SCS-C03 cheat sheet — every exam topic on one page

Detection

Designing Security Monitoring and Alerting Across an AWS Organization

• Security Hub CSPM with a delegated administrator and cross-Region aggregation gives one view of findings: member findings reach the administrator account and linked-Region findings reach the home Region.
• Central configuration lets the delegated administrator, from the home Region, apply policies to the root, OUs or accounts. Children inherit from the nearest parent, and a self-managed OU passes self-management to everything under it.
• GuardDuty delegated administration and auto-enable are per Region. Use ALL to cover existing and new accounts; NEW covers only accounts that join later.
• GuardDuty reads its foundational sources directly, so turning off flow logs or Resolver logging does not blind it. Protection plans each watch one thing: S3 access, S3 uploads, EKS audit logs, runtime processes, Lambda network activity, EBS malware or database logins.
• Macie automated discovery samples every bucket cheaply; jobs analyze chosen buckets in full. Sensitive data findings reach Security Hub CSPM only after you change publication settings, in the Macie administrator account for automated discovery.
• Match the need to the service: GuardDuty finds threats, Inspector finds vulnerabilities, Macie finds sensitive data in S3, Config evaluates configuration, Detective investigates, and Security Hub CSPM aggregates findings and scores posture.
• Security Lake stores and normalizes security data in OCSF for analytics, hunting, retention and SIEM subscribers; it never generates findings or alerts.
• Imported events fire on every finding update, so paging rules should match workflow status NEW and record state ACTIVE as well as severity.
• Use Route 53 endpoint checks for outside-in health and alarm-based health checks for private resources. Use metric filters with per-principal dimensions plus anomaly detection alarms for cyclical rates, and fixed thresholds when the limit must be explainable.
• Assessment maps by layer: conformance packs for resource configuration (StackSets for OU scope), Security Hub CSPM standards for benchmark posture, and State Manager for in-instance state, surfaced in Config through the association-compliance managed rule.

Designing Security Logging Solutions: CloudTrail, Flow Logs, Central Archives

• An organization trail from the management account logs every member automatically, and member accounts cannot modify, stop, or delete it — the answer to tamper-resistant org-wide logging.
• Management events record the control plane and are on by default; data events (S3 objects, Lambda invokes) are high-volume, off by default, scoped with event selectors — and never appear in the 90-day event history.
• CloudTrail log file integrity validation — hourly SHA-256 digest files, signed by CloudTrail and chained — proves logs were not modified or deleted; rewriting a digest breaks its signature.
• VPC Flow Logs capture metadata only; pkt-srcaddr/pkt-dstaddr recover real addresses through a NAT gateway, transit gateway flow logs cover inter-VPC traffic, and payload capture needs Traffic Mirroring.
• Resolver query logging records only queries the Route 53 Resolver handles; custom DNS servers bypass it.
• Protect the archive with source-conditioned delivery policies, SSE-KMS (GenerateDataKey for the service, Decrypt for readers), deny-delete statements, an SCP that binds the archive account’s root user, and Object Lock compliance mode.
• EventBridge reacts to single events; counting events over a window needs a metric filter plus an alarm. Subscription filters (cross-account via a CloudWatch Logs destination) stream logs onward.
• Security Lake normalizes native and custom sources to OCSF Parquet; data access subscribers ingest copies, query access subscribers query in place.
• Normalize with Lambda transforms, search and correlate in OpenSearch Service, visualize across stores with Managed Grafana; analyze history with Athena, recent log groups with Logs Insights, and triage with Security Hub findings.
• Set explicit retention everywhere: CloudWatch Logs groups default to never expiring, so keep the durable copy in S3 under lifecycle rules and give each log group a retention period.

