CS Techie
Comments
courseAWS
AWS lesson

Security Compliances in AWS

AWS provides a shared responsibility model for security and compliance. AWS manages the security “of” the cloud, while customers are responsible for security “in” the cloud. To help customers build secure and compliant environments, AWS offers a broad set of compliance programs, certifications, frameworks, and tools recognized worldwide.


Compliance Frameworks and Certifications Supported by AWS

AWS complies with many globally recognized security standards, covering industry, geography, and regulatory requirements:

  • ISO Certifications
    • ISO/IEC 27001 – Information Security Management
    • ISO/IEC 27017 – Cloud Security
    • ISO/IEC 27018 – Cloud Privacy and Data Protection
  • SOC (System and Organization Controls)
    • SOC 1 – Focused on financial reporting controls
    • SOC 2 – Security, Availability, Confidentiality, Processing Integrity, Privacy
    • SOC 3 – Public summary of SOC 2
  • Payment & Healthcare
    • PCI DSS – Payment Card Industry Data Security Standard
    • HIPAA Eligible Services – For safeguarding ePHI (Electronic Protected Health Information)
  • US Government Standards
    • FedRAMP (Federal Risk and Authorization Management Program)
    • FIPS 140-2 validated cryptographic modules
    • ITAR compliance (International Traffic in Arms Regulations)
  • European Regulations
    • GDPR readiness (General Data Protection Regulation)
    • ENS High (Spain), C5 (Germany), and other EU country-specific accreditations
  • Others
    • IRAP (Australia)
    • MTCS (Singapore)
    • K-ISMS (Korea)


AWS Governance, Risk, and Compliance (GRC) Tools

AWS provides tools to help customers prove and enforce compliance:

  • AWS Artifact
    • Self-service portal with access to AWS compliance reports, certifications, and security attestations.
    • Customers can download audit documents to meet internal or regulatory requirements.
  • AWS Config & AWS Security Hub
    • Continuously evaluate whether resources comply with defined rules and compliance standards (like CIS, PCI DSS).
    • Security Hub aggregates findings across AWS accounts and services.
  • Amazon GuardDuty
    • Threat detection service aligning to compliance requirements like continuous monitoring.
  • AWS Audit Manager
    • Automates the collection of evidence to simplify audit preparation against frameworks such as PCI-DSS, GDPR, HIPAA.


Customer Responsibilities in Compliance

While AWS provides infrastructure compliance, customers remain responsible for:

  • Proper classification and handling of data.
  • Configuring security controls such as encryption, IAM, SGs/NACLs.
  • Ensuring workloads meet compliance requirements (HIPAA, PCI DSS).
  • Enabling encryption (KMS, S3 SSE, RDS with TDE) where regulations mandate.
  • Maintaining logging and audit records using CloudTrail, CloudWatch, VPC Flow Logs.


Best Practices for Staying Compliant in AWS

  • Leverage AWS Organizations + Service Control Policies (SCPs) for governance.
  • Use encryption by default (KMS, TLS, EBS encryption, Secrets Manager).
  • Apply least privilege IAM policies, enforce MFA, rotate credentials.
  • Enable CloudTrail across all regions for governance and audit tracking.
  • Continuously monitor via AWS Config, Security Hub, GuardDuty, and Audit Manager.
  • Regularly download and present compliance artifacts using AWS Artifact