Evaluating compliance: Config, Security Hub CSPM, evidence and reviews

AWS Config rules: detecting noncompliance

Days 1 and 2 were about preventing bad configurations with SCPs, Guard and StackSets. Today is about checking: finding resources that are already wrong, fixing them and proving it to an auditor. Skill 6.3.1 starts with AWS Config. The configuration recorder writes down every change to your resources, and Config rules judge each recorded resource as compliant or not.

Remember the difference from Day 2. CloudFormation Guard and cfn-lint check a template before deployment. A Config rule checks the real resource after deployment, even if someone changed it by hand in the console.

$ aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-versioning-guard",
  "Scope": { "ComplianceResourceTypes": ["AWS::S3::Bucket"] },
  "Source": {
    "Owner": "CUSTOM_POLICY",
    "SourceDetails": [{ "EventSource": "aws.config",
      "MessageType": "ConfigurationItemChangeNotification" }],
    "CustomPolicyDetails": {
      "PolicyRuntime": "guard-2.x.x",
      "PolicyText": "rule check_versioning when resourceType == \"AWS::S3::Bucket\" { supplementaryConfiguration.BucketVersioningConfiguration.status == \"Enabled\" }"
    } } }'

$ aws configservice get-compliance-details-by-config-rule \
    --config-rule-name s3-versioning-guard --compliance-types NON_COMPLIANT \
    --query "EvaluationResults[].EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId"
[ "legacy-logs-bucket" ]

Many accounts: aggregators, organization rules and conformance packs

A real company has dozens of accounts and several Regions. Skill 6.3.1 says “aggregate alerts”. That means two separate jobs. First, push the same rules into every account with organization Config rules or organization conformance packs. Second, pull all results back into one place with an aggregator, so the security team sees one dashboard.

Control Tower, Config and the aggregator

If you use AWS Control Tower (Day 1), it turns on the Config recorder in governed accounts, sends Config data to the Log Archive account and creates an organization-wide aggregator in the Audit account (landing zone 3.x). Since landing zone 4.0 (November 2025) the Config integration is optional, Config data goes to its own bucket in the Config aggregator account (the old Audit account), a service-linked Config aggregator replaces the organization aggregator, and member accounts are recorded only in OUs where the AWS Config baseline is enabled. Control Tower detective controls are Config rules under the hood. So on the exam, “Control Tower is in place, now we need extra custom checks in every account” often leads to an organization conformance pack or organization Config rule deployed by the delegated administrator.

$ aws configservice put-organization-conformance-pack \
    --organization-conformance-pack-name baseline-pci \
    --template-s3-uri s3://org-config-packs/Operational-Best-Practices-for-PCI-DSS.yaml \
    --excluded-accounts 444455556666 --region eu-west-1

$ aws configservice put-configuration-aggregator \
    --configuration-aggregator-name org-all \
    --organization-aggregation-source \
      "RoleArn=arn:aws:iam::111122223333:role/ConfigAggregatorRole,AllAwsRegions=true"

$ aws configservice get-aggregate-compliance-details-by-config-rule \
    --configuration-aggregator-name org-all --config-rule-name restricted-ssh \
    --account-id 222233334444 --aws-region eu-west-1 --compliance-type NON_COMPLIANT

Remediation and notifications

Detection is only half of skill 6.3.1: you must also remediate and notify. AWS Config remediates with AWS Systems Manager Automation runbooks. Notifications travel through Amazon EventBridge, which can send the event to an SNS topic, a Lambda function or another runbook.

$ aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "restricted-ssh",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisableIncomingSSHOnPort22",
  "Parameters": {
    "AutomationAssumeRole": { "StaticValue": { "Values": ["arn:aws:iam::111122223333:role/ConfigFixSSH"] } },
    "SecurityGroupIds": { "ResourceValue": { "Value": "RESOURCE_ID" } } },
  "Automatic": true, "MaximumAutomaticAttempts": 5, "RetryAttemptSeconds": 60 }]'

EventBridge rule pattern (target: SNS topic security-alerts):
{ "source": ["aws.config"],
  "detail-type": ["Config Rules Compliance Change"],
  "detail": { "configRuleName": ["restricted-ssh"],
    "newEvaluationResult": { "complianceType": ["NON_COMPLIANT"] } } }

AWS User Notifications: one place for alerts

AWS User Notifications is in the SCS-C03 service list. It is a console service that turns AWS events into notifications without you building EventBridge → SNS → Lambda plumbing in every account. AWS managed notifications (for example AWS Health) arrive by default; notification configurations you create use EventBridge event rules (for example CloudWatch alarm state changes or Health scheduled changes). Delivery channels: the console Notifications Center, email, Amazon Q Developer in chat applications (Slack, Teams) and the AWS Console Mobile App.

