Governance, Auditing and Compliance on AWS

Domain 2 carries 30% of the CLF-C02 score, and task 2.2 is its governance half: "AWS compliance and governance concepts", "Where to capture and locate logs that are associated with cloud security", "identify where to find AWS compliance information (for example, AWS Artifact)", and "Recognizing services that aid in governance and compliance (for example, monitoring with Amazon CloudWatch; auditing with AWS CloudTrail and AWS Config; reporting with access reports)". That single sentence names almost every tool in this lesson, and it also plants the trap, because monitoring is CloudWatch while auditing is CloudTrail and Config. Students who blur those two verbs lose easy marks on stems that are otherwise pure recall.

In this lesson you will:

• decode the one-sentence stem that tells you which governance tool the exam wants;
• use AWS CloudTrail for who did what: including event history versus trails, organization trails and log-file integrity validation;
• resist the CloudWatch Logs trap (a delivery pipeline for events, not the audit record itself);
• use AWS Config for configuration history, rules, compliance state, conformance packs and aggregators;
• find AWS's SOC / ISO / PCI reports and sign a BAA in AWS Artifact: free and self-service;
• map Trusted Advisor's six check categories to what each support plan actually unlocks;
• apply SCPs correctly: deny-only, an allow at every level, any deny wins, management account untouched;
• place AWS Control Tower guardrails (preventive / detective / proactive) on a landing zone;
• read the compliance program buckets (certification vs law vs alignment) through the shared responsibility model;
• design a tagging strategy that survives an audit and splits the bill;
• separate data residency, data sovereignty and privacy, and answer Region-selection stems;
• triage a security event with CloudWatch vs CloudTrail vs Config vs Trusted Advisor;
• study four real AWS compliance cases, then sit 12 exam-style questions plus interactive checks;
• audit the live exam guide as of October 2026: rebuilt scope lists, the new support-plan names, and console moves that are not examinable.

---

1. One question, one tool

1.1 The stem decoder

Every governance question on this exam is a disguised question about which tool owns which kind of evidence. Read the stem for its verb and its noun: not for the service name a colleague once mentioned.

1.2 The exam guide's own division of labour

AWS words it narrowly, and the narrowness is examinable: monitoring = Amazon CloudWatch, auditing = AWS CloudTrail and AWS Config, and (task 2.4) identifying security issues = AWS Trusted Advisor. So an option that says "use CloudWatch to identify security issues" is not a nuance; it is the wrong verb. CloudWatch tells you the system is misbehaving now; CloudTrail tells you what was called; Config tells you what the resource looked like; Trusted Advisor tells you where the gap against best practice is.

---

2. AWS CloudTrail: who did what

2.1 What CloudTrail records

AWS's definition is the whole service in one line: "Actions taken by a user, role, or an AWS service are recorded as events". Those events are captured whether the call came from the console, the CLI, an SDK/API, or another AWS service, and AWS names the purpose directly: "operational and risk auditing, governance, and compliance".

• 📚 Did you know? CloudTrail Event history is free and automatic: AWS describes it as a "viewable, searchable, downloadable, and immutable record of the past 90 days of management events in an AWS Region". You do not create it, you cannot turn it off, and it is per Region and management-events only; which is exactly why it is not a substitute for a trail (as of Oct 2026).

2.2 Event history is not a trail

(Charges as of Oct 2026; verify current before use.)

The stem that gives this away is a retention stem: "retain API logs for five years across all accounts" or "deliver ongoing management events to a bucket": both require a trail (or CloudTrail Lake), because Event history stops at 90 days, management events only, in one Region.

2.3 Organization trails: one log for every account

An organization trail writes "the management account and all member accounts" to one S3 bucket, one CloudWatch Logs group and one EventBridge destination. The rules around it are classic exam material:

• only the management account or a delegated administrator can create it;

• CloudTrail creates the service-linked role AWSServiceRoleForCloudTrail in each member account;

• member accounts can see the trail but cannot modify or delete it; that is the governance point: a compromised member admin cannot silence the audit log;

• the bucket policy should admit only that service role and the organization ID.

