SAP-C03 security and governance explained
Security, Compliance, and Governance is the second of the five SAP-C03 domains and carries 25% of scored content, the same as domain 1. At professional level it means setting guardrails that hold across many accounts, giving workloads least-privilege access, protecting data with the right key model, and being able to prove compliance. This page covers the core reasoning behind the guide’s five tasks and marks what is new compared with SAP-C02.
What the domain asks of an architect
- Preventive guardrails. AWS Organizations service control policies (SCPs) set the maximum permissions for member accounts, including their root users. They never grant permissions and do not restrict the management account. AWS Control Tower packages guardrails and account provisioning.
- Identity. Cross-account access uses IAM roles with trust policies, not shared users. Permission boundaries cap what a delegated administrator can grant. Resource policies allow access from other accounts directly. See AWS IAM basics for how allow and deny combine. IAM Identity Center covers workforce access.
- Data protection. AWS KMS keys with key policies, grants and optional multi-Region keys; S3 bucket policies and encryption settings; AWS Secrets Manager rotation.
- Detection and evidence. CloudTrail records API calls, AWS Config records configuration state and evaluates rules, GuardDuty detects threats, Security Hub aggregates findings, Macie finds sensitive data in S3. Delegated administrator accounts collect these centrally.
- Network boundaries. Security groups, network ACLs, AWS WAF, AWS Network Firewall, VPC endpoints and PrivateLink for private paths to services.
The five tasks in the AWS exam guide
| Task | What it covers |
|---|---|
| 2.1 Design identity security architectures | Federation with IAM Identity Center, SAML 2.0, OIDC and SCIM; Cognito and EKS Pod Identity; least-privilege cross-account access (roles, permission boundaries, external IDs, session policies, ABAC); data perimeters with Access Analyzer, VPC endpoint policies and Verified Access; workload identities with IAM Roles Anywhere |
| 2.2 Encryption and key management | KMS customer managed keys and rotation, TLS 1.3 with ACM and Private CA, CloudHSM, post-quantum strategies with ML-DSA and ML-KEM |
| 2.3 Multi-account governance and compliance | Organizations, OUs and Control Tower Account Factory; centralized logging and configuration (CloudTrail organization trails, Config aggregation, GuardDuty, Security Lake, Security Hub, including AI model invocations); RAM; SCPs and RCPs; Config rules and Security Hub CSPM; Inspector and Patch Manager |
| 2.4 Meet compliance requirements | Data protection, data sovereignty and residency controls, audit trails including AI services, evidence collection with AWS Artifact, threat modeling and risk assessment |
| 2.5 Security and responsible AI controls | Bedrock Guardrails, access control for generative and agentic applications with AgentCore Identity, human-approval workflows with Step Functions |
New compared with SAP-C02, per the guide: Cognito, EKS Pod Identity and IAM Roles Anywhere, post-quantum cryptography, data residency controls, AWS Artifact evidence collection, risk assessment, and the whole of task 2.5. Resource control policies (RCPs) sit next to SCPs in task 2.3, so know that RCPs set the maximum permissions on resources while SCPs cap principals. The SAP-C02 guide treated Guardrails, agentic access control and human oversight as unscored emerging topics; in SAP-C03 they are scored skills.
Worked mini-scenario
A company with 40 accounts must ensure that data in S3 is never stored unencrypted, no account leaves approved Regions, and auditors can see who changed a security group.
- Guardrail approach. An SCP denies actions outside approved Regions and denies disabling CloudTrail. It prevents the violation, but SCPs cannot force encryption on resources that already exist.
- Detective approach. AWS Config rules, deployed through a conformance pack to every account, flag unencrypted buckets and security-group changes. They find the problem after it occurs.
- Combination. Use the SCP for what must never happen (Region and logging), set default bucket encryption and use Config for evidence and drift. An organization trail delivers logs to a locked-down log-archive account.
The trade-off is autonomy versus control: a tighter SCP blocks teams until exceptions are requested, so the design should name an exception path.
Easy-to-confuse pairs
| Pair | The distinction |
|---|---|
| SCP vs IAM policy vs permission boundary | Organization-wide ceiling vs grant to a principal vs ceiling on one role or user |
| CloudTrail vs Config | Who called which API vs what the resource looks like and whether it complies |
| GuardDuty vs Security Hub vs Inspector | Threat detection vs findings aggregation vs vulnerability scanning |
| KMS key policy vs IAM policy | The key policy must permit access; IAM alone cannot unlock a key unless the key policy allows it |
| AWS-managed key vs customer-managed key | No control over policy and rotation schedule vs full control and audit |
| PrivateLink vs VPC peering | One service exposed privately vs network-level connectivity |
Exam-style pitfall
Picking a detective control when the scenario says “prevent”. Config rules and alarms notify; only SCPs, IAM boundaries or resource policies stop an action. The reverse trap also appears: an SCP cannot grant access, so it never replaces the identity policy the workload needs.
Practice questions
Question 1. A security team must let developers create IAM roles for their applications but guarantee that no role they create can have more permissions than a defined baseline, including the ability to remove that limit. What is the best control?
- A. Share a baseline managed policy and ask developers to attach it
- B. Create a CloudWatch alarm on CreateRole events
- C. Require a permission boundary on created roles and deny its removal
- D. Enable AWS Security Hub in each account
Show answer
Answer: C
A permission boundary caps the permissions of roles and users, and the developers’ policy can require that any role they create has the boundary attached and deny removing it. A baseline policy that developers attach voluntarily is not enforced, a CloudWatch alarm only notifies after the fact, and Security Hub reports findings without blocking creation.
Want more questions like this? Full SAP-C03 practice tests →
Question 2. An S3 bucket in the audit account holds data encrypted with a customer managed KMS key in the same account. A role in another account must read the objects. The bucket policy already allows that role. Reads still fail with access denied. What is missing?
- A. Permission in the KMS key policy and role policy for the external role to decrypt
- B. Making the bucket public
- C. Peering the two accounts’ VPCs
- D. Replacing the key with an AWS owned key
Show answer
Answer: A
Using a customer managed key requires permission from the key policy, so the key policy must allow the external role (or the account) and the role needs matching IAM permissions for kms:Decrypt. Making the bucket public would defeat the requirement, switching to an AWS owned key removes control, and VPC peering has no effect on KMS authorization.
Want more questions like this? Full SAP-C03 practice tests →
Question 3. A regulator requires that engineers can never disable audit logging in any of 200 accounts, even with administrator permissions, and that the rule can be changed only by the central security team. Which solution meets this?
- A. An IAM deny policy added by each account administrator
- B. An AWS Config rule that reports when logging is off
- C. A written policy with annual training
- D. An SCP denying the actions, managed centrally by the security team
Show answer
Answer: D
An SCP applied from the organization root or OUs denies the logging-disable actions for every member-account principal, and only the management account can change it, which the central team controls through the management account or a delegated administrator. IAM deny policies can be removed by account administrators, Config rules only detect, and a training policy does not enforce anything.
Want more questions like this? Full SAP-C03 practice tests →