Amazon DOP-C02: Security, Compliance and Governance — Study Guide

By Laurynas Brazys · 4 August 2026 · #amazon #dop-c02 #certification #exam-prep #study-guide

Part of the AWS DevOps Engineer Professional DOP-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

Overview

Security, compliance, and governance on AWS hinge on deterministic controls that scale across accounts and Regions without slowing delivery. A robust design layers identity controls (IAM, permission boundaries, and service control policies), multi-account governance (AWS Organizations and Control Tower), continuous assessment and remediation (AWS Config), threat detection (Security Hub, GuardDuty, Inspector), secrets hygiene, encryption with AWS KMS, and network isolation (VPC security groups, NACLs, endpoints, and PrivateLink). The objective is to minimize blast radius, prove compliance continuously, and automate prevention and remediation while preserving least privilege and developer autonomy.

Identity, Policy, and Multi-Account Governance

IAM roles, policies, permission boundaries, and SCPs work together to form the effective permission set. An IAM role’s identity-based policies define allowed actions; the role’s trust policy defines who can assume it. Permission boundaries cap what a principal can do regardless of what identity policies say. SCPs in AWS Organizations set the absolute maximum for any principal in a member account (including the root user). Resource-based policies (for S3, KMS, Secrets Manager, etc.) may allow cross-account access, but they also cannot exceed boundaries imposed by SCPs or permission boundaries. The effective permission is the intersection of: identity policies ∩ permission boundary ∩ session policies (if present) ∩ resource policy (if applicable) ∩ SCPs, with any explicit Deny taking precedence.

Use permission boundaries to enable safe self-service in a single account. For example, a developer vending pipeline can create roles only if it attaches a boundary that denies iam:PassRole except for specific patterns, denies kms:Decrypt on sensitive keys, and caps EC2 instance types. Boundaries are attachable only by principals that already have iam:PutRolePermissionsBoundary; guard that right tightly.

SCPs are organization-wide guardrails. Common guardrails include prohibiting disabling AWS Config or CloudTrail, preventing outside-Organization invitations, denying changes to IAM Identity Center’s delegated administrator, and restricting Regions. Prefer explicit allow-by-exception patterns with conditions (for example, permitting changes by a central admin role) to minimize friction. Always allow creation and use of needed service-linked roles (e.g., for GuardDuty, Inspector, Config) or your SCPs will inadvertently block service setups.

AWS Organizations provides hierarchical OUs to separate environments (e.g., Sandbox, Dev, Prod), workload types, and exception lanes. Inherit SCPs from parent OUs to avoid policy drift. Use account vending to standardize account setup: AWS Control Tower’s Account Factory (console) or Account Factory for Terraform (AFT) to integrate into CI/CD. AFT adds GitOps-style workflows, drift detection, and feature flags (e.g., provisioning Enterprise Support), and scales to hundreds of accounts with consistent baseline guardrails.

AWS Control Tower automates a landing zone with prescriptive guardrails. Preventive guardrails are SCPs Control Tower manages; detective guardrails are AWS Config rules it deploys. Control Tower integrates IAM Identity Center for SSO and permission sets. Use ABAC-based permission sets with attributes for access control to scope actions by aws:PrincipalTag or identity attributes. Extend the baseline with Customizations for AWS Control Tower (CfCT) to deploy CloudFormation, SCPs, and Config packs per OU/account automatically. Keep exception OUs to host workloads needing tailored policies without weakening global guardrails.

Continuous Compliance and Automated Remediation

Enable AWS Config organization-wide from a delegated administrator account. Turn on recording for all resources in all Regions and aggregate configuration across the Organization with an organization aggregator. Use managed rules for common controls (e.g., ebs-encryption-by-default, restricted-ssh, s3-bucket-level-public-access-prohibited) and author custom Lambda-backed rules for bespoke logic (e.g., verifying KMS rotation cadence against a 90-day policy or enforcing default tags and values). Conformance packs group rules, parameters, and remediation into versioned, deployable bundles per OU; maintain them in version control and roll out via StackSets or CfCT for consistency and auditability.

Automated remediation closes the loop. Map each rule’s noncompliant evaluation to an SSM Automation runbook that enforces the baseline: attach a default instance profile, apply a tag with a default value, toggle S3 Block Public Access, or restart an EC2 instance for maintenance. Use parameterized documents and dynamic input (e.g., from the Config finding) to keep runbooks generic. For high-risk resources, configure remediation to auto-execute; for sensitive actions, require a change approval or manual invocation via EventBridge and ChatOps. Protect Config itself with SCPs that deny stopping the recorder or deleting delivery channels except by a central administrator.