With trusted access in AWS Organizations, the management account or a delegated administrator creates one configuration for the whole organization or chosen OUs. Matching events from member accounts create notifications in the admin account only, aggregation can group events (5 minutes or 12 hours), and new accounts are covered automatically.

Security Hub CSPM: standards, controls and central configuration

The blueprint names Security Hub for skill 6.3.1. Be careful with the name. Since 2025 the posture checking service that runs standards and controls is called AWS Security Hub CSPM (Cloud Security Posture Management). A new AWS Security Hub, generally available since December 2025, sits on top and correlates signals from GuardDuty, Inspector and Security Hub CSPM into prioritized risks. Older study material just says “Security Hub” for what is now CSPM.

$ aws securityhub create-configuration-policy --name prod-baseline \
  --configuration-policy '{ "SecurityHub": { "ServiceEnabled": true,
    "EnabledStandardIdentifiers": [
      "arn:aws:securityhub:eu-west-1::standards/aws-foundational-security-best-practices/v/1.0.0",
      "arn:aws:securityhub:eu-west-1::standards/cis-aws-foundations-benchmark/v/3.0.0" ],
    "SecurityControlsConfiguration": { "DisabledSecurityControlIdentifiers": ["CloudTrail.6"] } } }'

$ aws securityhub start-configuration-policy-association \
  --configuration-policy-identifier <policy-id> --target '{"OrganizationalUnitId":"ou-prod-abcd"}'

$ aws securityhub create-automation-rule --rule-name sandbox-low --rule-order 1 \
  --criteria '{"AwsAccountId":[{"Value":"444455556666","Comparison":"EQUALS"}]}' \
  --actions '[{"Type":"FINDING_FIELDS_UPDATE","FindingFieldsUpdate":{"Severity":{"Label":"LOW"}}}]'

Evidence for auditors: AWS Audit Manager and AWS Artifact

Skill 6.3.2 is about evidence. An auditor asks two different questions. “Is AWS itself secure?” is answered by AWS Artifact, which gives you AWS’s own audit reports and agreements. “Is your use of AWS compliant?” is answered by evidence from your accounts, which AWS Audit Manager collects and organizes automatically.

AWS Artifact in detail, and the Audit Manager availability change

AWS Artifact is a free self-service portal. Reports include SOC, ISO and PCI attestations and certifications; you accept the Artifact terms before downloading some of them. Agreements include the Business Associate Addendum (BAA), which HIPAA-covered companies usually need before processing protected health information. You can accept an agreement for one account, or as an organization agreement from the management account so that all existing and future member accounts are covered. You can also terminate an agreement later. Artifact also offers third-party reports from AWS Marketplace sellers.

Important 2026 change: AWS Audit Manager is in maintenance mode. From 30 April 2026 it can’t be set up in new accounts, and it won’t get new frameworks or Regions. Existing customers can keep using it, including new assessments. AWS suggests Config conformance packs, the Config resource compliance dashboard, Control Tower and Security Hub CSPM as alternatives. The exam guide still names Audit Manager, so learn its concepts.

$ aws auditmanager create-assessment --name pci-2026 \
    --framework-id <pci-dss-framework-id> \
    --assessment-reports-destination destinationType=S3,destination=s3://audit-reports-111122223333 \
    --scope '{"awsAccounts":[{"id":"222233334444"}],"awsServices":[{"serviceName":"s3"},{"serviceName":"kms"}]}' \
    --roles roleType=PROCESS_OWNER,roleArn=arn:aws:iam::111122223333:role/AuditOwner

$ aws auditmanager create-assessment-report --assessment-id <id> --name q4-pci-report

$ aws artifact list-customer-agreements
{ "customerAgreements": [ { "name": "AWS Business Associate Addendum",
    "organizationArn": "arn:aws:organizations::111122223333:organization/o-exampleorg",
    "state": "ACTIVE" } ] }

Best-practice reviews: Well-Architected Tool and Trusted Advisor

Skill 6.3.3 asks you to evaluate an architecture against AWS security best practices. Config and Security Hub CSPM check individual resources. The AWS Well-Architected Tool checks the design and processes of a whole workload through guided questions. Trusted Advisor adds automatic checks of your account, including some security checks.

