Task Statement 1.3: Determine appropriate data security controls.
📘AWS Certified Solutions Architect – (SAA-C03)
This topic is very important for the SAA-C03 exam. You must understand:
- What compliance means in AWS
- How AWS supports compliance
- Which AWS services help meet compliance requirements
- How to design compliant architectures
- What AWS is responsible for and what the customer is responsible for
This explanation is written in simple and easy English so everyone can understand.
1. What Is Compliance?
Compliance means following laws, regulations, standards, and internal company policies related to data security.
Organizations may need to follow:
- Government regulations
- Industry standards
- Internal security policies
These rules usually focus on:
- Data protection
- Encryption
- Access control
- Logging and monitoring
- Data retention
- Audit tracking
In AWS, compliance means choosing the correct AWS services and configurations to meet these requirements.
2. Shared Responsibility Model and Compliance
Before aligning AWS technologies, you must understand the Shared Responsibility Model.
AWS is responsible for:
- Security of the cloud (data centers, hardware, networking, infrastructure)
Customers are responsible for:
- Security in the cloud (data, IAM permissions, encryption settings, configurations)
For the exam:
- If the question talks about physical security → AWS responsibility
- If it talks about encryption settings or access control → Customer responsibility
3. AWS Compliance Programs
AWS supports many global compliance standards. You do not need deep details for each, but you must understand that AWS provides certified infrastructure.
Examples of compliance programs supported by AWS:
- AWS
- ISO
- SOC
- PCI DSS
- HIPAA
- GDPR
- FedRAMP
For the exam:
- AWS infrastructure is already certified.
- You must configure your services properly to remain compliant.
4. Key AWS Services for Compliance
To align AWS technologies with compliance requirements, you must understand the following services.
4.1 Identity and Access Control
1️⃣ AWS Identity and Access Management (IAM)
IAM controls:
- Who can access AWS resources
- What actions they can perform
For compliance:
- Apply least privilege
- Use IAM roles instead of long-term credentials
- Enable MFA for sensitive users
- Rotate access keys
Exam Tip:
If the question asks about restricting access → IAM is usually the answer.
2️⃣ AWS Organizations
Used to:
- Manage multiple AWS accounts
- Apply Service Control Policies (SCPs)
For compliance:
- Enforce policies across all accounts
- Prevent users from disabling security controls
3️⃣ AWS IAM Identity Center
Provides:
- Centralized access management
- Integration with external identity providers
Important for:
- Central compliance control
- Enterprise user management
4.2 Encryption and Key Management
Most compliance standards require encryption.
1️⃣ AWS Key Management Service (KMS)
Used to:
- Create and manage encryption keys
- Control who can use keys
- Enable key rotation
Exam Tip:
If the question mentions:
- Customer-managed keys
- Key rotation
- Control over encryption keys
→ Choose KMS.
2️⃣ AWS CloudHSM
Provides:
- Dedicated hardware security modules
- Full control over cryptographic keys
Used when:
- Strict regulatory requirements demand dedicated hardware.
3️⃣ Encryption at Rest and In Transit
AWS services that support encryption:
- Amazon S3
- Amazon EBS
- Amazon RDS
- Amazon DynamoDB
For compliance:
- Enable encryption at rest
- Use TLS/HTTPS for encryption in transit
4.3 Logging, Monitoring, and Auditing
Compliance requires audit trails.
1️⃣ AWS CloudTrail
Records:
- API calls
- User activity
- Account changes
Used for:
- Audit reports
- Investigation
- Compliance evidence
Exam Tip:
If the question says “track who did what” → CloudTrail.
2️⃣ Amazon CloudWatch
Used for:
- Monitoring metrics
- Setting alarms
- Log monitoring
3️⃣ AWS Config
Tracks:
- Resource configuration changes
- Compliance against rules
Can:
- Automatically detect non-compliant resources
Exam Tip:
If question says:
“Detect if a resource becomes non-compliant”
→ AWS Config.
4.4 Security Assessment and Continuous Compliance
1️⃣ AWS Security Hub
Provides:
- Central dashboard
- Aggregates findings from multiple services
- Checks against compliance standards
2️⃣ Amazon GuardDuty
Detects:
- Suspicious activity
- Malicious behavior
3️⃣ Amazon Macie
Identifies:
- Sensitive data in S3
- Misconfigured buckets
Important for:
- Data protection regulations
4️⃣ AWS Artifact
Provides:
- AWS compliance reports
- Audit documents
- Agreements
Exam Tip:
If the question asks:
“Where to download AWS compliance reports?”
→ AWS Artifact.
4.5 Data Residency and Regional Compliance
Some regulations require:
- Data must stay in a specific country or region.
AWS solution:
- Choose appropriate AWS Region.
- Do not replicate data to other regions.
- Use region-based controls.
For example:
If regulation requires data to remain in Europe:
- Deploy only in EU regions.
- Restrict cross-region replication.
5. Designing Compliant Architectures (Exam Perspective)
When designing for compliance, think about:
1️⃣ Access Control
- IAM roles
- Least privilege
- MFA
- SCPs
2️⃣ Encryption
- KMS-managed keys
- Encryption by default
- Enforce HTTPS
3️⃣ Monitoring
- CloudTrail enabled in all regions
- Centralized logging
- Log retention policies
4️⃣ Governance
- AWS Config rules
- Security Hub checks
- Organization-level controls
5️⃣ Data Lifecycle
- S3 lifecycle policies
- Backup policies
- Retention rules
6. Common Exam Scenarios
You may see questions like:
Scenario 1:
Organization must prove all API activity is recorded.
→ Enable CloudTrail in all regions.
Scenario 2:
Need centralized compliance dashboard.
→ Use Security Hub.
Scenario 3:
Require encryption with customer-controlled keys.
→ Use KMS with customer-managed keys.
Scenario 4:
Need to prevent users from disabling encryption.
→ Use Service Control Policies via AWS Organizations.
Scenario 5:
Need audit-ready AWS compliance documentation.
→ Use AWS Artifact.
7. Important Design Principles for Compliance
For the exam, remember these principles:
- Enable encryption by default.
- Log everything.
- Use least privilege.
- Use multi-account strategy.
- Centralize security monitoring.
- Automate compliance checks.
- Choose correct region for data residency.
- Regularly review configurations.
8. Final Exam Checklist for This Topic
Make sure you understand:
✔ Shared Responsibility Model
✔ IAM and access control
✔ Encryption services (KMS, CloudHSM)
✔ Logging services (CloudTrail, Config, CloudWatch)
✔ Monitoring and threat detection (GuardDuty, Security Hub, Macie)
✔ Compliance documentation (AWS Artifact)
✔ Multi-account governance (AWS Organizations)
✔ Regional data residency
✔ Automatic compliance enforcement
Final Summary
Aligning AWS technologies to meet compliance requirements means:
- Understanding what regulation requires
- Choosing the correct AWS services
- Configuring them securely
- Continuously monitoring compliance
- Providing audit evidence
AWS provides a compliant infrastructure.
Your responsibility is to configure and operate services securely.
