Security, Identity, and Compliance
Security is the largest topic on the CLF-C02 exam, worth about 30% of your score. This chapter explains the AWS shared responsibility model, how AWS Identity and Access Management (IAM) controls who can do what, and the many services AWS provides for protection, detection, and compliance. You will also learn core practices such as least privilege, multi-factor authentication, and encryption in transit and at rest, along with how AWS demonstrates compliance to auditors.
The shared responsibility model
Security in AWS is a partnership defined by the shared responsibility model, one of the most heavily tested ideas on the exam. AWS is responsible for security OF the cloud, and the customer is responsible for security IN the cloud. Security of the cloud means the infrastructure that runs all AWS services: the physical data centers and their access controls, the hardware, the host operating system and virtualization layer, and the networking that connects it all. Customers never touch these, and AWS proves it manages them well through third-party audits and compliance certifications. Security in the cloud means everything the customer places into or configures on top of AWS services: their data, how that data is classified and encrypted, identity and access management, application code, operating-system and firewall configuration on the resources they control, and network traffic protection. A memorable summary is that the customer is responsible for whatever they can configure. The crucial nuance is that the exact dividing line shifts depending on the service model. With an unmanaged service like Amazon EC2, the customer must patch the guest operating system, configure the firewall through security groups, and manage applications, so more responsibility sits with them. With a managed service such as Amazon RDS, AWS handles the operating-system patching and database engine maintenance, but the customer still controls network access rules, account permissions, and data encryption settings. With a fully managed, serverless service like Amazon S3 or AWS Lambda, AWS manages even more of the stack, yet the customer is always responsible for their own data, for who is allowed to access it, and for correct access-control configuration. Two responsibilities never leave the customer regardless of service: managing their data and managing who can access it. On the exam, when a scenario describes patching a guest OS, configuring security-group rules, or setting IAM permissions, that is the customer's job; when it describes physical security, hardware disposal, or maintaining the hypervisor, that is AWS's job. Reading the responsibility split correctly is worth several questions.
AWS Identity and Access Management (IAM)
AWS Identity and Access Management (IAM) controls authentication (who you are) and authorization (what you are allowed to do), and it is offered at no additional charge. Every AWS account begins with a root user, created from the email address used to open the account. The root user has complete, unrestricted access to everything, including billing and account closure, which makes it dangerous. AWS strongly recommends you secure the root user with multi-factor authentication, use it only for the few tasks that truly require it, and then create individual IAM identities for everyday work. The building blocks of IAM are users, groups, roles, and policies. An IAM user is a persistent identity for one person or application, with its own credentials. An IAM group is a collection of users that makes it easy to assign the same permissions to many people at once; you attach a policy to the group and every member inherits it. An IAM role is an identity with permissions that can be assumed temporarily by a trusted entity, providing short-lived credentials that expire automatically rather than long-term access keys. Roles are the preferred way to grant permissions to applications running on EC2, to AWS services acting on your behalf, and to users federated from an external identity provider, because there are no static secrets to leak or rotate. Permissions themselves are defined by policies, which are JSON documents listing which actions are allowed or denied on which resources under which conditions. A foundational best practice, and a pillar of the security domain, is least privilege: grant only the permissions required to perform a task and no more, so the damage from a compromised or misused credential is contained. By default, IAM denies everything, and an explicit deny always overrides any allow. For organizations that manage many accounts, AWS IAM Identity Center provides centralized single sign-on. On the exam, remember that roles beat long-term keys, groups simplify user management, policies are JSON, and least privilege is the governing principle. Protecting the root user and enabling MFA are the first things AWS wants you to do in any new account.
Protecting the account and credentials
Strong account hygiene is the foundation of AWS security, and the exam expects familiarity with the specific practices AWS recommends. The starting point is the root user. Because it can do anything in the account, you should enable multi-factor authentication on it immediately, avoid creating access keys for it, and lock it away for the rare tasks that genuinely require root, such as changing the account's support plan or closing the account. All routine administration should be done through IAM identities with scoped permissions. Multi-factor authentication (MFA) adds a second verification factor on top of a password, typically a time-based code from an authenticator app, a hardware security key, or a hardware token device. With MFA enabled, a stolen or guessed password is no longer enough to sign in, which dramatically reduces the risk of account takeover; AWS recommends MFA for the root user and for all privileged IAM users. Credential management extends beyond passwords. Access keys used by applications should be rotated regularly, never shared, and never hard-coded into source code or committed to a repository, because leaked keys are a leading cause of compromise. Wherever possible, use IAM roles instead of long-term access keys so credentials are temporary and rotate automatically. When applications genuinely need to store secrets such as database passwords or third-party API keys, AWS Secrets Manager can store them encrypted and rotate them automatically on a schedule, removing secrets from application code entirely; AWS Systems Manager Parameter Store offers a simpler option for configuration data and secrets. You can also enforce an IAM password policy that requires minimum length, complexity, and periodic rotation across the account. IAM Access Analyzer helps identify resources shared with external entities so you can catch unintended access. Bringing this together, the exam's model account has MFA on the root user, day-to-day work performed by least-privilege IAM users and roles, no hard-coded secrets, automatically rotated credentials, and secrets held in a dedicated service. When a question asks how to protect a compromised or overly powerful credential, the answers involve MFA, roles over keys, rotation, and least privilege.
