Compliance and Governance
Learn how AWS proves it meets security standards, how to protect data with encryption, and how to track activity and configuration with AWS Artifact, KMS, CloudHSM, ACM, CloudTrail, CloudWatch, and AWS Config.
Compliance and Governance is the second topic in the Security and Compliance domain. It covers three jobs that go together once your workloads are live: proving AWS meets recognized security standards, encrypting your data so it stays protected, and watching over your account so you always know what changed and whether it still follows your rules.
The topic has 3 lessons. The first covers AWS compliance programs and AWS Artifact, the portal where you download audit reports on demand. The second covers encryption at rest and in transit, plus the services that manage your keys and certificates. The third covers monitoring and auditing with AWS CloudTrail, Amazon CloudWatch, and AWS Config.
What This Topic Covers
- what cloud compliance means and how AWS proves it through audited programs like SOC, PCI DSS, and ISO 27001
- AWS Artifact, the self-service portal for downloading AWS audit reports and accepting agreements
- the difference between encryption at rest (often AES-256) and encryption in transit (TLS)
- AWS KMS and AWS CloudHSM for managing encryption keys, and when each one fits
- AWS Certificate Manager for provisioning and renewing SSL/TLS certificates
- AWS CloudTrail, Amazon CloudWatch, and AWS Config, and the distinct job each one does
Why It Matters
This topic gives you the language AWS uses for trust and accountability, and the CLF-C02 exam tests it often. Many questions come down to picking the right service for a need: where to get an audit report for your auditor, how to protect stored data, or who terminated a resource and when. If you know the one job each service does best, you can answer these quickly instead of second-guessing similar-sounding names.
It matters past the exam too. These are the services teams actually use to stay compliant and in control of a real AWS account. Artifact supplies the evidence regulators ask for, KMS and CloudHSM guard your keys, and CloudTrail, CloudWatch, and Config together answer who did what, how the system is performing, and whether your resources still match the rules you set.