SCS-C03 Domain 6: Security Foundations and Governance (14%)
Security Foundations and Governance is 14% of the SCS-C03 exam. It is about managing many accounts centrally (Organizations, Control Tower, SCPs and RCPs), deploying resources consistently, and proving compliance.
Weight on the exam: 14%. It is one of the six domains of the AWS Certified Security – Specialty SCS-C03 exam. Below is a summary of its tasks and skills according to the official AWS guide.
Tasks and skills tested
Task 6.1: Develop a strategy to centrally deploy and manage AWS accounts
- Deploy and configure organizations by using AWS Organizations.
- Implement and manage AWS Control Tower in new and existing environments, and deploy optional and custom controls.
- Implement organization policies to manage permissions (for example, SCPs, RCPs, AI service opt-out policies, declarative policies).
- Centrally manage security services (for example, delegated administrator accounts).
- Manage AWS account root user credentials (for example, by centralizing root access for member accounts, managing MFA, designing break-glass procedures).
Task 6.2: Implement a secure and consistent deployment strategy for cloud resources
- Use infrastructure as code (IaC) to deploy cloud resources consistently and securely across accounts (for example, CloudFormation stack sets, third-party IaC tools, CloudFormation Guard, cfn-lint).
- Use tags to organize AWS resources into groups for management (for example, by grouping by department, cost center, environment).
- Deploy and enforce policies and configurations from a central source (for example, AWS Firewall Manager).
- Securely share resources across AWS accounts (for example, AWS Service Catalog, AWS Resource Access Manager [AWS RAM]).
Task 6.3: Evaluate the compliance of AWS resources
- Create or enable rules to detect and remediate noncompliant AWS resources and to send notifications (for example, by using AWS Config to aggregate alerts and remediate non-compliant resources, Security Hub).
- Use AWS audit services to collect and organize evidence (for example, AWS Audit Manager, AWS Artifact).
- Use AWS services to evaluate architecture for compliance with AWS security best practices (for example, AWS Well-Architected Framework tool).
Services and tools to master
- AWS Organizations
- SCPs and RCPs
- AWS Control Tower
- AWS CloudFormation and StackSets
- CloudFormation Guard
- AWS Firewall Manager
- AWS Service Catalog
- AWS RAM
- AWS Config
- AWS Audit Manager
- AWS Artifact
Key facts for domain 6
Short summaries; each links to the study topic with the full note and its official source.
- SCPs don't grant permissions — An SCP never grants permissions: it sets the maximum available.
- What SCPs do NOT restrict — SCPs do not affect the management account or service-linked roles.
- SCPs don't apply to external accounts — SCPs only affect users and roles managed by accounts in the organization.
- Don't remove FullAWSAccess blindly — Do not remove the FullAWSAccess policy without replacing it with one that allows actions: otherwise every action in member accounts fails.
- Disabling SCPs deletes attachments — If you disable the SCP policy type in a root, all SCPs are detached, and when you re-enable it only FullAWSAccess remains.
- Improve SCPs with usage data — Use IAM 'service last accessed data' (or CloudTrail) to see which services allowed by an SCP are never used and refine the SCP toward least privilege.
- What AWS Config does — AWS Config records resource configuration and its history, and evaluates compliance with rules.
- Rules, conformance packs and remediation — A conformance pack is a set of rules deployable as a single entity.
Practice Domain 6
Answer practice questions, read the explanation and review your mistakes with spaced repetition.