View a markdown version of this page

Content Domain 2: Security, Compliance, and Governance - AWS Certified Solutions Architect - Professional
Task 2.1: Design identity security architectures.Task 2.2: Design solutions to implement encryption and key management strategies.Task 2.3: Design multi-account governance and compliance solutions.Task 2.4: Design architectures to meet compliance requirements.Task 2.5: Design security and responsible AI controls.

Content Domain 2: Security, Compliance, and Governance

Task 2.1: Design identity security architectures.

  • Skill 2.1.1: Implement identity federation by using standard protocols (for example, AWS IAM Identity Center, SAML 2.0, OpenID Connect, System for Cross-domain Identity Management [SCIM]).

  • Skill 2.1.2: Design application authentication and authorization solutions (for example, by using Amazon Cognito user pools, identity pools, OAuth 2.0, Amazon EKS Pod Identity).

  • Skill 2.1.3: Design least-privilege access controls such as cross-account access and temporary credentials (for example, by using IAM roles, IAM policies, permissions boundaries, external IDs, session policies, attribute-based access control [ABAC]).

  • Skill 2.1.4: Design data perimeter controls and external access validation solutions (for example, by using AWS Identity and Access Management Access Analyzer, VPC endpoint policies, AWS Verified Access).

  • Skill 2.1.5: Design workload identities for hybrid and multi-cloud environments (for example, by using IAM Roles Anywhere).

Task 2.2: Design solutions to implement encryption and key management strategies.

  • Skill 2.2.1: Implement encryption at rest by using customer managed keys and automatic key rotation (for example, by using AWS KMS).

  • Skill 2.2.2: Implement encryption in transit by using certificate management (for example, TLS 1.3, AWS Certificate Manager [ACM], AWS Private CA).

  • Skill 2.2.3: Implement dedicated hardware security modules to comply with regulations (for example, AWS CloudHSM).

  • Skill 2.2.4: Design post-quantum cryptography strategies (for example, by using AWS KMS with Module-Lattice Digital Signature Algorithm [ML-DSA], Module-Lattice-Based Key-Encapsulation Mechanism [ML-KEM]).

Task 2.3: Design multi-account governance and compliance solutions.

  • Skill 2.3.1: Design organizational structures that include features such as guardrails, landing zones, and automated account provisioning (for example, by using AWS Organizations, OUs, AWS Control Tower, AWS Control Tower Account Factory).

  • Skill 2.3.2: Implement centralized logging and configuration management solutions, including solutions for AI model invocations and responses (for example, by using AWS CloudTrail organization trails, AWS Config aggregation, AWS GuardDuty, Amazon Security Lake, AWS Security Hub, Amazon CloudWatch Logs).

  • Skill 2.3.3: Configure cross-account resource sharing (for example, AWS Resource Access Manager [AWS RAM], AWS Transit Gateway).

  • Skill 2.3.4: Design policy enforcement by using SCPs and RCPs.

  • Skill 2.3.5: Implement automated compliance monitoring (for example, by using AWS Config rules, AWS Security Hub CSPM).

  • Skill 2.3.6: Configure automated vulnerability scanning and patch management (for example, by using Amazon Inspector, AWS Systems Manager Patch Manager).

Task 2.4: Design architectures to meet compliance requirements.

  • Skill 2.4.1: Design architectures to meet data protection requirements (for example, by implementing encryption, access controls, audit logging).

  • Skill 2.4.2: Design solutions to meet regulatory requirements such as data sovereignty controls.

  • Skill 2.4.3: Implement audit trail management for regulated workloads, including for AI services.

  • Skill 2.4.4: Design data residency controls such as AWS Region-specific deployments and transfer restrictions.

  • Skill 2.4.5: Implement compliance evidence collection and reporting solutions (for example, by using AWS Artifact).

  • Skill 2.4.6: Implement risk assessment solutions for cloud architectures such as threat modeling and mitigation strategies.

Task 2.5: Design security and responsible AI controls.

  • Skill 2.5.1: Implement content filtering and compliance controls for generative AI services (for example, by using Amazon Bedrock Guardrails).

  • Skill 2.5.2: Implement access controls for generative and agentic AI applications (for example, by using Amazon Bedrock AgentCore Identity).

  • Skill 2.5.3: Design human oversight workflows that include approval mechanisms for AI operations (for example, by using AWS Step Functions).