Troubleshooting Security Monitoring, Logging, and Alerting on AWS

• Triage every broken pipeline in order — source, delivery, destination permissions, consumer — because downstream stages fail silently with no error anywhere.
• IsLogging true does not mean delivery works: read LatestDeliveryError for S3 files (and the digest, notification and CloudWatch Logs error fields for their paths), then the bucket policy and KMS key policy for cloudtrail.amazonaws.com. CloudTrail retries failed deliveries for up to 30 days.
• An organization trail's aws:SourceArn and aws:SourceAccount must name the management account's trail; member logs sit under AWSLogs/<org ID>/<account ID>/ and are not readable by member accounts until the bucket policy shares each account's prefix.
• CloudTrail records management events by default; S3 object-level and Lambda invoke data events only exist if event selectors enabled them — check selectors before suspecting tampering.
• Lambda logs through its execution role and filters by application and system log level; API Gateway REST logging needs a per-Region CloudWatch role ARN in account settings, and access logging (not execution logging) gives a per-request audit line.
• Legacy CloudFront logging needs bucket ACLs while v2 uses a delivery.logs.amazonaws.com bucket policy; real-time logs reach Kinesis in seconds. Route 53 health checkers come from the internet — allow the route53-healthchecks prefix list, and use alarm-based checks for private endpoints.
• A CloudWatch agent only picks up an edited config after fetch-config; it needs the instance role and, in private subnets, both the monitoring and logs interface endpoints.
• GuardDuty is enabled per Region per account (new members only with auto-enable); suppression rules archive findings, trusted IP lists prevent them, and S3 Protection (access anomalies) is not Malware Protection for S3 (upload scanning).
• GuardDuty and Security Hub CSPM events emit in the finding's Region; patterns are exact; MatchedEvents with FailedInvocations means the target's resource policy refused EventBridge.
• A KMS-encrypted SNS topic needs a customer managed key granting the publishing service. Stale compliance data means a stopped Config recorder or a broken delivery channel before anything else, and Config delivery to an SSE-KMS bucket needs config.amazonaws.com in the key policy.
• Security Hub CSPM controls on a resource type that AWS Config does not record show Unknown (WARNING findings) and Config.1 fails; No data means no findings at all, and Disabled means not evaluated.
• Metric filters are case-sensitive and never retroactive; alarms fail on the wrong statistic, period or missing-data treatment; subscriptions deliver nothing until confirmed.

Incident Response

Design and Test an AWS Incident Response Plan (SCS-C03)

• Pre-provision a scoped IR role in every account, protect it with an SCP, and remember a chained AssumeRole above one hour fails.
• Break-glass must not depend on the failed identity provider: hardware-MFA IAM users in the security account, credentials out of band, an alarm on every sign-in, and SCP exceptions that name the role ARN.
• Set the security alternate contact on every account centrally and at creation — AWS sends abuse and security notices there as well as to the root email.
• Deactivate an exposed key first because it is reversible; revoke role sessions with an aws:TokenIssueTime DateLessThan deny — trust-policy edits and shorter session limits do not touch live sessions, and the deny does not stop long-term keys.
• Keep evidence in a separate forensics account (not Log Archive or management); capture memory through Systems Manager before isolating (the disk snapshot flow runs in parallel), and share snapshots under a customer managed key.
• Shield Advanced readiness: protections, a Route 53 health check per protected resource, SRT access role, and Business or Enterprise Support for SRT help.
• Remediation: EventBridge (per Region) to Automation or Lambda, cross-account by assuming a role; auto-run only reversible, evidence-preserving steps and gate the rest with aws:approve or a Step Functions task token.
• Test with the right rung: tabletops for decisions, sample findings for pipelines, FIS with stop conditions for real faults; Resilience Hub estimates, FIS proves.

Responding to AWS Security Events: Compromised EC2, Credentials, and S3

• Validate first, then contain, preserve, eradicate and recover — in that order; suppress a proven-benign finding only for the validated resource.
• Tracked connections survive security-group changes; untracked flows (all-addresses rule plus all-ports return rule) drop at once. A narrow network ACL deny or the two-step security group swap cuts a live session; idle timeouts never do.
• Take a compromised instance out of Auto Scaling control with detach or Standby (both deregister it from target groups); scale-in protection and suspending ReplaceUnhealthy are not substitutes.
• Snapshot EBS volumes and capture memory on the running instance; hibernation must be enabled at launch, CreateImage reboots by default, and instance store data must be copied before any stop.
• Reserved concurrency 0 stops a Lambda function; a deny-all network policy on one labelled pod plus cordon (not drain) contains an EKS pod.
• An aws:TokenIssueTime deny ends temporary sessions, including ones minted from a leaked key, but never long-term keys; AWSCompromisedKeyQuarantineV3 denies only listed actions.
• Block Public Access applies the most restrictive setting but ignores non-public cross-account grants; CloudTrail data events log anonymous reads only where enabled, server access logs cover the whole bucket.
• Evidence lives in the forensics account under Object Lock (compliance never shortens; legal holds have no expiry) with CloudTrail digest files proving logs unchanged; Detective adds history only from the day it is enabled.

