Content Domain 6: Security Foundations and Governance - AWS Certification
Task 6.1: Develop a strategy to centrally deploy and manage AWS accountsTask 6.2: Implement a secure and consistent deployment strategy for cloud resourcesTask 6.3: Evaluate the compliance of AWS resources

Content Domain 6: Security Foundations and Governance

Task 6.1: Develop a strategy to centrally deploy and manage AWS accounts

Skills in:

  • Skill 6.1.1: Deploy and configure organizations by using AWS Organizations.

  • Skill 6.1.2: Implement and manage AWS Control Tower in new and existing environments, and deploy optional and custom controls.

  • Skill 6.1.3: Implement organization policies to manage permissions (for example, SCPs, RCPs, AI service opt-out policies, declarative policies).

  • Skill 6.1.4: Centrally manage security services (for example, delegated administrator accounts).

  • Skill 6.1.5: Manage AWS account root user credentials (for example, by centralizing root access for member accounts, managing MFA, designing break-glass procedures).

Task 6.2: Implement a secure and consistent deployment strategy for cloud resources

Skills in:

  • Skill 6.2.1: Use infrastructure as code (IaC) to deploy cloud resources consistently and securely across accounts (for example, CloudFormation stack sets, third-party IaC tools, CloudFormation Guard, cfn-lint).

  • Skill 6.2.2: Use tags to organize AWS resources into groups for management (for example, by grouping by department, cost center, environment).

  • Skill 6.2.3: Deploy and enforce policies and configurations from a central source (for example, AWS Firewall Manager).

  • Skill 6.2.4: Securely share resources across AWS accounts (for example, AWS Service Catalog, AWS Resource Access Manager [AWS RAM]).

Task 6.3: Evaluate the compliance of AWS resources

Skills in:

  • Skill 6.3.1: Create or enable rules to detect and remediate noncompliant AWS resources and to send notifications (for example, by using AWS Config to aggregate alerts and remediate non-compliant resources, Security Hub).

  • Skill 6.3.2: Use AWS audit services to collect and organize evidence (for example, AWS Audit Manager, AWS Artifact).

  • Skill 6.3.3: Use AWS services to evaluate architecture for compliance with AWS security best practices (for example, AWS Well-Architected Framework tool).