Prove Security and Compliance

Situation and constraints

Meridian Payments is preparing for an audit. Its compliance lead needs AWS reports about the cloud infrastructure, its security team needs evidence of actions and configuration changes in the company account, and its application team must protect customer data. One manager proposes downloading an AWS certification report and treating the work as finished.

That would confuse AWS evidence with Meridian's own evidence. AWS can demonstrate that controls for the infrastructure it operates have been assessed. Meridian must still show how it configured its resources, who changed them, how it protected data, and how it responded to suspicious activity. Compliance in the cloud remains a shared responsibility.

The company needs a small set of distinct answers rather than one imaginary “compliance service”:

• Where can an auditor obtain AWS compliance reports and agreements?
• How is sensitive data protected while stored and while moving?
• Which service records an API action by a user, role, or AWS service?
• Which service records how a resource was configured over time?
• Which service detects suspicious activity, and which service brings security findings together?

At Cloud Practitioner depth, the learner should recognize these purposes and boundaries. Meridian is not being asked to implement a security operations center or design encryption key policies.

The decision to make

Meridian should build an evidence chain that connects provider assurance, customer controls, recorded activity, resource state, and security findings.

The first decision is ownership. AWS Artifact can supply AWS security and compliance documents such as SOC reports and ISO or PCI-related material. Those documents may help Meridian's audit, but they do not prove that Meridian granted least privilege, enabled appropriate logging, or configured encryption correctly.

The second decision is data protection. Encryption at rest protects stored data. Encryption in transit protects data while it moves across a network. AWS services provide encryption capabilities, but Meridian remains responsible for choosing and configuring the controls appropriate to its data and compliance obligations.

The third decision is evidence type. AWS CloudTrail answers questions about activity: who or what made an API request, which action occurred, when it occurred, and which resource was involved. AWS Config answers questions about resource configuration: what settings a supported resource had, how related resources were connected, and how that configuration changed over time.

The fourth decision is detection and coordination. Amazon GuardDuty analyzes supported AWS data sources and logs to identify suspicious or potentially malicious activity. AWS Security Hub aggregates and prioritizes findings and checks the environment against supported security standards. Detection does not automatically equal prevention or remediation.

A practical mental model

Think of Meridian's audit as a court case with different kinds of evidence.

AWS Artifact is the building owner's inspection certificate. It supplies evidence about controls the provider operates. Encryption is the locked container used to protect valuable material. CloudTrail is the visitor and action log. AWS Config is the sequence of floor plans showing how rooms and doors were arranged over time. GuardDuty is an investigator that looks for suspicious behavior. Security Hub is the case desk where findings from multiple sources can be organized and prioritized.

One record cannot substitute for the others. A visitor log can show that someone changed a security group, but the configuration timeline is better for showing the before-and-after state. A configuration rule can flag a noncompliant setting, but it does not by itself identify every malicious actor. An AWS audit report describes AWS controls, not Meridian's application-specific compliance.

Build the evidence chain

Meridian can reason from the audit question to the matching capability.

For data protection, Meridian should classify the data first. It can then require suitable access control and encryption at rest and in transit. Encryption reduces exposure if data or traffic is accessed improperly, but it does not correct excessive permissions, unsafe application behavior, or poor key access controls.

For auditing, CloudTrail Event history provides a searchable record of recent management events, while trails or CloudTrail Lake support longer-lived or broader recording and analysis choices. The foundational distinction matters more than retention details: CloudTrail records account activity and API events.

For governance, AWS Config records supported resource configurations and relationships and can evaluate them against Config rules. It helps Meridian answer “was this resource configured as required?” A noncompliant result is a signal to investigate or remediate, not a guarantee that a breach occurred.

Recommended reasoning

Meridian should start with the requirement, not a service name.

If the auditor requests AWS's SOC report, use AWS Artifact. If the request is for proof of Meridian's own access reviews or application controls, Meridian must produce its own evidence. AWS explicitly keeps customer compliance documentation within the customer's responsibility.

If an investigator asks who deleted a resource or changed a policy, inspect CloudTrail activity. If the investigator asks which ports a firewall-like security group allowed last Tuesday, use AWS Config configuration history. These services complement one another because actions and state are different evidence.

If the security team needs managed threat detection across supported data sources, GuardDuty fits. It produces findings that describe suspicious activity. If the team needs a consolidated security posture and prioritized findings across accounts and integrated services, Security Hub fits. Current AWS documentation often labels its posture-management capability AWS Security Hub CSPM, where CSPM means cloud security posture management; the CLF-C02 guide and this curriculum manifest still use AWS Security Hub.

The team should also define ownership for every alert. A finding that nobody reviews is not a response process. Likewise, collecting logs without appropriate retention, access protection, and review does not satisfy an audit merely because the service is enabled.

Where the manifest services fit

AWS Artifact provides on-demand access to AWS security and compliance documents and supports reviewing or managing certain AWS agreements. It is the place to look for AWS assurance material, not a scanner for Meridian's resources.

AWS CloudTrail records actions made through the console, CLI, SDKs, and APIs as events. The shared AWS CloudTrail reference covers its event and trail model without repeating that service documentation here.

AWS Config records supported resource configurations, relationships, and changes and can evaluate resources against rules. Use the AWS Config reference when you need the deeper governance model.

Amazon GuardDuty is managed threat detection. It analyzes supported sources and emits findings when it detects suspicious activity. The Amazon GuardDuty reference explains its role alongside nearby security services.

AWS Security Hub provides a consolidated view of security findings and security posture. It can ingest findings from GuardDuty and other integrations and prioritize issues for review. See the shared AWS Security Hub reference for the broader service boundary.

Common exam confusion

• AWS compliance versus customer compliance: AWS Artifact reports concern AWS controls. The customer must still demonstrate its own controls and compliant use of AWS.
• Encryption at rest versus in transit: At rest protects stored data; in transit protects data moving over networks. Many workloads need both.
• CloudTrail versus CloudWatch: CloudTrail centers on API and account activity. CloudWatch centers on operational metrics, logs, alarms, and observability.
• CloudTrail versus Config: CloudTrail records an action. Config records supported resource state and configuration history.
• GuardDuty versus Security Hub: GuardDuty detects suspicious activity and creates findings. Security Hub aggregates and prioritizes findings and evaluates security posture.
• Detection versus prevention: A finding tells Meridian something needs attention. It does not prove the issue was blocked or remediated.
• Service availability versus correct configuration: AWS offering an encryption or logging feature does not mean the customer has configured it for the required scope.

Recall prompts

1. Why is an AWS Artifact report not enough to prove Meridian's own compliance?
2. What is the difference between encryption at rest and encryption in transit?
3. Which service would help identify who called an AWS API?
4. Which service would show how a supported resource's configuration changed?
5. How do GuardDuty and Security Hub play different roles?
6. Why does collecting a finding or log not complete the response process?

Summary

Meridian needs several complementary forms of assurance. AWS Artifact supplies AWS compliance documents. Encryption protects data at rest and in transit. CloudTrail records activity, while Config records configuration history and evaluates resource state. GuardDuty detects suspicious activity, and Security Hub brings findings and posture information together.

The durable exam mental model is to match the question to the evidence: provider report, data protection, action history, configuration history, threat finding, or consolidated posture. None of these removes Meridian's responsibility to configure, review, and respond.

Official references: CLF-C02 Domain 2, AWS Artifact, AWS CloudTrail, AWS Config, Amazon GuardDuty, and AWS Security Hub.