• 📚 Did you know? CloudTrail's log-file integrity validation uses "SHA-256 for hashing and SHA-256 with RSA for digital signing" and writes an hourly digest file that chains to the previous digest, making it "computationally infeasible to modify, delete or forge CloudTrail log files without detection". AWS says the feature is enabled by default for new trails, so "prove the log was not edited" is answered by validation, not by a bucket policy (as of Oct 2026).

2.4 Example E1: the CloudTrail bill

A month of activity: 5,000,000 management events (one copy to S3), 15,000,000 data events, 5,000,000 network activity events, plus a second copy of 2,500,000 management events forwarded to a second bucket for the SIEM.

The teaching point is not the arithmetic, it is the free first copy: "You can deliver one copy of your ongoing management events to your S3 bucket at no charge." Data events are never free, and Insights is off by default and charged separately (all rates as of Oct 2026; verify current before use).

2.5 Example E2: one trail for 40 accounts

A governance lead must prove "we log all account activity" for 40 member accounts. The documented pattern:

1. The management account creates a multi-Region organization trail.
2. One S3 bucket receives everything, with a folder per member account ID; one CloudWatch Logs group; optional EventBridge routing for automation.
3. Log-file validation stays on, and the bucket policy admits only AWSServiceRoleForCloudTrail plus the organization ID.
4. Member admins can see the trail, cannot stop or edit it.
5. Athena over the bucket (or a lookup-events query) answers "every API call that deleted an S3 bucket last quarter, with principal and source IP."

Result: uniform logging, one evidence source for the auditor, and no per-account configuration drift: the exact pattern the exam wants you to prefer over 40 hand-built trails.

2.6 The CloudWatch Logs trap

3. AWS Config: configuration history and compliance state

3.1 The recorder and configuration items

AWS Config gives "a detailed view of the configuration of AWS resources" including "how they were configured in the past". Mechanically: you choose which resource types to record, the recorder writes configuration items (CIs) to Amazon S3 and notifies through Amazon SNS (the recorder assumes an IAM role to do it), and you get current state plus change history: a snapshot series, not an event stream.

3.2 Rules, compliance state and remediation

A Config rule encodes "your ideal configuration settings". The rule engine evaluates your resources and stamps each one compliant or non-compliant, flags the resource, notifies you, and can remediate through an AWS Systems Manager document.

Two higher-level objects sit on top, and the exam distinguishes them sharply:

• Conformance pack = "a collection of AWS Config rules and remediation actions … deployed as a single entity": written in YAML, deployable across an organization;
• Aggregator = one cross-account, cross-Region view of configuration and compliance;
• Advanced query = query configuration history by schema across the aggregator.

3.3 Example E3: continuous versus periodic recording

An account records 100 EC2 instances that each change 10 times per day.

Continuous recording costs 2.5x more here but gives you hour-level history; periodic costs less and silently drops the intra-day detail. Choose by the question: "when did it change?" means continuous; "is it compliant now?" makes periodic defensible (rates as of Oct 2026; verify current before use).

3.4 Example E4: pricing a conformance bundle

AWS's own worked bundle: 10,000 configuration items + 50,000 rule evaluations + 15,000 conformance-pack evaluations per month.

Note where the money goes: evaluation, not storage. Adding rules is cheap; recording everything continuously is what moves the bill (as of Oct 2026; verify current before use).

3.5 CloudTrail records actions; Config records state

This is the single highest-yield distinction in the lesson:

Enable both. An examiner who writes "the security group was open for six hours" is testing whether you know that no event log, on any cloud, can reconstruct a duration without a configuration history.

• 📚 Did you know? Some Trusted Advisor checks are powered by AWS Config, which is why turning Config off can quietly degrade the advice you receive, and why conformance packs (rules plus remediation as one YAML artifact) are the fastest way to hand an auditor a repeatable, organization-wide compliance statement instead of a screenshot (as of Oct 2026).

