Security, Governance, and Compliance Concepts
Understand AWS Cloud security, governance, and compliance concepts
What you will learn
- Distinguish governance from compliance as related but different concepts.
- Explain the defense-in-depth principle and its multiple layers.
- Connect CloudTrail's job (who did what) with Config's job (is the configuration compliant).
- Explain the importance of data classification as the basis for any security policy.
Governance and compliance are often confused because they always appear together, but they are different concepts: governance is the internal policies and procedures an organization sets for itself to manage its own risk, while compliance is meeting binding external requirements imposed by a regulator or an industry standard.
Governance vs. compliance
| Governance | Compliance | |
|---|---|---|
| Source | Internal decisions the organization sets for itself | Binding external requirements (legal or standard-based) |
| Example | An internal policy requiring approval before opening any public port | The mandatory PCI DSS standard for handling payment card data |
The defense-in-depth layers
No reliance on a single protective layer — one layer failing doesn't mean the whole system is breached.
Network layer
Security Groups and NACLs
Host layer
OS patches and intrusion protection
Application layer
WAF and input validation
Data layer
Encryption and fine-grained access control
How CloudTrail and Config work together
A security group's settings change to allow an insecure public port. AWS Config detects the resource no longer complies with a "no unnecessary public ports" rule and alerts on it. CloudTrail directly answers the next question: who changed this setting, when, and from which IP address — together they give the full picture: what happened, and who did it.
What matters on the exam
- Quick rule: CloudTrail = "who did what" (an event log), Config = "is the current configuration compliant" (a state compared against a rule).
- Data classification (sensitive, public, confidential...) is logically the first step before any protection decision — you cannot protect something whose sensitivity level was never determined.
Governance logically precedes compliance
An organization with strong governance (clear internal policies, periodic review) finds complying with an external standard much easier — because internal discipline often already covers a large share of the external requirements.
Quick check
Answer in your head first, then reveal.
What is the difference between governance and compliance?Reveal the answer
Governance is internal policy the organization sets; compliance is binding external requirements.
Which tool answers "who changed this setting and when"?Reveal the answer
AWS CloudTrail.
Why does any security decision start with data classification?Reveal the answer
Because the required protection level depends on data sensitivity, which cannot be determined without classifying it first.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.