Skip to main content
Welcome. This article summarizes Domain 6: Security and Compliance — a focused yet broad area of the AWS Certified DevOps Engineer Professional exam. It covers identity and access at scale, encryption, secrets management, threat detection, compliance automation, and logging/audit practices. Domain 6 at a glance
  • Weight: ~17% of the exam
  • Focus: IAM at scale, encryption strategies, threat detection, and compliance automation
  • Core themes: identity, encryption, detection, and compliance — the four pillars of AWS security
Most questions map to a small set of services you should prioritize: AWS Organizations (Service Control Policies), AWS KMS, Secrets Manager / Systems Manager Parameter Store, GuardDuty, Inspector, Macie, Detective, Security Hub, and AWS Config. The remainder are supporting services for network security, logging, and remediation. Service control policies (SCPs) and IAM at scale
  • Use AWS Organizations and SCPs to establish centralized guardrails across multiple accounts.
  • Important distinction: SCPs do not grant permissions. They define the maximum allowed actions for principals in an account; IAM policies within accounts still must explicitly grant permissions.
  • Effective permission evaluation includes all applicable policies: SCPs, permission boundaries, identity policies, resource policies, and session policies. An explicit Deny anywhere overrides Allows, and actions must be explicitly allowed somewhere to succeed.
  • For cross-account access, prefer IAM roles with well-formed trust policies and fine-grained permission policies in the target account. AWS IAM Identity Center (previously AWS SSO) can simplify centralized assignment and access management.
  • When third parties or other AWS accounts assume roles, require an external ID in the role’s trust policy to mitigate the confused deputy problem.
A presentation slide titled "Cross-Account Access Patterns" that lists four numbered items: IAM Roles for Cross-Account Access, Trust Policy Configuration, Permission Policy Assignment, and External ID Protection, each with a brief description. The slide is copyrighted by KodeKloud.
SCPs restrict the maximum permissions in an account — they never grant access on their own. Always design SCPs to be least-privilege guardrails while configuring IAM policies inside accounts to explicitly grant required permissions.
Key Management Service (KMS) KMS is AWS’s managed key service backed by hardware security modules (HSMs). For customers that require dedicated HSM appliances, consider AWS CloudHSM. KMS concepts and best practices:
  • Key types:
    • AWS-owned keys — fully managed by AWS and not exposed to your account.
    • AWS-managed keys — created and managed by AWS for use by specific services.
    • Customer-managed keys (CMKs) — created in your account; you control key policies, grants, rotation, and usage.
  • Envelope encryption: use a data key (symmetric) to encrypt data, then encrypt (wrap) that data key using a KMS CMK. KMS can generate data keys and return both plaintext and encrypted versions to enable secure client-side encryption without exposing the CMK.
  • Rotation:
    • Customer-managed symmetric CMKs support automatic rotation (annual option).
    • Asymmetric CMKs do not support automatic rotation.
  • Access control: key policies and grants determine who can use or manage CMKs. Be deliberate with key policy design to avoid unintentional access gaps.
KMS quick reference table
A presentation slide titled "AWS KMS – Encryption at Scale" showing four feature cards: Customer Master Keys, Access Control Model, Envelope Encryption, and Automatic Key Rotation, each with a colored icon. The cards are arranged in a two-by-two grid on a white background.
Secrets management: Secrets Manager vs Systems Manager Parameter Store Understanding trade-offs between AWS Secrets Manager and Systems Manager Parameter Store helps you choose the right tool for secrets and configuration management. Comparison highlights:
  • AWS Secrets Manager
    • Per-secret pricing
    • Built-in automatic rotation for supported targets (for example, RDS credentials)
    • Rich lifecycle management, audit logging, and native rotation integrations
  • Systems Manager Parameter Store
    • Standard (free tier) and Advanced parameters (additional cost)
    • Supports SecureString parameters encrypted with KMS
    • No native automatic secret rotation — rotation must be custom or external
    • Good fit for configuration values and simpler secrets where rotation is not required or is handled externally
If an exam question explicitly requires automatic rotation of database credentials, Secrets Manager is typically the correct service to choose.
