AWS Certified Cloud Practitioner · CLF-C02

Security and Compliance

Domain 2 — Comprehensive Study Guide
Task Statements 2.1 · 2.2 · 2.3 · 2.4

30% of Exam Score — Highest Weighted Domain

Domain 2 Overview

Task 2.1 — Shared Responsibility Model

AWS responsibilities vs. customer responsibilities
How the split shifts by service type
"Security OF the cloud" vs. "IN the cloud"

Task 2.2 — Security, Governance & Compliance

AWS Artifact & compliance programs
Encryption in transit / at rest
Monitoring, auditing & reporting services

Task 2.3 — Access Management

IAM users, groups, roles & policies
Root user protection
MFA, IAM Identity Center, federation

Task 2.4 — Security Components & Resources

AWS WAF, Shield, GuardDuty, Firewall Manager
AWS Marketplace security products
Where to find AWS security documentation

Domain 2 is the heaviest-weighted domain on the exam, so it's worth spending extra review time here. Task 2.1 establishes the shared responsibility model, which is the conceptual foundation for nearly every other security question on the exam — you need to know exactly where AWS's job ends and the customer's job begins, and how that line moves depending on the service. Task 2.2 covers governance, compliance, and the specific AWS services used for monitoring, auditing, and reporting. Task 2.3 is about identity and access management — IAM users, groups, roles, policies, and root account protection. Task 2.4 rounds things out with AWS's purpose-built security services like WAF, Shield, and GuardDuty, plus where to go to find official security documentation.

2.1Task Statement 2.1

The AWS Shared Responsibility Model

Security OF the Cloud · Security IN the Cloud

2.1

Security OF vs. IN the Cloud

AWS Responsibility — "OF the Cloud"

Physical data center security
Hardware, networking infrastructure
Host operating system & virtualization layer
Global infrastructure (Regions, AZs, edge locations)

Customer Responsibility — "IN the Cloud"

Guest OS, updates & patches
Data encryption & protection
IAM configuration — users, groups, policies
Network & firewall configuration (security groups, NACLs)
Application-level security

Exam trigger: "Who patches the underlying hypervisor?" → AWS. "Who configures security group rules?" → Customer. Any question about data, IAM, or application config → Customer.

AWS is responsible for security "of" the cloud — the physical facilities, the hardware, the global network, and the virtualization layer that everything else runs on top of. The customer is responsible for security "in" the cloud — everything they put into that infrastructure, including their data, their identity and access configuration, their operating system patches on services they manage themselves, and their application code. A simple way to remember it: AWS secures the building and the utilities; the customer secures what they store inside it and who has the keys. This distinction is tested constantly, often as a "who is responsible for X" question, and the fastest way to answer is to ask whether the item is part of the underlying infrastructure AWS operates, or something the customer configures or uploads themselves.

2.1

How Responsibility Shifts by Service

Service Type	Example	Customer Manages	AWS Manages
Infrastructure (IaaS)	Amazon EC2	Guest OS, patches, apps, data, firewall config	Physical host, hypervisor, network, facilities
Managed Service	Amazon RDS	Data, access control, database settings	OS patching, DB engine installation, backups infrastructure
Serverless (Abstracted)	AWS Lambda	Function code, IAM permissions, data	OS, runtime, server provisioning & scaling

Exam trigger: the more "managed" or "serverless" a service is, the more AWS takes on — and the less the customer has to patch or provision.

The exact line between AWS and customer responsibility moves depending on which service you use. With Amazon EC2, an infrastructure-as-a-service offering, the customer manages almost everything above the hypervisor — guest operating system, patches, applications, and firewall rules — while AWS manages the physical host and everything below it. With a managed service like Amazon RDS, AWS takes over operating system patching and database engine installation, and the customer's job narrows to managing their data and access control. With a fully serverless service like AWS Lambda, AWS manages the server, operating system, and runtime entirely — the customer is only responsible for their function code, the data it processes, and the IAM permissions attached to it. The general pattern to remember: the more abstracted or "managed" a service is, the more responsibility shifts to AWS, and the less operational burden — but not security burden — falls on the customer. Configuring things like IAM policies and data encryption always remains a customer responsibility regardless of service type.