---

4. AWS Artifact: where AWS's own compliance information lives

4.1 Reports, on demand and free

AWS Artifact is "on-demand downloads of AWS security and compliance documents": ISO, Payment Card Industry (PCI) and System and Organization Controls (SOC) reports, certifications issued by accreditation bodies, and Marketplace/ISV documents. It is free of charge, self-service, and it is the exam's literal answer to task 2.2's skill: "identify where to find AWS compliance information (for example, AWS Artifact)".

4.2 Agreements: the BAA and the NDA

Artifact is also where you "review, accept, and track the status of your agreements with AWS for your AWS account and for multiple AWS accounts in your organization". The compliance FAQ names the Business Associate Agreement (BAA) and the NDA. So the stem "sign a BAA for my account and 20 member accounts" has one answer: AWS Artifact.

• 📚 Did you know? SOC 3 is public, you do not need an account-specific request to read it, while AWS publishes SOC 1 quarterly and SOC 2 and SOC 3 every six months over 12-month periods (since 30 September 2023), with new reports ready "in ~6 weeks". All of them arrive through AWS Artifact, and none of them is a HIPAA certificate, because one does not exist (as of Oct 2026).

---

5. AWS Trusted Advisor: best-practice checks and what your plan unlocks

5.1 The six check categories

Trusted Advisor recommendations exist "to save money, improve system availability and performance, or help close security gaps". The category list is fixed at six: reject any option that invents a seventh:

AWS's marketing pages sometimes say "resilience" where the documentation says "fault tolerance": same category, and "compliance" is not one of the six.

5.2 Availability by support plan

As of Oct 2026 AWS advertises 56 checks free to all plans and 482 in total once Business or higher adds 426 more, but on exam day quote the qualitative rule (free plans get a subset, paid plans get all), because check counts change (verify current before use).

5.3 Example E5: what each plan unlocks

Trusted Advisor is advisory. Enforcement comes from Config rules and remediation, SCPs (preventive) and Control Tower guardrails, and Organizational view aggregates the advice across the whole organization.

6. AWS Organizations and SCPs: the deny-only ceiling

6.1 Structure and feature sets

AWS Organizations gives you one root → organizational units (OUs), which nest and may go five levels deep → member accounts. The management account is the payer and the "ultimate owner … final control over security, infrastructure, and finance policies"; a member account "can belong to only one organization at a time".

6.2 SCPs never grant

AWS's wording is absolute, and exam options routinely invert it:

• SCPs give "central control over the maximum available permissions for the IAM users and IAM roles in your organization";
• "SCPs do not grant permissions … No permissions are granted by an SCP";
• effective permissions are the logical intersection of the SCP with identity-based and resource-based policies;
• "SCPs don't affect users or roles in the management account", only member accounts, including their root user, and they do not affect service-linked roles.

6.3 How the evaluation actually runs

Two rules fall out of that picture: an Allow must exist at every level (root → OU → account), so the AWS-managed FullAWSAccess SCP is the deny-by-default safety net, never remove it without replacing it with an allow policy, and a Deny at any level wins, which is why a deny-only policy is all you need to block a Region or a service.

6.4 Example E6: a deny-by-default SCP

The root keeps FullAWSAccess. The Prod OU adds a policy that denies ec2:* and rds:* outside eu-central-1, and denies iam:CreateUser and iam:CreateAccessKey everywhere.

That last line is a favourite distractor: SCPs have no effect on the management account's users and roles.

6.5 Example E7: consolidated billing pools usage

"AWS treats all the accounts in the organization as one account", so combined usage reaches volume tiers, Reserved Instance discounts and Savings Plans faster, and the discount is allocated back. Two accounts pulling 8 TB and 4 TB:

AWS Organizations is offered at no additional charge, and consolidated billing carries no extra fee, but note the catch the exam tests: the bill does not mirror the OU tree. Splitting spend by project is a cost allocation tag job, not an OU job (prices as of Oct 2026; verify current before use).

