Governance, Security and Compliance

AWS operates under a shared responsibility model: AWS is responsible for the security of the cloud — the facilities, hardware, global network and the software layers it operates — and you are responsible for security in the cloud — your data, identities, configuration and the guest software you run. The conceptual model is introduced on Cloud Concepts; what matters operationally is that the line moves with the service you pick:

Two practical consequences. First, "managed" never means "nothing to configure": nearly every public data exposure on AWS is a customer-side configuration (a public bucket, an open security group, an over-broad role), which is exactly what the services below detect. Second, responsibilities are inherited or shared for some controls: patching is shared (AWS patches the host, you patch the guest), and compliance is shared (AWS provides audited evidence for its layer through AWS Artifact; you provide evidence for yours). Older tutorials sometimes describe the model as a single diagram with a fixed line; the current documentation stresses that the line depends on the service and on the controls you choose.

No single control is enough, so AWS security is layered. A request or an attacker has to get through several independent layers, each with its own detective counterpart:

AWS Config records the configuration of supported resources over time and evaluates it against rules. Where CloudTrail answers "who called which API", Config answers "what did this resource look like, and was it compliant, at a given moment". Its parts:

Config is also the engine under other services: Security Hub’s CSPM controls and AWS Control Tower’s detective controls are mostly implemented as Config rules, which is why enabling them without a recorder produces no findings. Control Tower sets up Config for every account in a landing zone (see Accounts and Organizations).

AWS Security Hub was relaunched in December 2025 as a unified cloud security service: it ingests findings from AWS detection services (GuardDuty, Inspector, Macie and others), from Security Hub CSPM and from partner products, normalizes them into the Open Cybersecurity Schema Framework (OCSF), correlates related signals into prioritized exposure findings and shows potential attack paths, so a team triages a handful of correlated issues instead of thousands of individual alerts. The earlier service is not gone: it continues as AWS Security Hub CSPM (Cloud Security Posture Management), the part that runs continuous configuration checks against security standards and emits findings in the older AWS Security Finding Format (ASFF). Older articles and tutorials that say "Security Hub" almost always mean what is now called Security Hub CSPM; the CLI mirrors the split with the original enable-security-hub, batch-enable-standards, get-findings family (CSPM) and the new enable-security-hub-v2, get-findings-v2 family.

GuardDuty is a threat-detection service: it analyses CloudTrail management events, VPC flow logs and DNS query logs (the foundational data sources, which it reads itself with nothing to configure) with threat intelligence and machine learning, and produces findings such as credential exfiltration, cryptomining and communication with known malicious hosts. Extended Threat Detection correlates events over time into attack-sequence findings and is on by default at no extra cost. Optional protection plans widen what is watched:

GuardDuty never blocks anything; it detects. Pair findings with EventBridge to trigger a remediation Lambda or an SNS notification (see Messaging and Integration). It is Regional: enable it in every Region you use, and in unused Regions as well, because attackers like Regions nobody watches. A 30-day free trial applies to a first-time activation.

Amazon Detective is the investigation companion: it automatically collects CloudTrail, VPC flow and GuardDuty data into a behaviour graph so that, starting from a GuardDuty or Security Hub finding, you can see which role made which calls from which address over time, instead of querying logs by hand. It does not detect anything by itself, so it is usually enabled after GuardDuty. AWS Trusted Advisor runs checks in cost optimization, performance, resilience, security and service limits; the security checks that matter most (for example an open security group or a publicly accessible snapshot) are available on every support plan, the full set requires a paid one (see Cost Management and Support). AWS Health shows events affecting your resources and is covered with CloudWatch and CloudTrail on Monitoring and Observability.

[[Edge protection]] == Edge protection

AWS WAF is a web application firewall attached to a protected resource: CloudFront, an Application Load Balancer, an API Gateway REST API, AppSync, Cognito user pools, Verified Access and a few others. A web ACL holds ordered rules — AWS managed rule groups (OWASP-style protections, known bad inputs, IP reputation, bot control), your own rate-based rules, geo and IP-set matches — each with an action (allow, block, count, CAPTCHA). Always start new rules in count mode and promote to block after reviewing sampled requests. AWS WAF Classic is the pre-2019 generation; it has been retired and its resources must be migrated to the current AWS WAF (see the migration page in the WAF guide), so ignore any tutorial using aws waf rather than aws wafv2. The WAF web ACL for CloudFront must be created in us-east-1 with scope CLOUDFRONT; Regional resources use scope REGIONAL in the Region of the resource. WAF wiring for each front end is on CloudFront and CDN Delivery, Load Balancers and Gateways and API Gateway.

