Security, governance, and compliance concepts

AWS gives you compliance reports, encryption options, and services to monitor, audit, and protect resources. Know where to find compliance documents and which service answers which governance question.

Compliance information

• AWS Artifact: Self-service portal for AWS compliance reports (for example, SOC and PCI reports, ISO certifications) and agreements such as a Business Associate Addendum (BAA).
• AWS Compliance programs: AWS is assessed against many global, regional, and industry standards (for example, PCI DSS for payments, HIPAA for US health data, GDPR in the EU). The AWS Compliance website lists them.
• Compliance varies by service and by Region: check the 'services in scope' list for a program before you rely on a service for that workload.
• Using a compliant AWS service does not make your application compliant automatically; you still configure and operate it correctly.

Compliance across geographies and industries

• Requirements depend on where you operate and what you do: data protection laws by country or region, and industry rules for payments, health care, finance, and government.
• You choose the Region where data is stored, which supports data residency requirements. AWS doesn't move your content out of the Region you choose unless you do.
• AWS GovCloud (US) Regions are isolated Regions for US government agencies and customers with strict regulatory requirements.
• Benefits of cloud security: you inherit AWS's audited physical and infrastructure controls, get encryption and logging features built in, and can automate security checks at scale.

Encryption

• Encryption in transit: Protects data moving over a network, typically with TLS (HTTPS). AWS Certificate Manager (ACM) issues and renews TLS certificates.
• Encryption at rest: Protects stored data (S3, EBS, RDS, DynamoDB, and others), usually with keys from AWS Key Management Service (AWS KMS).
• AWS KMS: Create and control encryption keys, integrated with most AWS services, with key usage logged in CloudTrail.
• AWS CloudHSM: Dedicated, single-tenant hardware security modules when you must control the HSM yourself.

Securing resources

• Amazon GuardDuty: Intelligent threat detection that analyzes logs such as CloudTrail events, VPC Flow Logs, and DNS logs for malicious activity.
• Amazon Inspector: Automated vulnerability management: scans EC2 instances, container images in Amazon ECR, and Lambda functions for software vulnerabilities and unintended network exposure.
• AWS Security Hub: Central view of security findings from many services plus automated checks against security best practices.
• AWS Shield: DDoS protection. Shield Standard is automatic and free; Shield Advanced is paid and adds enhanced detection and mitigation, DDoS cost protection, and access to the Shield Response Team (SRT).
• Amazon Macie: Uses machine learning to discover sensitive data, such as personally identifiable information (PII), in Amazon S3.
• Amazon Detective: Helps investigate the root cause of security findings by analyzing and visualizing related activity.

Governance, monitoring, and auditing

• Amazon CloudWatch (monitoring): Metrics, logs, dashboards, and alarms for resources and applications.
• AWS CloudTrail (auditing API activity): Records who did what, when, and from where: API calls and console actions in your account.
• AWS Config (auditing configuration): Records resource configuration over time and evaluates it against rules (for example, 'all S3 buckets must block public access').
• Access reports: IAM credential reports (status of every user's passwords, access keys, MFA) and access advisor/last-accessed data help find unused permissions.
• Where security logs live: CloudTrail logs (delivered to S3 and optionally CloudWatch Logs), CloudWatch Logs, VPC Flow Logs, and service logs such as S3 server access logs and load balancer access logs.