SAP-C03 Compliance Architecture: Data Residency, Audit Trails, Object Lock, AWS Artifact and Threat Modeling

Compliance architecture is the set of controls that lets a regulated workload meet a rule and prove it met the rule: protecting the data, keeping it where the law says, recording who touched it, and producing evidence an assessor will accept. On AWS that work is split by the shared responsibility model: AWS is responsible for the security of the cloud (data centers, hardware, the services' own infrastructure) and proves it with independent audit reports; you are responsible for security in the cloud (configuration, identity, encryption choices, logging) and must prove that yourself.

SAP-C03 Task 2.4 breaks the job into six skills. Each maps to a small family of AWS mechanisms:

Key management depth (key policies, rotation, CloudHSM, external key stores), SCP and RCP mechanics, and responsible-AI controls such as Bedrock Guardrails belong to sibling tasks; this lesson uses them only where they decide a compliance or residency design.

A regulated data store usually needs three controls at once: encryption at rest with a key the company controls, a refusal of unencrypted connections, and a record of access. Choosing the right variant of each is what separates a compliant design from one that merely sounds secure.

Encryption at rest for S3

When a rule says the company must be able to revoke access to the data by turning the key off, only a customer managed key qualifies.

Encryption in transit

An S3 bucket policy that denies s3:* when aws:SecureTransport is false rejects every plain-HTTP request. Getting the boolean backwards denies the encrypted requests instead.

Relational databases

• Encryption at rest is set when an RDS instance is created; you cannot turn it on for an existing unencrypted instance. The path is: snapshot, copy the snapshot with encryption under the customer managed key, restore a new instance from the encrypted copy, then cut over.
• For RDS for PostgreSQL, the rds.force_ssl parameter set to 1 in a custom DB parameter group makes the database refuse non-TLS connections. It defaults to 1 only from PostgreSQL 15, so older versions need it set explicitly. IAM database authentication does not force TLS on password logins.
• Statement-level auditing of reads on a specific table comes from the pgAudit extension (object auditing), with PostgreSQL logs published to CloudWatch Logs. Database Activity Streams is not available for RDS for PostgreSQL, so it is not the answer there.

Masking sensitive data in logs

Logs can become a second copy of regulated data. A CloudWatch Logs data protection policy on a log group uses managed data identifiers (for example, credit card numbers) to mask matches at every egress point, including Logs Insights queries, subscription filters and exports, while the stored event stays intact. Only principals granted logs:Unmask can view the original values. That gives one copy of the logs, no custom code, and separate views for operators and investigators.

Amazon Macie finds sensitive data in Amazon S3, which is the first step of any data protection program: you cannot protect or locate personal data you do not know about. Macie offers two modes that answer different questions.

• Organization use: designate a Macie delegated administrator, then enable automated discovery for the organization. No bucket lists or schedules to maintain.
• Proof of absence needs a job. A low sensitivity score is an estimate built from a sample. Proving that no object contains a given data type needs a sensitive data discovery job that inspects every object in scope (sampling depth 100%). Jobs are charged by the volume of data inspected, so control cost by narrowing the buckets and objects in scope and by how often the job runs; adding or removing identifiers barely changes the bill.
• Custom data identifiers (a regular expression, optionally with keywords and proximity) detect company-specific formats such as internal member IDs that managed identifiers miss. The administrator can add them to the automated discovery settings, so ongoing discovery picks them up without any job.
• Allow lists do the opposite: they tell Macie to ignore text that matches, reducing false positives.

GuardDuty S3 Protection detects suspicious access, not sensitive content, and Glue sensitive-data detection works inside ETL jobs rather than giving an organization-wide sensitivity view.

S3 Object Lock stores object versions in write-once-read-many (WORM) form, which is how regulations that demand non-rewritable, non-erasable records are met on S3. It works on versioned buckets and can be enabled on an existing bucket. Protection applies per object version through a retention period, a legal hold, or both.