2.2Task Statement 2.2

Security, Governance & Compliance

Compliance Programs · Encryption · Monitoring · Auditing

2.2

Compliance Programs & AWS Artifact

AWS Artifact

Self-service portal for on-demand access to AWS compliance reports (SOC, PCI, ISO) and to review and accept AWS agreements. The primary source of AWS compliance documentation for auditors.

Compliance Varies by Geography & Industry

Different regions and industries carry different regulatory requirements — GDPR in the EU, HIPAA for U.S. healthcare data, FedRAMP for U.S. government workloads. Customers remain responsible for meeting requirements that apply to their own workload.

Shared Compliance Responsibility

AWS provides compliant infrastructure and certifications; the customer is responsible for configuring their own workload to actually meet the compliance requirements that apply to them.

AWS Artifact is the go-to answer whenever a question asks where to find AWS's official compliance reports or agreements — it's a self-service portal that gives on-demand access to documents like SOC reports, PCI compliance reports, and ISO certifications, without needing to contact AWS directly. Compliance requirements are not one-size-fits-all: a healthcare company in the United States needs to think about HIPAA, a company handling EU citizen data needs to think about GDPR, and a U.S. government contractor needs to think about FedRAMP. AWS provides infrastructure that is certified against many of these standards, but achieving compliance for a specific workload is still a shared effort — AWS's certifications don't automatically make a customer's application compliant if the customer's own configuration doesn't meet the requirement.

2.2

Encryption Options

Type	Protects	Example
Encryption at Rest	Data stored on disk (in a database, S3 bucket, or EBS volume)	Amazon S3 server-side encryption, AWS KMS-managed keys
Encryption in Transit	Data moving across a network between systems	TLS/SSL for API calls and web traffic

Exam trigger: "Protect data stored in S3" → encryption at rest. "Protect data moving between the client and the server" → encryption in transit.

Encryption is one of the concrete benefits of cloud security called out directly in the exam guide. Encryption at rest protects data while it's stored — sitting in an S3 bucket, an EBS volume, or a database — typically managed through AWS Key Management Service, or KMS. Encryption in transit protects data while it's moving across a network, such as between a user's browser and a web server, and is typically implemented with TLS or SSL. On the exam, a question describing data "sitting" somewhere points to encryption at rest, while a question describing data "moving" or "in transmission" points to encryption in transit. Cloud Practitioner-level questions generally stop at recognizing which type applies to a scenario, not at configuring the specific encryption mechanism.

2.2

Governance: Monitoring, Auditing & Reporting

Service	Category	Purpose
Amazon CloudWatch	Monitoring	Collects metrics and logs; triggers alarms on thresholds
AWS CloudTrail	Auditing	Logs every API call made in an account — "who did what, when"
AWS Config	Auditing	Tracks resource configuration changes over time for compliance
AWS Audit Manager	Auditing	Continuously collects evidence to simplify compliance audits
Amazon Inspector	Security Assessment	Automated vulnerability scanning for EC2 and container workloads
AWS Security Hub	Security Assessment	Centralized view of security findings across AWS accounts and services
Amazon GuardDuty	Threat Detection	Continuous, intelligent threat detection using ML and threat intel

This slide is one of the densest in Domain 2 and is worth memorizing carefully, because the exam frequently asks "which service would you use to..." questions. Amazon CloudWatch is about monitoring — collecting metrics, logs, and setting alarms on operational thresholds. AWS CloudTrail is about auditing user and API activity — it answers "who did what, and when" inside an account, which is the classic CloudTrail exam scenario. AWS Config tracks how resource configurations change over time, which is useful for verifying that resources stay compliant with an organization's rules. AWS Audit Manager continuously gathers evidence to make compliance audits less manual. Amazon Inspector automatically scans EC2 instances and container images for software vulnerabilities. AWS Security Hub aggregates security findings from multiple AWS security services into a single dashboard. Amazon GuardDuty is a continuous, intelligent threat detection service that analyzes account and network activity for malicious behavior using machine learning. A good shorthand: CloudTrail = who did it, CloudWatch = how is it performing, Config = did anything change, GuardDuty = is anything malicious happening.

2.3Task Statement 2.3

AWS Access Management

IAM · Root User Protection · Least Privilege · MFA

2.3

IAM Building Blocks

User

An identity representing a single person or application, with its own credentials.

Group

A collection of users; policies attached to the group apply to every member.

Role

A set of permissions assumed temporarily — by a user, service, or federated identity — without long-term credentials.

