Unit 6: Security and Compliance

This study guide focuses on implementing security, identity, and compliance at scale within an AWS multi-account environment. It covers the automation of security controls, data protection, and continuous auditing required for the DOP-C02 exam.

Learning Objectives

After studying this unit, you should be able to:

• Implement IAM at scale using AWS IAM Identity Center and Permission Boundaries.
• Design and enforce governance across multiple accounts using Service Control Policies (SCPs).
• Automate security controls using AWS Security Hub, Config, and GuardDuty.
• Apply data protection strategies including automated encryption and secret rotation.
• Configure robust auditing and logging for compliance and incident response.

Key Terms & Glossary

• SCP (Service Control Policy): An organization policy used to manage permissions in your organization, acting as a guardrail to limit the maximum available permissions.
• Permissions Boundary: An advanced feature in which you use a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity.
• ABAC (Attribute-Based Access Control): An authorization strategy that defines permissions based on attributes (tags) of the user and the resource.
• Least Privilege: The practice of granting only the permissions required to perform a specific task.
• Infrastructure Drift: When the actual state of your infrastructure differs from the state defined in your IaC templates.

The "Big Idea"

The core philosophy of Unit 6 is Defense in Depth through Automation. In a DevOps environment, security cannot be a manual gate. It must be integrated into the CI/CD pipeline and the account provisioning process. By using "Policy as Code" and automated remediation, organizations can maintain a high security posture without sacrificing velocity.

Formula / Concept Box

IAM Policy Evaluation Logic

Hierarchical Outline

1. Identity and Access Management at Scale
   • Human Access: AWS IAM Identity Center (SSO), Federation.
   • Machine Access: IAM Roles, instance profiles, and automated rotation.
   • Guardrails: Service Control Policies (SCPs) and Permissions Boundaries.
2. Security Automation and Data Protection
   • Network Security: WAF, Shield, Network Firewall, Security Groups.
   • Data Security: KMS (Key Management), ACM (Certificates), Macie (Discovery).
   • Governance: AWS Control Tower and AWS Organizations for account-level baselining.
3. Monitoring and Auditing
   • Logging: CloudTrail (API calls), VPC Flow Logs (Network traffic).
   • Detection: GuardDuty (Threats), Inspector (Vulnerabilities), Security Hub (Compliance).
   • Remediation: Config Rules + Lambda/Systems Manager for automated fixing.

Visual Anchors

Security Finding Aggregation Flow

Organization Structure with SCPs

Definition-Example Pairs

• Attribute-Based Access Control (ABAC):
  • Definition: Granting access based on metadata tags assigned to users and resources.
  • Example: A developer with the tag Project: Apollo can only start/stop EC2 instances that also have the tag Project: Apollo.
• Automated Remediation:
  • Definition: Using code to automatically fix a security non-compliance issue as soon as it is detected.
  • Example: If an S3 bucket is created without encryption, an AWS Config Rule triggers a Lambda function to enable AES-256 encryption on that bucket immediately.

Worked Examples

Example 1: Enforcing Least Privilege for Developers

Scenario: You need to allow developers to create IAM roles for Lambda but want to prevent them from escalating their own privileges. Solution:

1. Create a Permissions Boundary policy that allows common Lambda actions but excludes IAM administrative actions.
2. Create an IAM Policy for the developers that allows iam:CreateRole, but includes a Condition that requires the PermissionsBoundary to be attached to any new role they create.
3. This ensures that even if a developer creates a role with AdministratorAccess, that role is effectively limited by the boundary.

Example 2: Rotating Secrets for RDS

Scenario: A compliance requirement states RDS passwords must change every 30 days. Solution:

1. Store the database credentials in AWS Secrets Manager.
2. Enable Rotation in the secret settings.
3. Select the appropriate Lambda Rotation Template (provided by AWS for RDS).
4. Secrets Manager will automatically run the Lambda to update the RDS password and the secret value simultaneously.

Checkpoint Questions

1. What is the difference between an SCP and an IAM Policy? (Answer: SCPs set the maximum possible permissions for an account but do not grant access; IAM policies grant specific permissions to users/roles within an account.)
2. Which service would you use to find PII (Personally Identifiable Information) in an S3 bucket? (Answer: Amazon Macie.)
3. True or False: Security Hub automatically fixes all findings. (Answer: False. Security Hub aggregates findings; you must use EventBridge and Lambda/SSM for automated remediation.)
4. In a multi-account setup, where should CloudTrail logs be stored for maximum security? (Answer: In a dedicated, centralized Logging account with restricted access and S3 Object Lock enabled.)

Muddy Points & Cross-Refs

• GuardDuty vs. Inspector: Remember that GuardDuty is an Intrusion Detection System (IDS) monitoring logs for behavioral threats, while Inspector is a vulnerability scanner looking for known software flaws in EC2, ECR, and Lambda.
• Secrets Manager vs. Parameter Store: Secrets Manager is for sensitive data requiring rotation (costs more). Parameter Store (SSM) is for configuration data and simpler secret storage (free/low cost) but lacks native cross-account rotation.
• Config vs. CloudTrail: Config tracks state (what does it look like now?); CloudTrail tracks activity (who did what?).

Comparison Tables

RBAC vs. ABAC

Security Group vs. Network ACL (NACL)