AWS Services for Governance and Compliance
AWS Governance and Compliance
AWS takes a proactive and collaborative approach to governance and compliance when it comes to AI and generative AI workflows. AWS works closely with regulators, customers, and other stakeholders to ensure these technologies are used responsibly and in alignment with relevant laws and regulations.
AWS has many services and features to assist with governance and regulation compliance. The following is a brief description of some of the key services.
AWS Config
AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.
When you run your applications on AWS, you usually use AWS resources, which you must create and manage collectively. As the demand for your application keeps growing, so does your need to keep track of your AWS resources. The following are some scenarios where AWS Config can help you oversee your application resources:
- Resource administration: Exercise governance over your resource configurations and detect resource misconfigurations.
- Auditing and compliance: You might work with data that requires frequent audits to ensure compliance with internal policies and best practices. AWS Config helps you demonstrate compliance by providing access to the historical configurations of your resources.
- Managing and troubleshooting configuration changes: You can view how any resource you intend to modify is related to other resources and assess the impact of your change.
Amazon Inspector
Amazon Inspector is a vulnerability management service that continuously scans your AWS workloads for software vulnerabilities and unintended network exposure.
Amazon Inspector automatically discovers and scans running AWS resources for known software vulnerabilities and unintended network exposure. Some of these resources include Amazon Elastic Compute Cloud (Amazon EC2) instances, container images, and Lambda functions. Amazon Inspector creates a finding when it discovers a software vulnerability or network configuration issue.
Some examples of these vulnerabilities include the following:
- Package vulnerability: There are software packages in your AWS environment that are exposed to common vulnerabilities and exposures (CVEs).
- Code vulnerability: There are lines in your code that attackers could exploit. Other vulnerabilities include data leaks, weak cryptography, and missing encryption.
- Network reachability: There are open network paths to Amazon EC2 instances in your environment.
Some features of Amazon Inspector include the following:
- Continuously scan your environment for vulnerabilities and network exposure.
- Assess vulnerabilities accurately and provide a risk score.
- Identify high-impact findings.
- Monitor and process findings with other services and systems.
Note: The risk score is based on security metrics from the National Vulnerability Database (NVD) and is adjusted according to your compute environment.
AWS Audit Manager
AWS Audit Manager helps you continually audit your AWS usage to streamline how you manage risk and compliance with regulations and industry standards.
Audit Manager automates evidence collection so you can conveniently assess whether your policies, procedures, and activities (also known as controls) are operating effectively. When it's time for an audit, Audit Manager helps you manage stakeholder reviews of your controls.
Some tasks you can perform with Audit Manager include the following:
- Upload and manage evidence from hybrid or multi-cloud environments.
- Support common compliance standards and regulations.
- Monitor your active assessments.
- Search for evidence.
- Ensure evidence integrity.
AWS Artifact
AWS Artifact provides on-demand downloads of AWS security and compliance documents, such as AWS ISO certifications, PCI reports, and SOC Reports.
You can submit the security and compliance documents to your auditors or regulators to demonstrate the security and compliance of your AWS infrastructure.
AWS customers are responsible for developing or obtaining documents that demonstrate the security and compliance of their companies. You will learn more about the responsibilities of customers in a later lesson about the Shared Responsibility Model.
AWS CloudTrail
AWS CloudTrail helps you perform operational and risk auditing, governance, and compliance of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface (AWS CLI), and AWS SDKs and APIs.
Visibility into your AWS account activity is a key aspect of security and operational best practices. You can use CloudTrail to view, search, download, archive, analyze, and respond to account activity across your AWS infrastructure. You can identify who took which action, which resources were acted upon, and when the event occurred. These and other details can help you analyze and respond to activity in your AWS account.
AWS Trusted Advisor
AWS Trusted Advisor helps you optimize costs, increase performance, improve security and resilience, and operate at scale in the cloud.
Trusted Advisor continuously evaluates your AWS environment using best practice checks across the categories of cost optimization, performance, resilience, security, operational excellence, and service limits. It then recommends actions to remediate any deviations from best practices.
Use cases for Trusted Advisor include:
- Optimizing cost and efficiency
- Assessing your AWS environment against security standards and best practices
- Improving performance
- Improving resilience
Resources for further learning
You can learn more about the AWS services that are used for governance and compliance by visiting the AWS webpage for each of these services.
AWS Config
To learn more about AWS Config, choose the following link.
Webpage
Amazon Inspector
To learn more about Amazon Inspector, choose the following link.
Webpage
AWS Audit Manager
To learn more about AWS Audit Manager, choose the following link.
Webpage
AWS Artifact
To learn more about AWS Artifact, choose the following link.
Webpage
AWS CloudTrail
To learn more about AWS CloudTrail, choose the following link.
Webpage
AWS Trusted Advisor
To learn more about AWS Trusted Advisor, choose the following link.
Webpage
Next, you will learn about data governance strategies.