• A bucket default retention applies to new object versions only; changing it never touches existing objects.
• With an event hold in the default retention, every new version is protected while the hold is on; when the application releases the hold, S3 sets the retain-until date to the release time plus the configured duration. That fits "keep for N years after the case closes" with no batch job to set dates later.
• A long compliance-mode retention cannot be shortened later, so do not use one as a stand-in for a legal hold.
• MFA Delete and bucket policies are changeable by the root user, so they do not meet a "no one, including root" requirement.

A regulated audit trail must be complete, kept for the required period, and provably unaltered. CloudTrail Event history shows only the last 90 days of management events in one account and Region, so long-term retention needs a trail.

Retention

• An organization trail, created from the management account or a CloudTrail delegated administrator, logs every member account and Region to one S3 bucket, normally in a dedicated log archive account.
• S3 Lifecycle transitions log files to S3 Glacier Deep Archive for the lowest storage cost and expires them at the end of the retention period. Two caveats: by default Lifecycle does not transition objects smaller than 128 KB, and many compressed CloudTrail files are smaller, so add an object-size filter if they must move; each object in Deep Archive also carries roughly 40 KB of billed metadata overhead, so very small files can cost more archived than left in place.
• Match the transition to the query window. Amazon Athena skips objects in Glacier Flexible Retrieval and Deep Archive unless they are restored, so logs that investigators query must stay in a directly readable class until that window ends. S3 Intelligent-Tiering's opt-in archive tiers can move objects out of Athena's reach inside the window, and it does not tier objects under 128 KB.
• CloudTrail Lake closed to new customers on 31 May 2026 (existing event data stores keep working). Never present it as the retention choice for a new account.

Integrity

Log file integrity validation makes CloudTrail hash (SHA-256) every log file it delivers and deliver an hourly digest file listing those hashes, signed with a Region-specific private key and chained to the previous digest. aws cloudtrail validate-logs walks the chain and reports:

• a changed file as a hash mismatch;
• a deleted or moved file as not found;
• periods with no delivery.

It checks only files that the digests reference. A file that never appears in the verbose output, even though the digests around it are valid, was not delivered by CloudTrail.

Validation detects tampering but does not prevent deletion. To meet "detect changes and stop anyone deleting the logs for N years", combine it with Object Lock in compliance mode on the log bucket (digest files live in the same bucket and are protected too). Versioning, KMS encryption or a second copy in CloudWatch Logs do not give signed proof.

Scope: management events versus data events

• Management events cover control-plane calls (CreateBucket, CreateTable). Object- and item-level calls such as S3 GetObject/PutObject and DynamoDB GetItem/Query are data events, which are off by default and billed separately.
• Advanced event selectors narrow data events to what the rule needs: resources.ARN StartsWith a bucket-and-prefix ARN or Equals a table ARN, readOnly Equals false for writes only, and userIdentity.arn to exclude a known caller. A role session's caller ARN has the form arn:aws:sts::<account>:assumed-role/<role>/<session>, never the IAM role ARN, so exclusions use NotStartsWith on that STS prefix.
• S3 server access logs are cheaper but delivered on a best-effort basis, so they fail a "complete, reliably delivered" requirement. DynamoDB Streams record item changes, not reads, and Contributor Insights is usage analytics, not an audit trail.

Auditing a generative AI workload needs two records: who called what (CloudTrail) and what was asked and answered (model invocation logging). CloudTrail never records prompt or response bodies.

A trail that records only management events therefore shows model invocations but misses agent and knowledge base calls until those data event resource types are added.

Model invocation logging

• Captures input and output for each invocation and delivers to Amazon S3, CloudWatch Logs or both. The destination must be in the same account and Region as the Bedrock calls, and large or binary bodies (over 100 KB) go only to S3.
• To centralize prompts in a log archive account under WORM retention while keeping data in one Region, log to a bucket in the workload account and use S3 Same-Region Replication to an Object Lock compliance-mode bucket in the log archive account.
• If prompts can contain card numbers or other identifiers, a CloudWatch Logs data protection policy masks them for day-to-day readers and logs:Unmask lets investigators see originals. A Bedrock guardrail changes what the model sees and returns; it is a runtime control, not a log-access control.