AWS Shield defends against DDoS. Shield Standard is automatic and free on every account for network and transport layer attacks against CloudFront and Route 53 and, to a degree, other public endpoints; Shield Advanced is a paid subscription adding larger-event detection and mitigation, the AWS Shield Response Team, cost protection for scaling caused by attacks, and application-layer protection with WAF. AWS Firewall Manager applies WAF web ACLs, Shield Advanced, security-group policies, Network Firewall and Route 53 Resolver DNS Firewall rules across every account of an organization from a delegated administrator, automatically covering new resources and accounts; it depends on AWS Config. AWS Network Firewall is a managed stateful network firewall for VPC traffic, deployed in dedicated firewall subnets (network-layer detail on VPC Networking).

Derived from AWS CLI reference — wafv2 create-web-acl and AWS WAF.

AWS Organizations, service control policies, resource control policies, Control Tower and tag policies are the account-level governance tools and are covered on Accounts and Organizations. Two further services complete the picture and are mentioned only briefly:

A preventive guardrail is the strongest governance control because it applies even to administrators of a member account. The following service control policy, attached to the Bookshelf workload OU, stops anyone in the member accounts from switching off the detective services above or leaving the organization (the example is a starting point; test it in a sandbox OU first, as an SCP mistake can lock out your own pipelines):

Derived from the SCP examples in the AWS Organizations user guide.

AWS Artifact is the self-service portal for AWS’s own audit evidence: on-demand downloads of third-party audit reports and certifications (SOC 1, 2 and 3, ISO/IEC 27001 and related standards, PCI DSS attestation of compliance, C5, HIPAA-related documents and many more), and a place to review, accept and track agreements with AWS, such as a Business Associate Addendum for HIPAA workloads or a non-disclosure agreement that unlocks restricted reports. Agreements can be accepted for a single account or for all accounts of an organization. Some reports require accepting a confidentiality term before download. Documents and agreements are free of charge; access is controlled with IAM, so give auditors a read-only role. Artifact also offers an Assurance Assistant that drafts answers to compliance and due-diligence questionnaires from the available evidence. Reports say what AWS secured; they do not prove anything about your own workloads, which is where the remaining services come in.

AWS maintains a long list of compliance programs — certifications and attestations such as ISO/IEC 27001, 27017 and 27018, SOC 1/2/3, PCI DSS, HIPAA eligibility, FedRAMP, C5 in Germany, and regional or sector programs — and a published services in scope list per program. A service not in scope of a program must not process regulated data for that program, so check the list before choosing a service for regulated data. The Customer Compliance Center collects whitepapers, auditor-learning paths and per-industry and per-country guidance. AWS Regions also differ in which programs they hold: GovCloud and China are separate partitions (see AWS Global Infrastructure), and the AWS European Sovereign Cloud, generally available since January 2026, is an independently operated infrastructure in the European Union for workloads with strict sovereignty requirements.

AWS Audit Manager automates evidence collection for audits: you create an assessment from a prebuilt framework (PCI DSS, HIPAA, SOC 2, GDPR, CIS and others), it gathers evidence from API calls, CloudTrail, Config rules and Security Hub checks, and produces an assessment report for the auditor. Its status has changed. AWS is moving Audit Manager to maintenance mode: from 2026-04-30 it can no longer be set up in new accounts, and an account that already uses it can keep creating assessments but cannot extend it to new Regions (organization deployments can still add member accounts). AWS continues to maintain it and does not remove it, and recommends AWS Config conformance packs for new compliance work. The two are not equivalent: a conformance pack evaluates only the technical controls expressible as Config rules and has no audit report, no SOC 2 or GDPR packs and no evidence for procedural controls, so it does not replace the whole audit workflow. For the policies, procedures and documentation an auditor also expects, the availability notice points to partner compliance-automation tools used with Config. Treat the two options as follows: for a new account, deploy conformance packs (and the Security Hub CSPM standards) and keep evidence in an S3 bucket; for an account already using Audit Manager, keep using it, and plan the move.

Derived from AWS Audit Manager availability change.

A practical order of work for a fresh account (or a new account in the organization), each item linking to where it is covered. Many are automated by Control Tower for accounts created through Account Factory.

Pricing model (no prices here; follow the dated links in the references):

Limits and quotas: each service has Regional quotas (for example Config rules per Region, conformance packs per Region, GuardDuty member accounts per administrator, WAF web ACL capacity units) listed on its endpoints-and-quotas page; request increases through Service Quotas. GuardDuty, Inspector, Macie, Security Hub and Config are all Regional — coverage in one Region says nothing about another.

Recent changes (verified 2026-10-01, re-check the lifecycle page):

Older guides are also outdated in showing only the original Security Hub (now CSPM), treating shared responsibility as a single fixed diagram, and presenting Audit Manager as the default compliance tool.

Security services bill while enabled; disable what you enabled for a throwaway account. Do this only in a test account — turning off detection in a real one is itself a security finding.

Empty and delete the Config delivery bucket last (versioned buckets need all versions removed; see S3 Object Storage). Evidence retained by Config and Macie in S3 is not deleted automatically.