Skip to main content
Welcome. This lesson covers a curated set of AWS services commonly used for governance, security, and regulatory compliance. We start with the AWS Shared Responsibility Model and then review services that help you secure resources, monitor activity, collect audit evidence, and demonstrate compliance. This is a practical, non-exhaustive guide emphasizing services you’ll commonly encounter when designing compliant solutions on AWS. Overview
  • Shared Responsibility: clarifies what AWS manages (cloud infrastructure) vs. what customers manage (guest OS, application, data, configuration).
  • Governance & compliance services in this guide: services for evidence collection, continuous monitoring, access controls, vulnerability scanning, data management, and model explainability.
Quick Reference — Services at a glance Shared Responsibility
  • The AWS Shared Responsibility Model defines which security and compliance controls AWS is responsible for and which ones the customer must manage.
  • Practical rule of thumb: if you can configure or log in to a resource, you are responsible for securing and patching it; if you cannot, AWS usually handles it.
  • AWS provides many management and monitoring tools to help you fulfill your responsibilities, but customers must configure and operate those tools correctly.
AWS Artifact — Compliance Reports and Attestations
  • AWS Artifact is available in every AWS account and provides direct access to AWS third‑party compliance reports and regulatory attestations, such as PCI DSS and ISO/IEC 27001.
  • Use Artifact to supply auditors with AWS-provided evidence and reduce the audit scope that focuses on AWS-managed controls.
Data Profiling and Preparation (DataBrew / SageMaker Data Wrangler / Jupyter)
  • For regulatory work you often need to inspect the data itself: search for PII, measure completeness, or identify anomalies. Tools include AWS Glue DataBrew, SageMaker Data Wrangler, and custom Jupyter notebooks (pandas, scikit-learn, seaborn).
  • These tools support data profiling, visualization, and cleansing—key activities before applying governance controls or producing evidence.
A presentation slide for "AWS Glue DataBrew — Data Preparation for Governance" highlighting "Visual data preparation and profiling." The right side shows a DataBrew UI screenshot with dataset columns, data quality metrics, and bar charts.
When preparing datasets for compliance reviews, capture profiling outputs (counts, null rates, histograms) as artifacts. These visuals help demonstrate data quality and lineage to auditors.
Fine-Grained Data Access: AWS Lake Formation
  • Lake Formation provides centralized, fine-grained access control on top of S3-backed data lakes. It supports permissions at database, table, column, and row levels (including row-level filtering).
  • This level of granularity enables least-privilege access patterns required for sensitive analytical workloads and simplifies access management across analytics services.
A schematic titled "AWS Lake Formation – Fine-Grained Data Access Control" showing a datalake divided into a Public Zone (Bronze, Silver, Gold) and a Private Zone (Sensitive, Staging Area). Arrows show an internal user's open vs. restricted access and a SaaS data provider ingesting into the staging area.
S3 Storage Classes and Lifecycle Rules — Data Management for Compliance
  • Use S3 storage classes and lifecycle policies for cost-effective retention and to meet regulatory retention requirements. Transition objects between classes based on access patterns and apply Object Lock to enforce immutability for evidence retention.
  • Lifecycle rules and object lock are commonly used as part of an organizational retention policy to ensure data cannot be modified or deleted during a legal or compliance retention period.
A presentation slide titled "Amazon S3 – Data Management for Compliance and Cost Optimization" showing two key points: multiple storage classes and lifecycle rules, and cost-effective data management based on access frequency. The right side features a diagram of S3 storage classes and Glacier retrieval/archival tiers and transitions.
Example: S3 lifecycle rule (archive after 365 days)
Model Explainability and Monitoring: SageMaker Clarify
  • SageMaker Clarify helps analyze training data and model predictions for bias and provides feature importance and explainability artifacts.
  • Combine Clarify with SageMaker Model Monitor to detect data drift or model performance degradation at runtime and produce monitoring artifacts that auditors or compliance reviewers can evaluate.
Continuous Configuration Monitoring: AWS Config
  • AWS Config records resource configurations and changes over time and evaluates resource states against managed or custom rules.
  • Use Config to detect drift from your intended state (for example, public security groups) and trigger automated remediation workflows (Lambda, Systems Manager) where appropriate.
  • Example use case: enforce a rule to prohibit EC2 security groups with 0.0.0.0/0 SSH access and create a remediation action to lock it down.