Detection, monitoring, and network protection
AWS provides a family of services to log activity, detect threats, and filter malicious traffic, and the exam expects you to match each service to its purpose. For auditing and visibility, AWS CloudTrail records API calls and account activity across your AWS account, producing an audit trail of who did what and when, which is essential for security investigations and compliance. AWS Config records and evaluates the configuration of your resources over time, letting you see how a resource was set up historically and flag configurations that drift from desired rules. Amazon CloudWatch is the monitoring and observability service, collecting metrics, logs, and alarms so you can watch performance and be alerted to anomalies; while primarily operational, it supports security by alerting on unusual behavior. For threat detection, Amazon GuardDuty continuously analyzes logs such as CloudTrail, VPC Flow Logs, and DNS logs using machine learning to detect malicious or unauthorized activity without you deploying any agents. Amazon Inspector automatically scans workloads such as EC2 instances and container images for software vulnerabilities and unintended network exposure. Amazon Macie uses machine learning to discover, classify, and protect sensitive data such as personally identifiable information stored in Amazon S3. For centralized visibility, AWS Security Hub aggregates and prioritizes findings from GuardDuty, Inspector, Macie, and other tools into a single dashboard, while Amazon Detective helps analyze and investigate the root cause of findings. On the network side, AWS shields applications from attack. AWS Shield provides protection against distributed denial-of-service (DDoS) attacks, with Shield Standard included automatically and Shield Advanced offering enhanced protection. AWS WAF, the web application firewall, filters HTTP and HTTPS requests to block common exploits such as SQL injection and cross-site scripting. AWS Firewall Manager centrally manages firewall rules across accounts. Within a VPC, two firewalls control traffic: security groups act as stateful firewalls at the instance level and support only allow rules, while network access control lists (NACLs) act as stateless firewalls at the subnet level and support both allow and deny rules. Knowing which service detects, which audits, and which filters, plus the stateful-versus-stateless firewall distinction, answers many security questions.
Encryption, compliance, and governance
Protecting data and demonstrating compliance are essential parts of the security domain. Encryption comes in two forms you must distinguish. Encryption at rest protects stored data so that even if the underlying media is accessed the data is unreadable without the key; AWS Key Management Service (KMS) creates and controls the cryptographic keys and integrates with services such as Amazon S3, Amazon EBS, and Amazon RDS to encrypt data with a few clicks. AWS CloudHSM offers a dedicated hardware security module for customers with strict key-custody requirements. Encryption in transit protects data as it moves across networks, using Transport Layer Security (TLS) so data cannot be read if intercepted; AWS Certificate Manager (ACM) provisions and manages the TLS certificates that enable HTTPS. Many services, including S3, encrypt data at rest by default, and enabling encryption is a customer responsibility under the shared responsibility model. On the compliance side, AWS maintains a large portfolio of certifications and attestations such as SOC 1, SOC 2, ISO 27001, PCI DSS, HIPAA eligibility, and FedRAMP. AWS Artifact is the self-service portal that provides on-demand access to these compliance reports and agreements so customers can share them with their own auditors. Because AWS certifies the infrastructure, customers inherit those controls for the parts AWS manages, but they remain responsible for compliance of what they build on top. For governance across many accounts, AWS Organizations lets a business centrally manage multiple accounts under a single management account, consolidate billing, and apply service control policies (SCPs) that set permission guardrails limiting what member accounts can do regardless of their IAM policies. AWS Control Tower builds on Organizations to set up and govern a secure multi-account environment using best-practice blueprints and guardrails. For security guidance and incident notifications, AWS Trusted Advisor checks accounts against best practices including security, and the AWS Health Dashboard communicates events affecting your resources. On the exam, associate KMS with keys and encryption at rest, ACM and TLS with encryption in transit, Artifact with downloadable compliance reports, and Organizations with SCPs and consolidated governance.
Last updated: September 2026
Practice stays free. The full AWS Certified Cloud Practitioner (CLF-C02) study guide is the material itself, taught start to finish — a downloadable PDF + EPUB you keep.