The Security pillar and Trusted Advisor security checks

The Security pillar has seven design principles: implement a strong identity foundation, maintain traceability, apply security at all layers, automate security best practices, protect data in transit and at rest, keep people away from data, and prepare for security events. Its best practice areas are security foundations, identity and access management, detection, infrastructure protection, data protection, incident response and application security. Trusted Advisor security checks include security groups with unrestricted specific ports, IAM use, MFA on the root account, S3 bucket permissions, public EBS and RDS snapshots and exposed access keys. With Basic Support you must refresh security checks by hand. Trusted Advisor can also show Security Hub CSPM FSBP control results, and it has an organizational view for all accounts.

$ aws wellarchitected create-workload --workload-name payments-api \
    --description "Card payments API" --environment PRODUCTION \
    --aws-regions eu-west-1 --review-owner sec-team@example.com \
    --lenses wellarchitected serverless

$ aws wellarchitected get-lens-review --workload-id 0a1b2c3d4e --lens-alias wellarchitected \
    --query "LensReview.PillarReviewSummaries[?PillarId=='security'].RiskCounts"
[ { "HIGH": 4, "MEDIUM": 3, "NONE": 4, "UNANSWERED": 0, "NOT_APPLICABLE": 0 } ]

$ aws wellarchitected create-milestone --workload-id 0a1b2c3d4e --milestone-name pre-launch-2026-10

Cheatsheet extras: compliance frameworks and AWS Config vocabulary

Your cheat sheet lists the compliance programs by name (ISO 27001, FedRAMP, HIPAA, NIST, PCI DSS, SAS 70, FIPS 140-2) and the AWS Config terms (configuration item, snapshot, stream, recorder). Exam questions use these words without explaining them, so you must know what each one means and which AWS feature helps. Some cheat sheet facts are out of date; the notes below give today’s behavior.

AWS Config vocabulary from the cheat sheet

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "config.amazonaws.com" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "AWS:SourceAccount": "111122223333" } }
  }]
}

$ aws configservice put-delivery-channel --delivery-channel \
  name=default,s3BucketName=config-history-111122223333,snsTopicARN=arn:aws:sns:eu-west-1:111122223333:config-stream,configSnapshotDeliveryProperties={deliveryFrequency=TwentyFour_Hours}

Lecture summary map

Day 3 on one screen: detect, fix, notify, prove, review.

1. Mind map

2. Match the requirement to the service

3. “If the question says… pick…”

Must-remember cheat sheet

Core quiz

Check the basics first. Pick an answer, then press Check.

Hard quiz

Harder than most real exam questions on purpose, with one “choose two” and one matching question. Aim for 9 out of 12.

Domain 6 review quiz (Days 1–3)

Questions from every governance day. If you miss one, reopen that day’s lecture and its “Must remember” boxes.

Practice test questions (from your mock exams)

Eight questions about AWS Config, Trusted Advisor and audit evidence. These questions come from your own mock exams in the practice tests folder, matched to this lecture. Each one was checked against current AWS behavior, so some wording and answers are updated; the source is shown at the end of each explanation. Questions marked (New) were written in October 2026 for exam-guide skills or AWS changes that the mocks don’t cover.

Hands-on lab (30 minutes, low cost)

1. In a sandbox account, open AWS Config and make sure the configuration recorder is on (record at least security groups and S3 buckets). Config charges per configuration item recorded and per rule evaluation, so keep the scope small.
2. Add the managed rule restricted-ssh. Create a test security group that allows TCP 22 from 0.0.0.0/0 and wait until the rule shows it as NON_COMPLIANT.
3. Create an SNS topic with your email, then an EventBridge rule on Config Rules Compliance Change for that rule with the topic as target. Re-evaluate the rule and check your email.
4. Add remediation to the rule with AWS-DisableIncomingSSHOnPort22 and a small role for AutomationAssumeRole. Run it manually on the test group and watch the rule turn compliant.
5. Open AWS Artifact, accept the terms and download one report (for example a SOC report), and look at the Agreements page without accepting anything. Then create a workload in the Well-Architected Tool (free), answer five Security pillar questions and save a milestone.
6. Clean up: delete the remediation configuration, the rule, the EventBridge rule, the SNS topic, the test security group and the Automation role. Stop the recorder if this is a personal account. If you tried Security Hub CSPM, disable it before its free trial ends, because control checks are billed per check.