Policy

A JSON document defining permissions. Managed policies are reusable and AWS- or customer-created; inline policies are embedded directly in a single user, group, or role.

Principle of Least Privilege: grant only the permissions required to perform a task — nothing more. This is the guiding rule behind every IAM policy design decision on the exam.

IAM users represent individual people or applications and hold their own long-term credentials. Groups are a convenience layer — instead of attaching a policy to ten individual users, you attach it once to a group and add each user as a member. Roles are different from users in an important way: they don't have permanent credentials, and are instead assumed temporarily by a trusted entity, whether that's a human user, an AWS service like EC2 or Lambda, or a federated identity coming from an external identity provider. Policies are the JSON documents that actually define what's allowed — AWS managed policies are maintained by AWS and cover common use cases, customer managed policies are reusable documents you create yourself, and inline policies are directly embedded in one specific user, group, or role rather than being reusable. Every one of these building blocks should be designed around the principle of least privilege: grant exactly the permissions needed for a task, and nothing broader, to limit the blast radius of a compromised credential.

2.3

Root User Protection & Authentication

Protecting the Root User

The root user is created with the AWS account and has unrestricted access. Best practice: enable MFA immediately, avoid daily use, and create an IAM administrator user for routine tasks instead.

Tasks Only the Root User Can Perform

Changing the account's support plan, closing the AWS account, changing the account root user email/password, and a small number of other account-level actions.

Multi-Factor Authentication (MFA)

Requires a second verification factor beyond a password (e.g., a hardware token or authenticator app). Strongly recommended for the root user and privileged IAM users.

IAM Identity Center & Federation

IAM Identity Center (formerly AWS SSO) provides centralized workforce access across multiple AWS accounts and applications. Federated identities let users authenticate with an existing external identity provider instead of creating a separate AWS-only credential.

The root user is the identity created when an AWS account is first set up, and it has complete, unrestricted access to everything in that account — which is exactly why AWS best practice is to lock it down immediately with multi-factor authentication and then largely stop using it day to day, relying instead on an IAM administrator user for routine account management. A small, specific set of actions can only be performed by the root user, not by any IAM user no matter how many permissions they're granted — closing the account, changing the support plan, and modifying the account's root email or password among them; the exam likes to test recognition of this short list. Multi-factor authentication adds a second verification factor on top of a password, such as a one-time code from a hardware token or authenticator app, dramatically reducing the risk from a stolen password alone. AWS IAM Identity Center, previously called AWS Single Sign-On, is the service for centrally managing workforce access across multiple AWS accounts and business applications from one place. Federated identity means letting users log in with credentials they already have from an external identity provider — like a corporate directory or a social login — rather than creating and managing a brand-new AWS-specific username and password.

2.3

Credential & Secrets Management

Tool	Purpose
AWS Secrets Manager	Stores, rotates, and retrieves secrets like database credentials and API keys
AWS Systems Manager Parameter Store	Stores configuration data and secrets as hierarchical key-value pairs
IAM Password Policy	Enforces password complexity, rotation, and reuse rules for IAM users
Access Keys	Long-term credentials (access key ID + secret key) for programmatic API/CLI access — should be rotated regularly and never hard-coded

Exam trigger: "Automatically rotate a database password" → Secrets Manager. "Store a simple config value or parameter" → Systems Manager Parameter Store.

AWS Secrets Manager is purpose-built for sensitive credentials like database passwords and API keys, and its standout feature is automatic rotation — it can periodically generate a new secret value and update the dependent service without manual intervention. AWS Systems Manager Parameter Store is a more general-purpose store for configuration data and secrets as key-value pairs; it's a lighter-weight option often used for values that don't need Secrets Manager's automatic rotation capability. IAM password policies let an administrator enforce rules on IAM user passwords — minimum length, complexity, expiration, and reuse prevention. Access keys are the credential pair used for programmatic access to AWS through the CLI or SDKs rather than the console; because they're long-term credentials, best practice is to rotate them regularly and avoid embedding them directly in application code. The core exam distinction to remember is that Secrets Manager specializes in automatic secret rotation, while Parameter Store is the more general configuration and secrets store.

2.4Task Statement 2.4

Security Components & Resources

Protective Services · AWS Marketplace · Where to Find Security Guidance

2.4

AWS Protective Security Services

AWS WAF

Web application firewall that filters malicious HTTP/HTTPS traffic (e.g., SQL injection, cross-site scripting) before it reaches an application.

