6.3 - Evaluating resource compliance (Config, Security Hub, Audit Manager, Artifact)
AWS Certified Security Specialty objective 6.3 covers proving that resources match the rules. AWS Config records a configuration history, so it tells you exactly what a security group looked like at two in the morning, and it evaluates rules that are change triggered or periodic, the periodic trigger being the one that fits a check such as access keys rotated every ninety days. Conformance packs ship rules and their remediations as one versioned artifact across the organization, an automatic remediation runs an SSM Automation document whose role must hold the permissions, a rule reporting no evaluations in a Region usually means the recorder is off or that resource type is not recorded, and an aggregator missing accounts means an authorization step was skipped. Security Hub does something different: it aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer and any third party that emits the AWS Security Finding Format, scores them against standards such as CIS and Foundational Security Best Practices, supports central configuration for current and future accounts, cross-Region aggregation, EventBridge routing to a ticketing system, and suppression that differs from archiving a record. Audit Manager collects evidence continuously against control sets, and AWS Artifact delivers SOC reports and the business associate addendum. Expect compliance tooling scenarios.
Config evaluates configuration compliance and keeps history, Security Hub only aggregates and scores findings. Rule shows no evaluations in one Region = the configuration recorder or that resource type is not recorded there. Who made the bucket public and when did it stop being compliant = CloudTrail for who, Config for when.
Practice questions
1. An auditor asks which service continuously evaluates whether resource configurations comply with defined rules and keeps a history of their changes.
- Amazon CloudWatch
- AWS CloudTrail, which stores every API call made in the account and derives from that log the current configuration of each resource
- AWS Config (correct answer)
- Amazon Inspector
Config records the configuration of each supported resource, keeps a timeline of every change and evaluates rules against it. CloudWatch handles metrics and logs, CloudTrail records who called what but does not maintain a configuration state or evaluate compliance, and Inspector looks for software vulnerabilities.
2. A CISO wants a single console showing findings produced by GuardDuty, Inspector, Macie and IAM Access Analyzer across every account. Which service does this?
- AWS Security Hub (correct answer)
- AWS Config, which normalizes the findings of those services into configuration items and presents them on a single compliance dashboard for the organization
- Amazon Detective
- AWS Audit Manager
Security Hub is the aggregator: it ingests findings from other services in a common format and shows them centrally. Config evaluates configuration compliance and does not ingest findings from security services, Detective builds investigation graphs from a small set of sources, and Audit Manager collects evidence for audit frameworks.
3. A team must deploy the same set of Config rules and their remediations to every account of an organization, as one versioned package. What should they use?
- A Security Hub security standard
- An IAM permissions boundary carrying the compliance requirements, applied to every role so that non compliant configurations become impossible to create in the first place
- An Audit Manager assessment
- A Config conformance pack deployed organization wide (correct answer)
A conformance pack bundles Config rules and remediation actions in a single template that can be deployed across the whole organization and versioned like code. A Security Hub standard is a fixed set of controls you enable rather than a package you author, a permissions boundary caps identities and expresses no configuration rule, and an Audit Manager assessment collects evidence without deploying any rule.
4. A Config rule detects security groups open to the world on port 22 and must close them without human action. How is this implemented?
- By enabling automatic remediation in the Security Hub standard that owns the equivalent control
- By attaching an SCP that denies the ec2:AuthorizeSecurityGroupIngress call whenever the requested source range is 0.0.0.0/0 on any port
- By attaching a Systems Manager Automation remediation action to the rule (correct answer)
- By exporting the Config findings to Athena and querying them daily
Config remediation runs a Systems Manager Automation document against the non compliant resource, either on demand or automatically. Security Hub standards have no remediation engine of their own, an SCP prevents a future call but does nothing about the rules already in place, and an Athena query only reports.
5. An organization must produce, for a PCI DSS audit, evidence collected continuously and mapped to each control of the framework. Which service is intended for this?
- AWS Artifact
- AWS Audit Manager (correct answer)
- AWS Config, by exporting the compliance state of every rule to a bucket and letting the auditor rebuild the control mapping from the exported snapshots
- Amazon Macie
Audit Manager runs an assessment against a framework, collects evidence automatically from CloudTrail, Config and Security Hub, and files it under the matching control. Artifact only supplies AWS own audit reports, a manual Config export leaves the mapping work undone, and Macie is about discovering sensitive data in S3.
6. A customer asks for the SOC 2 Type II report covering the AWS services they consume. Where is it obtained?
- From Security Hub, in the compliance standards section
- From an Audit Manager assessment report generated against the SOC 2 framework, once every automated evidence collector has completed a full quarterly cycle
- By opening a support case with the AWS account team
- In AWS Artifact (correct answer)
Artifact is the self service portal for AWS audit reports and agreements, downloadable on demand under a confidentiality agreement. Security Hub reports on your own posture, Audit Manager documents your workloads and never produces the AWS attestation itself, and no support case is needed.