CLF-C02 Domain 2 - Security and Compliance
Domain 2 is 30% of the scored AWS Certified Cloud Practitioner (CLF-C02) exam. It tests responsibility boundaries, governance/compliance, identity, and which security service solves which problem.
2.1 Shared responsibility
AWS secures of the cloud: facilities, hardware, networking, and managed-service infrastructure. Customers secure in the cloud: data, identities, permissions, application code, and service configuration. The dividing line shifts by service:
- Amazon EC2: customer patches the guest OS and applications.
- Amazon RDS: AWS patches the managed database platform; customer controls data, accounts, and configuration.
- AWS Lambda: AWS operates servers and runtime infrastructure; customer secures function code, dependencies, data, and permissions.
2.2 Security, governance, and compliance
- AWS Artifact supplies AWS audit reports and agreements. AWS Audit Manager collects evidence about your own AWS usage, but has dropped off the current in-scope list.
- AWS CloudTrail records API activity, Amazon CloudWatch observes metrics/logs and alarms, and AWS Config records resource configuration and evaluates rules.
- Encrypt at rest and in transit. AWS Key Management Service (KMS) provides managed keys; AWS CloudHSM provides single-tenant HSM control; AWS Certificate Manager (ACM) manages TLS certificates for integrated services.
- Compliance is shared: AWS supplies compliant infrastructure and evidence; the customer configures and proves the workload’s compliance.
2.3 Access management
- Protect the root user with MFA, no routine access keys, and use it only for root-only tasks.
- Apply least privilege with AWS Identity and Access Management (IAM) users, groups, roles, and policies.
- Prefer temporary role credentials over long-lived access keys; use AWS IAM Identity Center for workforce access and federation.
- Store secrets in AWS Secrets Manager or Systems Manager Parameter Store, not in code.
- An explicit deny overrides allows; permissions boundaries, service control policies, identity policies, and resource policies limit the final effective permission.
2.4 Service matching
| Need | Service |
|---|---|
| Threat detection from logs and events | Amazon GuardDuty |
| EC2/ECR/Lambda vulnerability management | Amazon Inspector |
| Discover/classify sensitive data in S3 | Amazon Macie |
| Investigate security findings | Amazon Detective |
| Aggregate findings and posture checks | AWS Security Hub CSPM |
| DDoS protection | AWS Shield |
| Filter web requests | AWS WAF |
| Centrally manage WAF/Shield/firewall policies | AWS Firewall Manager |
| Share supported resources across accounts | AWS Resource Access Manager (RAM) |
Common traps
- Macie discovers/classifies sensitive S3 data; it does not anonymize or mask the data.
- GuardDuty detects suspicious activity; Inspector scans supported workloads for vulnerabilities; Detective investigates context after a finding.
- Security groups are stateful and attach to resources; network ACLs are stateless and apply at subnet boundaries.