A slide comparing AWS Secrets Manager and AWS Systems Manager Parameter Store with side-by-side numbered points about rotation, pricing, best-use cases, and integrations. The left column highlights automatic rotation, per-secret pricing, and native database integrations, while the right notes manual rotation, a free tier for standard parameters, and broad AWS service integration.
Threat detection and vulnerability tools Use a mix of agentless and agent-based services to detect threats, vulnerabilities, and sensitive data exposure. Service overviews:
A slide titled "Threat Detection Services" displaying three red icons labeled Amazon GuardDuty, Amazon Inspector, and Amazon Macie. Each icon represents a different AWS security/service offering.
A slide titled "AWS Security Hub" showing a vertical timeline for "Centralized Security Posture Management" with numbered nodes linking to features such as Aggregate Findings, Security Standards, Automated Response, and Cross-Account View.
Compliance, configuration tracking, and remediation
  • AWS Config records resource configurations and relationships over time, creating a historical inventory.
  • Key features:
    • AWS Managed Rules and the ability to author custom rules
    • Conformance packs: bundles of rules and remediation related to a compliance framework
    • AWS Config Aggregator: collect Config data across accounts and regions for centralized auditing
  • AWS Config is primarily an auditing and compliance tool. It can trigger automated remediation workflows, but you must wire up the remediation (for example, via Systems Manager Automation, Lambda, or EventBridge) to enforce changes.
A presentation slide titled "AWS Config for Compliance" showing four feature cards: AWS Managed Rules, Auto-Remediation, Conformance Packs, and Aggregator with brief descriptions. The slide is branded © KodeKloud.
Network defense-in-depth Think in layers — each layer protects against different threat vectors:
  • Security Groups: stateful, instance-level firewall
  • Network ACLs: stateless, subnet-level controls
  • AWS WAF: application-layer protection (HTTP/S)
  • AWS Shield: DDoS protection
    • Shield Standard — enabled by default at no charge
    • Shield Advanced — paid, adds DDoS cost protection and 24/7 DRT support
A presentation slide titled "Network Security Layers" showing "Defense in Depth for AWS Networks." It lists four numbered components: Security Groups, Network ACLs, AWS WAF, and AWS Shield.
Logging and audit trails
  • AWS CloudTrail
    • Tracks management events and optional data events (for example, S3 object-level events and Lambda invocation records)
    • Supports log file integrity validation for tamper detection
  • Amazon CloudWatch
    • Metrics, logs, and alarms for operational monitoring
  • Combine CloudTrail + CloudWatch + AWS Config to build a robust logging, monitoring, and compliance posture
Final exam checklist (high-level)
  • Organizations + SCPs for centralized guardrails and account-level restrictions
  • IAM cross-account roles, trust policies, and using an external ID to mitigate confused deputy issues
  • KMS: understand AWS-owned, AWS-managed, and customer-managed keys; envelope encryption; and key rotation rules
  • Secrets Manager vs Parameter Store: rotation, pricing, and when to pick each service
  • Threat detection services and their data sources:
    • GuardDuty — VPC Flow Logs, DNS, CloudTrail
    • Inspector — vulnerability assessments (EC2, ECR, Lambda)
    • Macie — S3-sensitive data discovery
    • Detective — investigation and timelines
  • Security Hub — centralized aggregation, standards, and automated response via EventBridge
  • AWS Config — inventory, managed/custom rules, conformance packs, aggregators for multi-account compliance
  • CloudTrail + CloudWatch + Config form the core logging/audit framework
  • Network defense-in-depth: Security Groups → NACLs → WAF → Shield
Exam tip: For centralized guardrails think AWS Organizations + SCPs. For automatic credential rotation think AWS Secrets Manager. For data-key wrapping think envelope encryption with AWS KMS.
References and further reading That covers a concise, exam-focused summary of Domain 6. If any section needs expansion, consult the linked official AWS documentation for the latest service details and best practices.

Watch Video