Infrastructure Security

Edge Security on AWS: WAF, Shield, and CloudFront as Controls

• Match the control to the layer: Shield for L3/4 floods, WAF rate-based rules and the Anti-DDoS managed rule group for L7 floods, managed rule groups for exploits, Bot Control for automation — and put CloudFront in front of anything WAF cannot attach to.
• Web ACLs attach to CloudFront and Amplify (global scope, us-east-1) and to Regional ALBs, API Gateway REST APIs, AppSync, Cognito, App Runner and Verified Access — never to NLBs, EC2 or HTTP APIs.
• Rules run in ascending priority and the first terminating action ends evaluation; Count is non-terminating but still adds labels, which only later rules can match.
• Pick managed groups by stack: the Core rule set has no SQL injection rules (add SQL database), Log4j patterns are in Known bad inputs, and OS and application groups follow the servers and frameworks.
• On a CloudFront web ACL the source IP is the viewer; key rate-based rules on a forwarded IP only behind a trusted proxy, and use scope-downs and custom keys such as JA3/JA4 for distributed or IP-rotating floods.
• Count is the safe evaluation mode; triage false positives from WAF logs (terminatingRuleId, plus ruleGroupList for rules inside a group) and override the one rule to Count.
• Shield Advanced covers only resources added as protections (NLBs through their Elastic IPs); SRT and proactive engagement need Business or Enterprise Support; Firewall Manager with auto remediation protects new resources org-wide; L7 auto-mitigation is now legacy.
• Lock origins with OAC plus an AWS:SourceArn condition for S3, VPC origins for private ALB/NLB/EC2, or the origin-facing prefix list plus a listener-verified secret header for internet-facing ALBs.
• Response headers policies add security headers for viewers (origin override decides who wins); S3 CORS is browser-enforced, not access control, and needs Origin in the CloudFront cache key.
• IoT policies use client/ for Connect, topic/ for Publish and Receive, topicfilter/ for Subscribe, scoped by ${iot:Connection.Thing.ThingName}; WAFv2 logs are a native Security Lake source, third-party data must already be OCSF Parquet.

Securing Compute Workloads: EC2, Containers, and Lambda

• IMDSv2 defeats SSRF credential theft; a hop limit of 1 keeps bridged containers out only when HttpTokens is required. Launch parameters beat account defaults, which beat the AMI setting, so only an ec2:MetadataHttpTokens deny or account-level IMDSv2 enforcement makes an IMDSv1 launch fail.
• Instance profiles store nothing on the host; GetSessionToken and IAM Roles Anywhere both depend on a stored secret. Pin role credentials with aws:Ec2InstanceSourceVpc compared to ${aws:SourceVpc}, scoped to ec2:SourceInstanceARN and excluding aws:ViaAWSService.
• Image Builder rebuilds only on new dependencies with EXPRESSION_MATCH_AND_DEPENDENCY_UPDATES_AVAILABLE and x.x.x recipe versions; Patch Manager patches OS packages, so open Inspector findings on language packages are fixed in the application build.
• Prioritise by the Inspector score (CVSS adjusted for reachability and exploitability), not raw CVSS; EPSS estimates exploitation likelihood.
• GuardDuty Runtime Monitoring covers EKS, ECS on Fargate and EC2 with an agent; Lambda is covered by Lambda Protection through network activity logs.
• ECR continuous scanning is an enhanced-scanning frequency bounded by Inspector re-scan durations; cross-account pull needs the repository policy for the three pull actions and ecr:GetAuthorizationToken in the puller's identity policy.
• Execution role at task startup, task role at runtime; the service-linked and infrastructure roles act for ECS, never for your code.
• On EKS, grant AWS access per pod with IRSA or EKS Pod Identity, never by inflating the node instance role; enable control-plane audit logs and prefer a private API endpoint.
• Lambda's resource policy decides who invokes it: scope S3 grants with both aws:SourceArn and aws:SourceAccount; EventBridge Scheduler uses its own execution role instead.
• Only native Session Manager shells log session data; EC2 Instance Connect Endpoint still needs port 22 or 3389 open on the instance from the endpoint.
• CodeGuru Security has ended; scan in the IDE with Amazon Q Developer, in repositories with Inspector code security, and gate builds with the Inspector SBOM Generator and Scan API.
• Bedrock Guardrails mask or block sensitive data per direction and check prompt attacks only on tagged user input; invocation logs keep the original text, so mask them with CloudWatch Logs data protection.

