Security, compliance, and governance
AWS Services for Governance and Compliance
| Service | What it does | Pick it when the question says... |
|---|---|---|
| AWS Config | Records resource configurations and their history, detects misconfigurations | "Track configuration changes", "show historical configuration for an audit" |
| Amazon Inspector | Continuously scans for software vulnerabilities (CVEs) and unintended network exposure in EC2, container images, and Lambda, with risk scores from the NVD | "Find vulnerabilities" |
| AWS Audit Manager | Automates evidence collection to assess whether controls work, and manages audit reviews | "Continuously audit", "collect evidence" |
| AWS Artifact | On-demand downloads of AWS compliance reports (ISO, PCI, SOC) and ISV reports from AWS Marketplace | "Download compliance reports for auditors", "due diligence on Marketplace vendors" |
| AWS CloudTrail | Logs API activity: who did what, to which resource, and when | "Who made this change?", "audit account activity" |
| AWS Trusted Advisor | Best-practice checks for cost, performance, resilience, security, operational excellence, and service limits | "Recommendations to optimize and secure the account" |
Easy to mix up
- Config tracks resource state. CloudTrail tracks user and API actions.
- Artifact gives you reports. Audit Manager helps you run your own audits.
- Inspector finds vulnerabilities. GuardDuty finds threats (see the security lessons).