6.6 Limits worth memorising (verify current before use)

---

7. AWS Control Tower: guardrails on a landing zone

7.1 What it builds

Control Tower governs an AWS multi-account environment, orchestrating AWS Organizations, AWS Service Catalog and AWS IAM Identity Center to build a landing zone "in less than an hour". Its vocabulary is deliberately plain: a control = guardrail = "a high-level rule … expressed in plain language", with guidance graded mandatory / strongly recommended / elective, plus Account Factory for vending accounts and a Dashboard that shows drift by account and OU.

7.2 The three kinds of guardrail

7.3 Data-residency guardrails

In November 2021 AWS announced 17 new guardrails so that "customer data … is not stored or processed outside a specific AWS Region or Regions": preventive examples include "Disallow internet access for an Amazon VPC instance" and "Disallow Amazon Virtual Private Network (VPN) connections". Each preventive control's artifact is an SCP, which is why Control Tower, Organizations and SCPs are always taught together.

• 📚 Did you know? The division of labour is worth memorising as three sentences: AWS Organizations is the account and policy plumbing, the SCP is the permission ceiling, and AWS Control Tower is the opinionated landing-zone layer on top that vends guardrailed accounts and reports drift. AWS also states that "Mandatory controls are always applied, and they can't be changed." (as of Oct 2026)

---

8. Compliance programs and the shared responsibility model

8.1 The three buckets

AWS states that it "supports 143 security standards and compliance certifications, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-3, and NIST 800-171", and it sorts them into three very different buckets (as of Oct 2026; verify current before use):

8.2 The three questions students get wrong

8.3 Shared responsibility, restated for auditors

The audit line is the same one from lesson 5: AWS is audited for security of the cloud, customers for security in it. Three consequences appear repeatedly as options:

• inheriting AWS's controls never removes your half of the model;

• compliance varies by service: check the AWS Services in Scope list rather than assuming a whole-Region blanket;

• "AWS Compliance Center" is not a keyed answer for task 2.2; the skill statement itself names AWS Artifact.

• 📚 Did you know? The AWS compliance site publishes research spanning over 60 countries, and its programs page splits certifications from laws for a reason: a cloud service provider cannot be "HIPAA certified", because no such certification exists to distribute; which is why the exam's correct HIPAA answer is always the trio BAA via Artifact + HIPAA-eligible services + customer responsibility (as of Oct 2026).

9. Tagging strategy as governance

9.1 What a tag is and why governance cares

A tag is "a simple label consisting of a key and an optional value", and keys and values are case sensitive. AWS's own list of reasons is the exam answer: consistent tagging lets you "filter and search for resources, monitor cost and usage, and manage your AWS environment". In practice a clean tag taxonomy is the cloud's CMDB: the index an auditor queries instead of a spreadsheet.

9.2 The four-layer stack

---

10. Data sovereignty and residency

10.1 Three words, three meanings

For CLF-C02 the examinable angle is a Region-selection reason: AWS notes that customers "retain complete control over which AWS Region(s) your data is physically stored in", and opt-in Regions must be enabled explicitly before anything runs there.

10.2 The residency control stack

AWS's data-protection material states plainly that "you control your data … to determine where your data is stored, how it is secured" and that "AWS Control Tower provides governance and controls for data residency"; while customers "retain complete control over which AWS Region(s) your data is physically stored in".

• 📚 Did you know? Date-stamp your infrastructure numbers or they rot: the AWS Cloud spans 39 Geographic Regions and 124 Availability Zones, with 7 more AZs and 2 more Regions (Kingdom of Saudi Arabia and Chile) announced but not yet open, while the AWS European Sovereign Cloud Region eusc-de-east-1 was announced generally available on 14 January 2026 yet does not appear on the public Region map. Quote the 39 / 124 figure and the eusc date separately, and label both "as of Oct 2026, verify current before use".

---

11. Security-event identification: which tool answers which question

11.1 The triage table

11.2 Example E8: the auditor's four questions

None of the four requires a new purchase; all four require foresight: the trail, the recorder and the tag scheme must exist before the auditor arrives.

11.3 Check your vocabulary

11.4 Evidence request → tool and feature

The same triage, run backwards: the auditor states the evidence, you name the tool and the exact feature that produces it. This is the shape stems take when they hide the service name behind a requirement.