Firewall Manager complements this layer for policy-as-a-service across accounts, using Organizations. Delegate a central admin and author policies for WAF web ACL associations on internet-facing ALBs/API Gateway, VPC security group auditing and cleanup, or DNS Firewall rule propagation. This shifts future enforcement from detection/remediation to prevention.

Threat Detection, Secrets Hygiene, and Vulnerability Management

Security Hub serves as the central pane of glass for findings across accounts and Regions. Enable it with a delegated admin, aggregate findings, and activate relevant standards (AWS Foundational Security Best Practices, CIS, PCI DSS where applicable). Findings flow into the AWS Security Finding Format (ASFF), normalizing inputs from GuardDuty, Inspector, IAM Access Analyzer, Config, Macie, and partner tools. Wire EventBridge patterns to route critical findings to remediation automations (SSM Automation, Lambda) and notifications (SNS, chat).

GuardDuty provides managed threat detection without requiring you to manage data-plane log pipelines. It analyzes CloudTrail management and data events, VPC Flow Logs, Route 53 Resolver DNS query logs, and EKS audit logs to detect anomalous behavior, credential exfiltration, crypto-mining, DNS exfiltration, and more. Enable Malware Protection for S3 and EC2/EBS scanning on suspicious activity. Use organization-wide auto-enablement and archive low-signal findings systematically with suppression rules to focus on actionability.

Amazon Inspector continuously assesses EC2 (via SSM agent) for package CVEs, ECR container images for vulnerabilities pre-deploy, and Lambda functions for code package CVEs. Inspector requires that EC2 instances have the SSM Agent installed, the instance profile allows SSM permissions, and egress to SSM/KMS endpoints (via VPC endpoints if internet is restricted). Configure Inspector to send findings to Security Hub and trigger patch workflows with Systems Manager Patch Manager or runbook-driven remediation. Use tags to scope which resources are in scope for scanning and to separate sandbox from regulated workloads.

Secrets Manager centralizes secret storage, rotation, and cross-account access with strong auditability. Prefer Secrets Manager over parameter stores for credentials that require rotation, leveraging built-in rotation for RDS/Aurora or Lambda-based rotation for external systems. Staging labels (AWSCURRENT, AWSPREVIOUS) allow zero-downtime rotation. Run rotation Lambdas in VPCs with the necessary endpoints (Secrets Manager, RDS, KMS) and restrict egress. For cross-account consumption, attach a resource-based policy that grants principals in other accounts GetSecretValue; ensure the KMS key policy for the secret’s CMK allows the consumer’s principals to decrypt and, if needed, to create grants. For disaster recovery or locality controls, replicate secrets across Regions and align rotation windows.

Data Protection and Network Security

Design encryption using KMS with explicit key policies. Key policies, not just IAM policies, ultimately authorize principals for cryptographic operations on a CMK. Adopt a least-privilege, role-based key policy model: delegate administration to a central KMS admin role; grant usage rights narrowly to workload roles; disallow wildcard kms:* to avoid accidental escalation. Use condition keys (kms:EncryptionContext:*) to bind decryption to expected contexts. Multi-Region keys enable active-active encryption where data replicates cross-Region.

Grants are the right tool for delegating temporary or tightly scoped key usage without editing the key policy, and they are required for some service flows (e.g., EC2 Auto Scaling using encrypted launch templates, cross-account AMI usage). To allow another account to create grants, the key policy must permit kms:CreateGrant to that account’s principals; the grantee must supply a grant token for immediate use in the same call path. For cross-account encrypted AMIs, copy and encrypt the AMI with a CMK, share the AMI, permit the target account to create grants on the CMK, and have the target service-linked role receive a grant.

Envelope encryption is the default pattern: generate a data key with KMS, encrypt data locally with the plaintext data key, then store only the ciphertext and the encrypted data key. On read, call KMS Decrypt to recover the plaintext data key into memory. This minimizes KMS calls for large payloads and limits plaintext key exposure. Where supported, use service-managed SSE-KMS (S3, EBS, RDS) for operational simplicity but still align key policies for cross-account producers/consumers.

VPC security starts with least-privilege security groups. Security groups are stateful; return traffic is implied. Prefer security group references over CIDR-based rules to avoid brittle IP allow-lists and to keep intent with infrastructure code. Default outbound allows are risky; explicitly restrict egress to required destinations and use VPC endpoints for AWS service access. NACLs are stateless and evaluated first; keep them as coarse, subnet-level controls with explicit returns for ephemeral ports only when you must implement an additional boundary or meet regulatory requirements; otherwise, favor security groups for manageability.