A slide titled "AWS Config — Continuous Monitoring for Compliance" showing a flow diagram of AWS Config functions (Record/Normalize, Manage, Evaluate, Simplify). The diagram also lists use cases on the right: operational troubleshooting, compliance and auditing, change management, and security monitoring.
Vulnerability Scanning: Amazon Inspector
  • Amazon Inspector automates security assessments for EC2 instances, container images, and Lambda functions. It identifies common vulnerabilities and exposures (CVEs) and security misconfigurations.
  • Inspector reports and findings can feed into your incident and remediation processes to reduce exposure for AI model runtime environments (e.g., containerized inference).
Slide titled "Amazon Inspector – Security and Compliance Assessments" with two panels highlighting automated security assessments and vulnerability identification. To the right is a dashboard screenshot showing donut and bar charts visualizing vulnerability counts and severities.
Audit Evidence Collection: AWS Audit Manager
  • AWS Audit Manager automates evidence collection and organizes artifacts to support assessments against specific frameworks. It streamlines evidence gathering (from CloudTrail, Config, Inspector, and other services) so you can produce audit-ready reports faster.
  • Note: Audit Manager collects and organizes evidence; it does not itself certify compliance. Use it to centralize artifacts and reduce manual collection effort during audits.
A presentation slide titled "AWS Audit Manager — Streamlined Compliance Auditing" showing a screenshot of the AWS Audit Manager Framework library dashboard. Left-side callouts highlight features like simplifying compliance management and automating evidence collection for audits.
API Activity and Forensics: AWS CloudTrail
  • AWS CloudTrail records control-plane API calls made in your account (console, SDKs, CLI, and many AWS services). It’s essential for forensic investigations, change tracking, and compliance reporting.
  • CloudTrail does not capture in-guest OS activity or direct database queries—use host-based logging and database auditing in addition to CloudTrail.
  • Best practice: enable CloudTrail for all accounts and deliver logs to a centralized, access-controlled, and immutable S3 bucket (optionally with AWS Lake Formation or AWS Organizations policies to centralize access).
Enable CloudTrail for every account and send logs to a centralized, access-controlled S3 bucket. Centralized CloudTrail logs are a non-negotiable best practice for enterprise auditing and incident response.
Example: enable an organization trail (CLI)
A screenshot of the AWS CloudTrail console titled "Comprehensive Activity Logging." It shows the Event history view with a filtered list of recent management events (e.g., PutEvaluations, ConsoleLogin) including timestamps, user names, and event sources.
Best-Practice Recommendations: AWS Trusted Advisor
  • AWS Trusted Advisor runs checks across security, cost, performance, fault tolerance, and service limits. It helps identify misconfigurations, underutilized resources, and potential quota constraints.
  • Full set of checks requires Business or Enterprise support plans; however, many critical security and cost checks are available to lower support tiers as well.
A slide showing a screenshot of the AWS Trusted Advisor recommendations dashboard with check summaries (action recommended, investigation recommended, excluded checks) and a reported potential monthly savings. The slide title reads "AWS Trusted Advisor — Best Practices and Compliance Recommendations."
Practical examples and snippets
  • S3 Object Lock: enable when creating a bucket or set via bucket-level configuration to retain objects immutably for a legal hold or retention period.
  • AWS Config: use managed rules like restricted-common-ports to detect open ports and tie remediation actions to Systems Manager documents or Lambda.
  • Audit evidence: configure CloudTrail, Config, Inspector, and GuardDuty to forward findings into Audit Manager or an evidence store for consolidated reporting.
Closing notes
  • This lesson covered a practical set of AWS services used for governance and compliance: AWS Artifact; DataBrew/Data Wrangler/Jupyter for profiling; Lake Formation for fine-grained access; S3 lifecycle and Object Lock for retention and immutability; SageMaker Clarify and Model Monitor for model explainability and drift detection; AWS Config for continuous compliance; Amazon Inspector for vulnerability scanning; Audit Manager for evidence collection; CloudTrail for activity logging; and Trusted Advisor for best-practice recommendations.
  • These services form a practical starting point. For production-ready compliance, combine them with organizational policies, automation (IaC), centralized logging, and regular audits. Consult AWS documentation and hands-on labs to implement controls specific to your regulatory requirements.
Links and references

Watch Video