---

12. The live exam guide: what changed by 2026

2026 Updates (as of October 2026)

The exam tests the guide you download today, not the PDF somebody revised from in 2023. Every item below was checked against AWS's own pages in October 2026, and each one changes how you should read a governance, support or scope stem.

• The service lists were rebuilt, and scope is now examinable in its own right. In-scope entries fell from 128 in the launch-era Version 1.0 CLF-C02 guide to 111 across 19 categories (official in-scope list, checked 2026-10), while the out-of-scope list grew from 11 entries at launch to more than 50. For this lesson: AWS Network Firewall is explicitly out of scope (it is athenahealth's story detail, never a keyed answer), AWS Audit Manager and AWS Resource Groups and Tag Editor appear on neither list, dropped from in-scope, so treat them as distractors, exactly as §1.2 warns, and Service Quotas is a newly listed Management and Governance service sitting beside CloudTrail, CloudWatch, AWS Config, Control Tower, Organizations and Trusted Advisor.

• ⚠️ Scope correction (supersedes any earlier statement): AWS Outposts is on the current in-scope list under Compute (checked 2026-10), so ignore any material that calls it out of scope; AWS Local Zones appears on neither list and AWS Wavelength is explicitly out of scope. All three are non-answers in a governance stem anyway: key CloudTrail, AWS Config, AWS Artifact, Trusted Advisor, Organizations/SCP, Control Tower, CloudWatch or Security Hub.

• Domain 4's support task was rewritten after the December 2025 support overhaul. The current guide reads "Identifying AWS Support options for AWS customers (for example, customer service and communities, Basic Support, AWS Business Support+, AWS Enterprise Support, AWS Unified Operations)": the older "AWS Developer Support … AWS Enterprise On-Ramp Support" wording is gone. Developer, classic Business and Enterprise On-Ramp stopped taking new subscriptions after 2 December 2025 (existing ones run through 1 January 2027) and Basic stays free (AWS News Blog, 2 December 2025). The Trusted Advisor rule from §5 is untouched: free plans get a subset of checks, Business or higher gets them all.

• The console keeps moving even when the guide does not. Cost Optimization Hub (AWS News Blog, 26 November 2023) gathers every recommended saving action in one place; Target Coverage arrived in the Savings Plans Purchase Analyzer (9 June 2026); RI/SP group sharing went generally available (19 November 2025). None of those names sits on either scope list (checked 2026-10), and the guide's cost task still names only AWS Budgets and AWS Cost Explorer, so an option offering the Cost Optimization Hub for a governance or audit stem is a distractor, not the answer.

• Well-Architected Agent is real, and still not examinable by name. AWS announced it in preview on 1 October 2026 and describes it as "the next-gen evolution of AWS Trusted Advisor and the AWS Well-Architected Tool", yet the in-scope list still says AWS Trusted Advisor and AWS Well-Architected Tool. Key the guide's names, not the headline.

• Two renames to memorise. The category Customer Engagement is now Customer Enablement, which contains AWS Support only (AWS Activate, AWS IQ and AWS Managed Services moved to the out-of-scope list), and the guide writes AWS IAM Identity Center with no "(AWS Single Sign-On)" parenthetical (official scope lists, checked 2026-10).

• 📚 Did you know? The exam guide is a moving document with no version number: the current PDF prints only "Copyright © 2026", the only stamped artefact is the launch-era "Version 1.0 CLF-C02" guide, and that guide's Appendix B, the CLF-C01 dates and the old 26 / 25 / 33 / 16 weightings, has been deleted from the live document. The docs landing page's uiVersion=2024.10 is the AWS Docs UI template version, not a guide revision date, and the weightings themselves have not moved at all: 24 / 30 / 34 / 12 as of Oct 2026.

Reading rule: the official in-scope and out-of-scope lists are the arbiter. A service that is absent from the in-scope list may appear inside a case study as story detail, but it can never be the keyed answer, and any claim that the guide carries a version number, or that a weighting silently shifted, is unverifiable and must not be taught as fact.