Cross-Region inference in the audit trail

When requests go through a cross-Region inference profile, CloudTrail logs each one in the source Region, and the additionalEventData.inferenceRegion field records which Region actually processed it, which is per-request residency evidence.

The first sovereignty control is preventing anyone from deploying regional resources outside the approved Regions. AWS Control Tower offers two managed ways to do it, and a custom SCP is the third option.

Use the landing zone setting when the whole estate shares one Region list; use the OU-level control when one OU (for example a business unit under a stricter regulator) needs a different list from the rest. Both exempt global services for you.

Why global services break naive SCPs

Calls to global services such as IAM, Route 53 and CloudFront resolve to us-east-1 for aws:RequestedRegion. A Deny on Action "*" outside an EU Region therefore blocks creating IAM roles or editing Route 53 records. The fix is a Deny with NotAction listing the global services, so the Region condition applies only to regional services. Adding us-east-1 to the allowed list would open every regional service there; aws:ViaAWSService covers only calls a service makes on a principal's behalf; and a resource control policy governs access to resources rather than which Region principals act in.

Regulatory agreements

Some rules require a contract with AWS, such as a HIPAA Business Associate Addendum (BAA). These are accepted in AWS Artifact (see the evidence section): an organization agreement covers every account, an account agreement covers one.

Region deny stops resources being created elsewhere, but data can still leave through networking, edge caching or services that route requests across Regions. Residency designs close those paths too.

Control Tower data residency controls

• Disallow cross-Region networking (EC2, CloudFront, Global Accelerator): denies creating or accepting VPC peering connections and transit gateway peering attachments, and denies CloudFront CreateDistribution/UpdateDistribution and Global Accelerator changes. AWS notes it blocks VPC peering even within one Region. Transit gateway VPC attachments are not denied, so a transit gateway in the Region connects VPCs privately while the control stays on. Editing a Control Tower-managed SCP causes drift.
• Disallow VPN connections: blocks Site-to-Site VPN and Client VPN.
• Disallow internet access for customer-managed VPCs: denies creating and attaching internet gateways and egress-only internet gateways (and default VPCs). Existing VPCs keep their internet access, so existing gateways must be removed separately, and the Account Factory VPC internet setting must be turned off for newly provisioned accounts.

CloudFront is a global service that Region deny exempts, so without the networking control a team can still put regulated objects behind a distribution that caches them at edge locations worldwide. CloudFront geo restriction filters viewers, not where content is cached. A bucket policy that denies s3:GetObject to principals outside the organization or OU does not help either: it would also deny the CloudFront service principal that origin access control uses, it protects only the one bucket it is attached to, and it does nothing to stop someone creating a new distribution. VPC Block Public Access blocks internet traffic but leaves gateways attached, so it does not satisfy a rule that forbids the gateways themselves; a Config rule only detects.

Generative AI: cross-Region inference

• Cross-Region inference raises throughput without a capacity commitment. Inference profiles do not support Provisioned Throughput.
• An SCP that allows only the source Region causes explicit-deny failures for requests routed elsewhere; the least-privilege fix is to allow the profile's destination Regions for Bedrock inference actions only, not for every action.
• Requests can be routed to opt-in Regions that are not enabled in the account, so you do not need to enable them.

Countries without an AWS Region

• AWS Outposts racks run AWS infrastructure and APIs in your own facility, managed from a parent Region. S3 on Outposts keeps object data on the rack, inside the country, with the S3 API.
• EBS snapshots of Outpost volumes go to the parent Region by default. Local snapshots (to S3 on Outposts) keep snapshot data on the rack; Amazon Data Lifecycle Manager can automate them with the Outpost as the destination, and an IAM policy that denies CreateSnapshot for the Outpost's volumes when ec2:OutpostArn is null blocks Regional copies. Snapshot metadata still lives in the Region, but no snapshot data does.
• File Gateway, a neighbouring Region or a Local Zone all store data outside the country. An external key store controls where keys live, not where data is stored.