AWS Shield

Protects against DDoS attacks. Standard tier is automatic and free; Shield Advanced adds enhanced detection and response for a fee.

AWS Firewall Manager

Centrally configures and manages WAF rules, Shield protections, and security groups across multiple accounts in an organization.

Amazon GuardDuty

Continuous, ML-driven threat detection that monitors for malicious or unauthorized account and network activity.

Exam trigger: "Block SQL injection at the application layer" → WAF. "Protect against a DDoS attack" → Shield. "Manage firewall rules across many accounts centrally" → Firewall Manager.

AWS WAF operates at the application layer, inspecting web requests and blocking common exploits like SQL injection and cross-site scripting before they reach the application. AWS Shield defends against distributed denial-of-service attacks — Shield Standard is automatically included at no extra cost and protects against common, frequently occurring network and transport layer attacks, while Shield Advanced is a paid tier offering more sophisticated detection, mitigation, and direct access to a specialized response team for large or complex attacks. AWS Firewall Manager solves an organizational problem: rather than configuring WAF rules and security groups account by account, Firewall Manager lets a central security team apply and enforce these settings across every account in an AWS Organization at once. Amazon GuardDuty rounds out the group as a continuous, intelligent monitoring service, analyzing account, network, and workload activity for signs of compromise using machine learning and threat intelligence feeds. The exam tends to test which of these four to reach for based on the type of attack or problem described in the scenario.

2.4

Finding Security Resources & Support

Resource	What It Provides
AWS Trusted Advisor	Automated checks across cost, performance, security, and fault tolerance, with actionable recommendations
AWS Knowledge Center	Official Q&A-style articles answering common AWS support questions
AWS Security Bulletins / Security Blog	Announcements on vulnerabilities, patches, and evolving security best practices
AWS Marketplace	Curated third-party software, including security tools, that deploy directly into a customer's AWS environment

Exam trigger: "Get automated recommendations to improve our security posture" → Trusted Advisor. "Find a third-party firewall or antivirus product for AWS" → AWS Marketplace.

AWS Trusted Advisor is an automated advisor that inspects an account across several categories — cost optimization, performance, security, fault tolerance, and service limits — and surfaces specific, actionable recommendations, such as flagging an overly permissive security group or an S3 bucket with public access. The AWS Knowledge Center provides official short-form articles that answer frequently asked support questions, distinct from the more narrative AWS Security Blog and security bulletins, which publish updates on new vulnerabilities, patches, and evolving guidance. AWS Marketplace is where customers can find and deploy third-party software directly into their AWS environment, including security products like firewalls, antivirus, and intrusion detection tools built by outside vendors, rather than only using AWS's own native security services. On the exam, recognize Trusted Advisor as the tool for automated, proactive account recommendations, and Marketplace as the source for third-party (non-AWS-built) software.

Quick Review — Domain 2 Checklist

Can you answer these?

Task 2.1 — Shared Responsibility

Explain "security of" vs. "security in" the cloud
Say how the split shifts across EC2, RDS, and Lambda

Task 2.2 — Security & Compliance

Know AWS Artifact is where compliance reports live
Distinguish encryption at rest vs. in transit
Match CloudWatch, CloudTrail, Config & GuardDuty to their jobs

Task 2.3 — Access Management

Define users, groups, roles & policies
List root-user-only tasks
Secrets Manager vs. Parameter Store

Task 2.4 — Security Components

WAF vs. Shield vs. Firewall Manager
Know Trusted Advisor gives automated recommendations
Know AWS Marketplace hosts third-party security tools

Quick Reference — Concept Map

Shared Responsibility

AWS → of the cloud
Customer → in the cloud
Shifts with service type

Compliance & Monitoring

Artifact → compliance reports
CloudTrail → who did what
CloudWatch → performance/alarms
Config → what changed

Access Management

Users/Groups/Roles/Policies
Least privilege always
Root user → MFA + minimal use
Secrets Manager → auto-rotation

Security Components

WAF → app layer filtering
Shield → DDoS protection
GuardDuty → threat detection
Trusted Advisor → recommendations

Domain 2 Complete

You're Ready for Domain 2

30% of CLF-C02 · Security and Compliance
The highest-weighted domain — review it twice.