---

Real-World Case Studies

Four AWS-published stories show what governance looks like when it is designed rather than bolted on. Every figure below is customer- or AWS-claimed and unaudited: the examinable point is the pattern (which governance lever was pulled, which services did the work), never the marketing number.

Case A, athenahealth: governance as code across 120 accounts

Challenge. A healthcare-software company (HIPAA-sensitive workloads) needed egress monitoring across a sprawling VPC estate while inspection costs climbed and the security team stayed small.

Services. AWS Network Firewall deployed centrally, AWS Transit Gateway, AWS RAM to fan policy out to member accounts, CloudFormation rules-as-code, AWS Direct Connect, with AWS Shield on the roadmap.

Outcome (customer-claimed). Inspection costs −95%; hundreds of VPCs across 120 accounts stood up "in just a few days"; eight people designed and rolled out the new security design "with no disruptions"; firewall logs centralized.

Domain mapping. Domain 2: defence in depth, governance through infrastructure-as-code and consistent policy reuse instead of 120 hand-configured accounts. The governance lesson: the control was expressed once, then shared (AWS RAM) and codified (CloudFormation), so the audit evidence is the template.

Case B, Smartsheet Gov: FedRAMP-ready in under 90 days

Challenge. A public-sector SaaS vendor with no presence in AWS GovCloud (US) needed a US-government-grade authorization; AWS describes the typical timeframe for that journey as 12 to 18 months.

Services. AWS GovCloud (US) plus ATO on AWS: AWS publishes the underlying program material and inherited controls, the customer builds on top.

Outcome (AWS-published, 29 August 2019). From no GovCloud presence to FedRAMP ready in less than 90 days, versus typical timeframes "as long as 12-18 months": roughly a 4 to 6x compression.

Domain mapping. Domain 2: compliance programs and shared responsibility. The examinable distinction: FedRAMP is a government authorization, not an AWS product; AWS supplies the Region and the inherited controls, and the customer obtains the authorization. Inheriting controls shortens the work but does not transfer responsibility.

Case C, Avalon Healthcare Solutions: 700+ audit controls without a VPN

Challenge. A healthcare lab-insights company handling PHI and audited against more than 700 controls needed browser access to reports and patient data without VPN sprawl across its staff.

Services. AWS Verified Access for identity-based, browser-only access (OpenID Connect federation through Okta), sitting behind a firewall: no VPN endpoint anywhere in the design.

Outcome (AWS-published). Perimeter network setup compressed from days to about an hour; 50 business users onboarded by February 2024; the 700+ controls continued to be met; AWS also reports far fewer attempted breaches after the change.

Domain mapping. Domain 2, identity-based access, Zero Trust and the shared responsibility model. The governance lesson is that a fixed control set is satisfied by changing who can reach what, not by lowering the bar: the audit surface shrank while the controls stayed at 700+. Note the exam angle: AWS Verified Access appears on neither the in-scope nor the out-of-scope list (checked 2026-10), so it is story detail only, a keyed answer for access questions still comes from IAM, IAM Identity Center or AWS WAF.

Case D, Socure: inheriting controls, not responsibility

Challenge. A fraud-identity vendor building a FedRAMP-compliant environment for government customers on AWS GovCloud (US), where AWS describes the authorization journey as taking as long as 12 to 18 months (the typical timeframe quoted in the Smartsheet story above).

Services. AWS GovCloud (US) plus complementary tooling: the point of the story is what AWS already carries before the customer writes a single control statement.

Outcome (AWS Public Sector Blog, 14 November 2024, customer-claimed). Socure states that it "inherited over 46 FedRAMP-required security controls from AWS GovCloud": more than 46 controls arrived already satisfied by the underlying cloud.

Domain mapping. Domain 2: shared responsibility, put in numbers. Inheritance shrinks your control matrix, but the authorization stays yours and so do configuration, identity and application security. Two exam traps to file here: never read "46 inherited" as "46 total" (FedRAMP's control set is far larger), and remember from Case B that FedRAMP is a government authorization, not an AWS product you can buy.

---

Practice Questions

---