Network Security Controls: SGs, NACLs, Network Firewall, and Egress

• Security groups are stateful and allow-only; referencing SGs as sources gives micro-segmentation that survives IP churn — behind a load balancer reference the load balancer's group, and across a transit gateway referencing works inbound only and not through an inspection VPC.
• NACLs are stateless, ordered (lowest matching number wins), subnet-wide, and the only layer with an explicit deny: allow the ephemeral range in the reply direction, and number an exception below the deny it carves out.
• Isolated subnets have no route to an internet gateway, NAT gateway or egress-only internet gateway (no 0.0.0.0/0 and no ::/0) and reach AWS services through endpoints — ECR needs ecr.api, ecr.dkr and the S3 gateway endpoint for layers.
• Endpoint policies are data-perimeter checkpoints: aws:ResourceOrgID limits which resources the endpoint reaches (stops exfiltration with any credentials), aws:PrincipalOrgID limits who uses it, and aws:SourceVpce in a bucket policy protects your own buckets.
• Network Firewall inspects only what routing steers to its per-zone endpoints, including an internet gateway edge route table for inbound traffic; it has no security groups, preserves source addresses, and logs only traffic sent to the stateful engine.
• A domain allow list implies a deny only in default action order and only for the listed protocols; in strict order use the Drop established default action (Drop all kills the handshake before the SNI is visible), and in a central inspection VPC set HOME_NET to the spoke CIDRs plus the inspection VPC's own.
• DNS Firewall filters queries to the VPC resolver, which Network Firewall never sees; Network Firewall filters routed connections, which DNS Firewall never sees — use both, and block direct DNS, DoT and DoH to the internet.
• Centralized inspection needs spoke TGW route tables with no propagated spoke routes plus appliance mode on the inspection VPC attachment, whose associated route table needs route propagation for zone-aware flow placement; MACsec (dedicated connections only) or private IP VPN over a transit VIF encrypt Direct Connect; Verified Access replaces VPNs with per-request Cedar policies where group and endpoint policies must both allow.
• Find unnecessary access with Network Access Analyzer scopes (MatchPaths and ExcludePaths, any resource) and Inspector network reachability findings (EC2, automatic); troubleshoot from Flow Logs on both ends and from where a flow stops appearing in the logs.

Identity and Access Management

AWS Authentication Strategies: MFA, STS, and Federation

• Enforce MFA with an explicit deny using BoolIfExists on aws:MultiFactorAuthPresent (or Null on aws:MultiFactorAuthAge) and put the enrollment carve-out inside the deny with NotAction — a separate Allow cannot beat an explicit deny.
• FIDO2 security keys and passkeys resist real-time phishing because they sign for the origin; any typed code, virtual or hardware TOTP, can be relayed. SMS is not an IAM MFA option, and each IAM user can register up to eight devices.
• Choose the STS API by caller: AssumeRole for AWS principals, AssumeRoleWithSAML and AssumeRoleWithWebIdentity for federation, GetSessionToken for an MFA session from access keys. GetFederationToken sessions carry no MFA, cannot call IAM, and cannot assume roles.
• Role chaining (including from EC2 instance profile credentials) is limited to one hour, and a chained request above 3,600 seconds fails rather than being shortened.
• Session tags need sts:TagSession in every reachable role's trust policy, transitive tags cannot be changed later in a chain, and source identity is set once and recorded in every CloudTrail event of the chain.
• The external ID works only because the vendor generates a unique value per customer and never lets customers choose it; account, role or IP conditions cannot stop a confused-deputy request.
• IAM Identity Center provisions permission sets as roles across accounts; with an external IdP, users must be provisioned (SCIM, token valid one year) before SAML sign-in, and MFA is enforced at the IdP.
• Workloads authenticate without stored keys: OIDC with a tight sub condition for CI, EKS Pod Identity or IRSA for pods, instance profiles on EC2, Roles Anywhere certificates for servers outside AWS, and Cognito identity pools for app users.
• Diagnose by evidence: a SAML response missing its Role attribute fails before any AssumeRoleWithSAML event, while trust-condition and duration problems show as failed AssumeRoleWithSAML events in CloudTrail.

