Governance and Security Controls at Scale

This guide covers the implementation and development of automated governance and security controls across multi-account AWS environments, focusing on the toolset required for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam.

Learning Objectives

By the end of this study guide, you should be able to:

• Design and deploy an AWS Control Tower Landing Zone for multi-account governance.
• Implement preventive guardrails using Service Control Policies (SCPs).
• Configure detective controls and automated remediation using AWS Config and AWS Security Hub.
• Analyze and investigate security threats using Amazon GuardDuty and Amazon Detective.
• Standardize infrastructure delivery using AWS Service Catalog portfolios.

Key Terms & Glossary

• Guardrail: High-level rules for ongoing governance of your AWS environment (e.g., "Disallow public S3 buckets").
• Landing Zone: A well-architected, multi-account AWS environment that is a starting point from which you can deploy workloads.
• Finding: A standardized record of a security issue or compliance check generated by services like GuardDuty or Security Hub.
• Drift: When the actual configuration of a resource differs from its expected or defined state (e.g., in CloudFormation).
• Portfolio: A collection of products (IaC templates) in Service Catalog that are managed as a single unit for specific user groups.

The "Big Idea"

In a large-scale enterprise, manual security oversight is impossible. The "Big Idea" is to move from manual gatekeeping to automated guardrails. Instead of reviewing every change, DevOps engineers build a "Governance Pipeline" where security is baked into the account structure (Control Tower/SCPs), monitored in real-time (Config/GuardDuty), and centralized for visibility (Security Hub).

Formula / Concept Box

Hierarchical Outline

• I. Multi-Account Orchestration
  • AWS Control Tower: Automates the setup of a Landing Zone with best-practice blueprints.
  • AWS Organizations: The foundation for consolidated billing and Service Control Policies (SCPs).
• II. Compliance and Configuration Management
  • AWS Config: Records configuration history and evaluates changes against Config Rules.
  • Remediation: Use Systems Manager (SSM) Automation documents or Lambda to fix drift.
• III. Centralized Security Operations
  • AWS Security Hub: Aggregates findings from GuardDuty, Inspector, and Macie into the AWS Security Finding Format (ASFF).
  • Amazon GuardDuty: Intelligent threat detection using VPC Flow Logs, CloudTrail, and DNS Logs.
  • Amazon Detective: Graph-based visualization for root cause analysis of security findings.
• IV. Service Delivery and Standardization
  • AWS Service Catalog: Allows users to self-serve pre-approved CloudFormation stacks.

Visual Anchors

Multi-Account Security Flow

Security Hub Finding Aggregation

Definition-Example Pairs

• Service Control Policy (SCP): A policy used to manage the maximum available permissions for an organization.
  • Example: Applying an SCP that denies the s3:PutBucketPublicAccessBlock action to ensure no user in a member account can make a bucket public.
• AWS Config Managed Rule: Pre-defined rules provided by AWS to evaluate if resources comply with common best practices.
  • Example: The s3-bucket-logging-enabled rule checks if your S3 buckets have logging active; if not, the resource is marked "Non-compliant."
• Amazon Detective Behavior Graph: A visual representation of entities (IPs, Roles, Instances) and their relationships over time.
  • Example: Visualizing which IAM role was used to launch 50 EC2 instances from an unusual IP address during a GuardDuty "Brute Force" alert.

Worked Examples

Problem: Automatically remediating unencrypted S3 Buckets

1. Detection: Create an AWS Config Rule named s3-bucket-server-side-encryption-enabled.
2. Trigger: When a bucket is created without encryption, Config marks it as NON_COMPLIANT.
3. Automation: Configure an SSM Automation Document (AWS-EnableS3BucketEncryption) as the remediation action.
4. Permission: Create an IAM Role that allows SSM to modify S3 settings and pass it to the Config remediation configuration.
5. Result: Within minutes of an insecure bucket creation, the encryption is automatically enabled without human intervention.

Checkpoint Questions

1. What is the primary difference between an SCP and an IAM Policy?
2. Which service would you use to visualize the relationship between a suspicious IP address and multiple failed login attempts across accounts?
3. True or False: AWS Security Hub can automatically fix compliance issues without any other services.
4. How does AWS Control Tower use AWS Config?

▶Click for Answers

1. SCPs set the maximum possible permissions for an account (the boundary), while IAM policies grant specific permissions to users/roles within that boundary.
2. Amazon Detective.
3. False. Security Hub identifies issues; you must use EventBridge and Lambda/SSM for automated remediation.
4. Control Tower deploys Detective Guardrails, which are implemented as AWS Config Rules in the member accounts.

Muddy Points & Cross-Refs

• GuardDuty vs. Inspector: GuardDuty monitors network/account behavior (logs), while Inspector performs vulnerability scans on the host/software (agent-based or agentless).
• SCP Inheritance: Remember that SCPs at the Root level affect all OUs, and OUs affect all accounts within them. A Deny at any level overrides any Allow.
• Detective Data Sources: Detective does not start working the moment you enable it; it needs to ingest logs (CloudTrail, VPC Flow Logs) to build its graph. It has a 2-week lookback period if logs were already available.

Comparison Tables