Section 2.2 - AWS Certified Cloud Practitioner Study Guide
Tags: aws, cloudskills, examprep, cloud
Published: 2022-02-24 19:03:28

**This series is intended to be a personal study guide. Information may not be comprehensive or accurate. I am sharing it in case others find it useful. Please feel free to comment if any information is inaccurate.**

[Return to Exam Guide](https://dev.to/aidutcher/aws-certified-cloud-practitioner-study-guide-exam-guide-outline-233o)

<u>**2.2 Define AWS Cloud security and compliance concepts**</u>

**Identify where to find AWS compliance information**

- [AWS Compliance page](https://aws.amazon.com/compliance/)
- [Compliance Whitepaper](https://docs.aws.amazon.com/whitepapers/latest/introduction-aws-security/compliance.html)
- _Locations of lists of recognized available compliance controls (for example: HIPPA, SOCs)_
     - [Compliance resources](https://aws.amazon.com/compliance/resources/)
- _Recognize that compliance requirements vary among AWS services_

**At a high level, describe how customers achieve compliance on AWS**

- _[Identify different encryption options on AWS](https://aws.amazon.com/blogs/security/importance-of-encryption-and-how-aws-can-help/) (for example, in transit, at rest)_
     - In transit - encrypting while data moves from one place to 
                    another
     - At rest -   encrypting in storage and compute
- AWS compute environments are continuously audited
- Assurance programs provide templates and control mappings
- Automated tools and services reduce audit effort

**Describe who enables encryption on AWS for a given service**

- AWS automatically encrypts traffic on global and regional networks between AWS secured facilities
- Customers independently control encryption on services as a part of the shared responsibility model

**Recognize there are services that will aid in auditing and reporting**

- _Recognize that logs exist for auditing and monitoring (do not have to understand the logs)_
- _Define Amazon CloudWatch, AWS Config, and AWS CloudTrail_
     - [CloudWatch](https://aws.amazon.com/cloudwatch/)  
          - monitoring and observability service to detect 
          anomalous behavior in your environments, set alarms, 
          visualize logs and metrics side by side, take automated 
          actions, troubleshoot issues, and discover insights to 
          keep your applications running smoothly
     - [Config](https://aws.amazon.com/config/)
          - service that enables you to assess, audit, and 
          evaluate the configurations of your AWS resources. 
          - Config continuously monitors and records your AWS 
          resource configurations and allows you to automate the 
          evaluation of recorded configurations against desired 
          configuration
     - [CloudTrail](https://aws.amazon.com/cloudtrail/)
          - monitors and records account activity across your AWS 
          infrastructure, giving you control over storage, 
          analysis, and remediation actions

**Explain the concept of least privileged access**

- [Least privileged access user guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege)
- Users and roles should have the minimum amount of access needed to perform their tasks

[Return to Exam Guide](https://dev.to/aidutcher/aws-certified-cloud-practitioner-study-guide-exam-guide-outline-233o)