3 buckets and objects are private and protected by default.
• S3 Block Public Access: A straightforward setting that overrides all other policies. Enable it on all buckets that should not be publicly accessible.
• Bucket policies: JSON resource-based policies. Use when the user/system cannot authenticate via IAM. Can grant cross-account access.
• ACLs: Legacy access control mechanism. Less commonly used; avoid overly permissive ACL configurations.
• Trusted Advisor bucket permission check: Free feature that identifies buckets with permissions granting global access.