IAM Policy Evaluation and Authorization Strategies on AWS

• Evaluation order: explicit deny first, then the organization ceilings, resource-based and identity-based grants, permissions boundaries, and session policies — with implicit deny for anything never allowed.
• Only identity-based and resource-based policies grant access; SCPs, RCPs, boundaries, and session policies are ceilings that can only take away.
• Same-account access needs one allow; cross-account access needs both the resource policy and the caller's identity policy — and for SSE-KMS, the key policy and the caller's kms:Decrypt permission too.
• Exempt principals from a Deny with one statement listing them all under ArnNotLike on aws:PrincipalArn; NotPrincipal misses assumed-role sessions.
• Perimeter Denies on aws:PrincipalOrgID also hit service principals unless you exempt aws:PrincipalIsAWSService; network Denies need aws:ViaAWSService false; organization-wide confused-deputy protection is an RCP on aws:SourceOrgID.
• Delegated administration needs the iam:PermissionsBoundary condition on CreateRole and PutRolePermissionsBoundary, denies on removing or editing the boundary, and PassRole limited to the team's IAM path.
• ForAllValues matches vacuously when the key is absent — pair it with a Null check; use IfExists for keys present on only some resource types of an action.
• RestrictPublicBuckets is the only Block Public Access setting that changes what an existing public bucket policy grants; one unconditioned Principal * statement makes the whole policy public.
• Verified Permissions authorizes inside your applications with Cedar (default deny, forbid wins); Roles Anywhere separates workloads through trust-policy conditions on certificate attributes.
• The IAM Policy Simulator evaluates SCPs but not RCPs; Access Analyzer custom policy checks block risky policies before deployment.

Data Protection

Data in Transit on AWS: TLS, ACM, and End-to-End Encryption Design

• Enforcement is server-side: a Deny on aws:SecureTransport = false for S3 (with any s3:TlsVersion deny added alongside, never instead), CloudFront viewer and origin protocol policies, rds.force_ssl or require_secure_transport, and ElastiCache transit encryption mode required.
• ELB security policy names encode the versions (TLS13-1-2 = TLS 1.2 minimum, TLS13-1-3 = TLS 1.3 only); listeners created by CLI or CloudFormation without SslPolicy get ELBSecurityPolicy-2016-08, so govern them with an SCP on elasticloadbalancing:SecurityPolicy.
• An ALB always terminates TLS, re-encrypts only when the target group uses HTTPS, and never validates target certificates; an NLB TCP listener passes TLS through end to end, while an NLB TLS listener terminates; CloudFront validates origin certificates and needs a publicly trusted one.
• API Gateway mTLS protects only the custom domain — disable the default execute-api endpoint; ALB mTLS verify mode checks a trust store and imported CRLs, passthrough mode leaves validation to the application.
• Gateway endpoints serve S3 and DynamoDB inside one VPC only; interface endpoints (PrivateLink) work from on-premises too, and PrivateLink endpoint services share one service without routing or CIDR conflicts.
• Client VPN gives a network tunnel with authorization rules per CIDR (group rules need AD or SAML); Verified Access gives VPN-less, per-request identity- and device-checked access to individual applications.
• Nitro instances encrypt traffic between supported types in the same or peered VPCs (not through load balancers or transit gateways); VPC Encryption Controls evidences it with the flow-log encryption-status field and enforces it after starting in monitor mode.
• EMR in-transit encryption comes from a security configuration applied at launch; EKS pod traffic is encrypted by Nitro nodes but authenticated only by mesh mTLS; SageMaker AI inter-container encryption needs UDP 500 and ESP and slows distributed training.