Compliance evidence comes from two sides of the shared responsibility model: AWS Artifact for what AWS controls, and AWS Config and Security Hub CSPM for what you control.

AWS Artifact

• Reports: AWS's independent audit reports (SOC, ISO, PCI DSS Attestation of Compliance and responsibility summary, and others). These are the evidence for inherited controls such as data center physical and environmental security.
• Agreements: an organization agreement is accepted from the management account of an organization with all features enabled and covers every existing and future member account; it cannot be accepted from a delegated administrator or narrowed by OU or SCP. An account agreement is accepted while signed in to one account and covers only that account, which fits when only that one account handles the regulated data.
• Third-party reports: security and compliance documents (such as a SOC 2 report) for ISVs that sell on AWS Marketplace, provided through AWS Marketplace Vendor Insights, which also lets you monitor the vendor's security profile over time.
• Notifications: Artifact can email you about new and updated reports and agreements through AWS User Notifications, so no one has to check the console.

Evidence about your own resources

• AWS Config organization conformance packs deploy framework-aligned rule sets (for example Operational Best Practices for PCI DSS or HIPAA Security) to every member account from a Config delegated administrator; an aggregator gives the central view. A conformance pack is configuration evidence, never a contractual agreement.
• Configuration history: Config records a configuration item whenever a recorded resource changes and keeps history for the retention period (seven years by default), so you can show exactly how a security group looked months ago. CloudTrail Event history covers only 90 days of API calls, not resulting state.
• Advanced queries run SQL-like SELECT statements over current configuration, including against an aggregator, so you can list every unencrypted EBS volume across accounts and Regions without deploying anything new.
• Security Hub CSPM standards (such as PCI DSS) evaluate resources continuously; with a delegated administrator and cross-Region aggregation they give one view across accounts and Regions.
• AWS Audit Manager is in maintenance mode: since 30 April 2026 it cannot be set up in new accounts or Regions. Existing customers keep it; for a new organization, use Config conformance packs and Security Hub CSPM instead.
• Trusted Advisor checks are operational recommendations, not continuous framework evidence.

Risk assessment finds what could go wrong before it does (threat modeling, per workload, at design time) and tracks known risks across a portfolio over time (Well-Architected reviews).

Threat modeling with Threat Composer

The Well-Architected security pillar (SEC01-BP07) recommends threat modeling early in design and points to Threat Composer, which writes threats in a consistent grammar (actor, precondition, action, impact), links each to mitigations, highlights gaps, and exports a machine-readable model you can keep in Git and review with each design change. It needs no deployed resources, unlike Amazon Inspector or GuardDuty, whose findings describe running workloads.

STRIDE classifies threats so that each gets a mitigation of the matching kind:

Good mitigations attack the threat's precondition or its impact path. Take a threat in which an insider with broad console access changes a Lambda function's code to exfiltrate data. Removing standing write access (just-in-time elevation) removes the precondition; requiring signed code through a Lambda code-signing configuration breaks the impact path, because unsigned code is rejected at deployment. A control that protects a different property, such as encrypting the function's environment variables, leaves the threat as open as before. Match each mitigation to the STRIDE property the threat violates.

Well-Architected Tool reviews

• A review records high-risk and medium-risk issues per workload; a milestone saves the review's state so later reviews show which risks were fixed, which supports trend reporting.
• Custom lenses add company or regulatory questions and best practices to the same review and can be shared with the organization or OUs.
• Review templates hold pre-filled answers and notes (for Framework and custom lens questions) so workloads defined from them start with shared-control answers in place. Profiles are a near-twin that record business goals to prioritize questions; they do not hold answers.
• Workload sharing with the organization (after enabling AWS Organizations access in the tool) gives other accounts access in the same Region: read-only shows answers, risks and milestones; contributor also allows updating answers. Sharing a lens shares only its questions.