Eliminate internet dependencies by using VPC endpoints. Gateway endpoints (S3, DynamoDB) route privately over the AWS network; associate an endpoint policy to restrict accessible buckets or tables. Interface endpoints (AWS PrivateLink) expose AWS services (Secrets Manager, KMS, SSM, ECR, CloudWatch) via private IPs; deploy them in subnets with the right security groups and enable Private DNS so standard service names resolve to private addresses. For producer-consumer microservices across accounts/VPCs, publish an NLB-backed endpoint service and have consumers create interface endpoints to it via PrivateLink, avoiding peering or transit gateways and keeping traffic off the public internet. Combine these controls with no-NAT, no-IGW subnets, and centralized egress inspection where internet access is required.

Practical Problem Scenario

Expedia Group is expanding to hundreds of AWS accounts across multiple Regions and must enforce a strict security baseline: no internet egress for workloads, automated remediation of misconfigurations, centralized threat detection, secrets rotation, and controlled cross-account sharing of encrypted AMIs for standardized golden images.

Establish multi-account governance with AWS Organizations and AWS Control Tower

Action: Create OUs for Sandbox, Dev, Prod, and Security. Deploy Control Tower to establish the landing zone, enable mandatory guardrails, and integrate IAM Identity Center. Use Account Factory for Terraform (AFT) to vend accounts via GitOps.
Why: Control Tower provides turnkey, continuously enforced guardrails (SCPs and Config rules). AFT standardizes account provisioning at scale and codifies baselines in version control.

Author SCPs to enforce global guardrails with exceptions

Action: Attach SCPs that deny disabling CloudTrail and AWS Config, restrict Regions, and prevent public S3 ACLs. Include condition-based exceptions for a security-admin role in the Security OU. Allow creation/use of required service-linked roles.
Why: SCPs cap privileges across all principals, including root, preventing drift while permitting controlled exceptions for central operations.

Deploy Config conformance packs with automated remediation

Action: From the Security delegated admin account, enable AWS Config organization-wide and create an aggregator. Roll out a conformance pack that enforces EBS encryption by default, restricted SSH, mandatory tags with default values, and required WAF on public entry points. Map each rule to SSM Automation documents for automatic fixes (e.g., attach default instance profile, set missing tags to weekly).
Why: Conformance packs deliver consistent, auditable policy-as-code with auto-remediation that keeps environments in a compliant state without ticket churn.

Centralize detection with Security Hub, GuardDuty, and Inspector

Action: Enable GuardDuty and Inspector organization-wide with a delegated admin. Enable Security Hub standards (AWS FSBP and CIS) and aggregate findings. Create EventBridge rules to route high-severity findings to SSM Automation runbooks and an SNS topic for on-call.
Why: Managed detection and vulnerability assessment provide continuous coverage with minimal operational overhead, and Security Hub consolidates signals for faster triage and response.

Enforce least privilege IAM with permission boundaries and ABAC

Action: In AFT-provisioned accounts, require developer-created roles to attach a permission boundary that denies iam:PassRole except to curated roles and limits high-impact APIs. Use IAM Identity Center permission sets with ABAC to scope actions by team tags.
Why: Permission boundaries enable safe self-service while preventing privilege escalation; ABAC reduces policy sprawl and stays aligned with identity attributes.

Harden network paths with VPC endpoints and PrivateLink

Action: Remove IGWs/NATs from application subnets. Create interface endpoints for KMS, Secrets Manager, SSM, ECR, CloudWatch, and gateway endpoints for S3/DynamoDB with restrictive endpoint policies. Publish internal platform services via PrivateLink-backed NLBs for cross-account consumption.
Why: Private connectivity eliminates internet exposure and ensures services remain reachable in locked-down environments.

Implement KMS key strategy with grants for cross-account AMIs

Action: Create CMKs per environment with role-scoped key policies. In the image-building account, encrypt golden AMIs and share them. Update the CMK policy to allow the target accounts to create grants, then create grants to service-linked roles in those target accounts.
Why: Grants provide scoped, auditable delegation without editing key policies for every consumer, enabling Auto Scaling to launch from encrypted AMIs across accounts.

Standardize secrets rotation and cross-account access

Action: Store database and API credentials in Secrets Manager. Implement Lambda rotation for non-RDS targets and enable built-in rotation for RDS. For shared platform secrets, attach resource-based policies granting GetSecretValue to consumer roles in other accounts and ensure CMK policies allow decrypt. Place rotation Lambdas in VPCs with necessary endpoints.
Why: Automated rotation reduces credential risk; resource policies with KMS alignment enable secure cross-account consumption while preserving least privilege and audit trails.

This architecture gives Expedia Group enforceable guardrails, provable compliance, automated fixes, and tightly controlled data access paths, all while preserving developer velocity through safe self-service and private connectivity.

← Monitoring · All domains · Containers and Serverless Operations →

Practice these questions → · Timed practice on ExamRoll.io →