Encryption at Rest on AWS: KMS Keys, Key Policies, and Service Integration

• Customer managed keys are the only key type with editable key policies, a chosen rotation period, grants, disabling, deletion, and cross-account use; KMS-generated material supports all of it.
• Use CloudHSM directly only when you must manage the HSM users or keep PKCS#11/JCE code; a CloudHSM-backed custom key store is still reached only through the KMS API. Choose client-side encryption when the storage service must never see plaintext.
• The key policy is the root of trust: the account-principal statement enables IAM policies, the lockout safety check guards edits, and a recreated role with a deleted role's name does not regain access.
• Cross-account KMS access needs both the key policy and the caller's IAM policy on the key ARN (not an alias ARN); aws:PrincipalOrgID covers a whole organization, aws:SourceOrgID applies only to service principals.
• Rotation never re-encrypts data — fixing exposed material means re-encrypting with new data keys; multi-Region keys help client-side encryption, while S3 replication re-encrypts anyway.
• S3 Bucket Keys fix SSE-KMS throttling and cost (new objects only, bucket-ARN context, not with DSSE-KMS); a StringNotEquals deny on the KMS key-ID header pins the key that default encryption cannot.
• Encrypt existing EBS volumes by creating an encrypted volume from a snapshot, and RDS by copying the snapshot with encryption; aws/ebs and aws/rds snapshots cannot be shared. Org-wide, an SCP must cover CreateVolume and RunInstances, and Config rules must be deployed to every account.
• Object Lock compliance mode can only be extended, a simple delete only adds a delete marker, and enabling Object Lock is irreversible and not retroactive; MFA delete is root-only, CLI/API-only, and incompatible with Lifecycle.
• For ransomware resilience, copy backups to another account or a logically air-gapped vault under Backup Vault Lock compliance mode, using customer managed source keys for EBS and RDS; DataSync verifies transfers, Lambda code signing in Enforce mode blocks untrusted code.
• Disable a key and watch CloudTrail before scheduling deletion: the 7–30 day pending window is recoverable, but deletion makes every ciphertext under the key permanently unrecoverable.

Protecting Secrets, Confidential Data, and Cryptographic Key Material

• Secrets Manager earns its cost with rotation, cross-account resource policies and multi-Region replication; a standard-tier Parameter Store SecureString is the free answer for encrypted configuration that never rotates.
• Four rotation forms: service-managed secrets (no function), AWS-provided templates (a Lambda in your account), managed external secrets (onboarded SaaS partners only, no Lambda) and custom four-step functions for everything else.
• createSecret stores AWSPENDING, setSecret changes the target, testSecret signs in with AWSPENDING, finishSecret moves AWSCURRENT with UpdateSecretVersionStage; a stale AWSPENDING blocks later rotations until removed.
• Single-user rotation invalidates the old password at once; alternating users keeps the previous user valid, but every later grant must go to both users.
• Cross-account secrets need the secret's resource policy and a customer managed key's policy (aws:PrincipalOrgID in both for a whole organization); replicas get a key in their own Region, and default replicas break cross-account readers.
• CloudWatch Logs data protection masks at ingestion with managed and custom data identifiers; account and log-group policies both apply. SNS message data protection (closed to new customers since 30 April 2026) acts Inbound on publishers and Outbound per subscriber.
• Only an external key store keeps material outside AWS; custom key stores give up multi-Region keys, imported material and KMS rotation.
• Imported material rotates on demand only, and any expired or deleted material makes the whole key unusable; multi-Region keys share material and rotation but not aliases, policies or grants.
• Standard ACM certificate keys never leave AWS; exportable ACM certificates and Private CA certificates hand you the key. Share Private CA through AWS RAM and request through ACM for managed renewal.

Security Foundations and Governance

AWS Organizations, SCPs, and Control Tower: Multi-Account Security Strategy

• Separate accounts are the blast-radius boundary: cross-account access is denied by default, so IAM changes inside one account cannot reach another — only an explicit resource or trust policy grant can open it.
• Logs go to the log-archive account, security tooling to the audit account; the Suspended OU is a pre-built quarantine you move a compromised account into without changing anything inside it.
• No SCP or RCP applies to the management account, so keep it empty and delegate: security services (per Region for GuardDuty, with auto-enable), IAM root access tasks and even Organizations policy management.
• SCPs never grant: an action needs an Allow at every level, SCPs at one level combine, and an explicit Deny wins — exceptions go inside the Deny as a condition (ArnNotLike aws:PrincipalArn).
• Region deny uses NotAction for global services (they evaluate as us-east-1); root deny matches aws:PrincipalArn arn:aws:iam::*:root; protecting CloudTrail, GuardDuty and Config is an unconditioned SCP Deny.
• RCPs cap access to member-account resources for any caller on a documented, growing list of services (not service-linked roles, AWS managed KMS keys or the management account); the perimeter pairs aws:PrincipalOrgID with an aws:PrincipalIsAWSService exception.
• Declarative policies set and lock a configuration everywhere (service-linked roles and future APIs included); an SCP can only deny the API that changes it.
• Control Tower: preventive = SCP or RCP, detective = Config rule, proactive = CloudFormation hook; controls run only in governed Regions; register OUs to enroll existing accounts (AWSControlTowerExecution role, no conflicting Config resources); Account Factory vends governed accounts, CfCT customizes but creates none.
• Centralized root access deletes member root credentials and runs root-only tasks through sts:AssumeRoot with task policies, scoped by sts:TaskPolicyArn; the management account root user still needs multiple MFA devices and sign-in alerting.

Secure IaC Deployment: CloudFormation, StackSets, and Service Catalog

• Peer review, attribution, and revert together need source control with pull requests; a versioned S3 bucket gives only the revert.
• Drift detection compares only properties explicitly set in the template or parameters, so declare security-relevant settings; CloudTrail, not drift, tells you who changed something.
• Stack policies govern CloudFormation updates only; stopping direct API edits needs an SCP deny with an aws:PrincipalArn exception for the deploy role. Scope iam:PassRole to the specific service role ARN.
• Service-managed StackSets with automatic deployment cover future accounts in targeted OUs, but never deploy to the management account; trusted access applies only to service-managed permissions, and operation preferences control rollout, not per-account failures.
• cfn-lint checks CloudFormation validity; Guard checks your policy against any JSON/YAML, including Terraform plan JSON; Hooks enforce in the account at deploy time; Config rules detect after the fact.
• NoEcho only masks output and never covers Metadata or Outputs; use secretsmanager or ssm-secure dynamic references — only Secrets Manager rotates, and a plain ssm reference resolves an unencrypted value.
• Terraform state holds secrets in plaintext: encrypt it with KMS and restrict reads to the deploy role; locking and versioning protect integrity, not confidentiality.
• Tag policies standardize keys and values but do not block untagged creation; an SCP denying the create action when aws:RequestTag is null does. Resource groups are Regional and AND their tag keys; cost allocation tags affect billing only.
• Service Catalog launch constraints (LocalRoleName for shared portfolios) remove underlying permissions from users; RAM shares one owner-controlled resource; Firewall Manager needs AWS Config and continuously enforces WAF and security group policies.

Evaluating AWS Resource Compliance: Config, Security Hub, Audit Manager

• AWS Config evaluates only what it records: a customer managed recorder (one per account per Region, needs a delivery channel to start) produces configuration items, and rules evaluate them on change or on a schedule.
• A stopped recorder silences change-triggered rules and leaves a permanent gap in history; periodic rules keep running, so the breakage is easy to miss.
• Guard custom policy rules need no code but are change-triggered only; time-based checks need a periodic managed or Lambda rule. Proactive evaluation reports on planned resources but never blocks or remediates.
• Remediation = rule + SSM Automation runbook + AutomationAssumeRole, set to automatic; retries run only after failures, and service-linked securityhub- rules cannot carry remediation — use your own copy of the rule.
• Config Rules Compliance Change events land on the default bus of the account and Region that evaluated; aggregators emit no events, so organization-wide alerts need forwarding to a central bus.
• Conformance packs and rules are account- and Region-scoped and an aggregator evaluates nothing; organization packs reach new accounts only if a recorder exists within 7 hours.
• Security Hub CSPM scores per control (passed ÷ enabled); conformance packs score per rule-resource pair. Unrecorded types give WARNING findings and a failed Config.1; suppressed and archived findings don't count.
• Past state comes from Config history, the caller from CloudTrail (Event history 90 days, older from trail logs). Audit Manager organizes evidence for existing customers only since 30 April 2026; Artifact provides AWS's reports and agreements; the Well-Architected Tool reviews design.