Security and Compliance
Data Classification, Encryption, Secrets, and Security Findings
CoreClassify data, enforce encryption at rest and in transit, manage rotating secrets, and route detector findings through a governed remediation workflow.
Aligned to AWS Certified CloudOps Engineer - Associate (SOA-C03) Version 1.1, verified August 24, 2026.
Why this matters
Classification, cryptographic protection, credential lifecycle, detection, aggregation, and remediation are separate layers. Applying only one leaves neighboring risks unresolved.
Must Know
- Define classification labels and required handling, then use evidence such as Amazon Macie findings for supported S3 discovery rather than inferring sensitivity from encryption state.
- KMS authorization can involve IAM, key policy, grants, service integration, key state and Region, and encryption context. Permission to read a resource does not automatically permit decryption.
- ACM manages supported certificates for TLS endpoints. Validate domain control or imported-chain trust, certificate status, hostname coverage, Region placement, listener attachment, and client trust.
- Secrets Manager stores and retrieves secrets under workload permissions and can coordinate rotation. Clients must refresh cached values safely and rotation stages must remain consistent.
- GuardDuty detects threat activity, Inspector finds supported software vulnerabilities and unintended network exposure, Macie discovers sensitive S3 data, and Security Hub aggregates normalized findings and workflow state.
- AWS Security Agent recommendations remain findings to validate and remediate under approved least-privilege and audit controls.
Compare and Distinguish
- Classification determines handling; encryption protects data; neither performs the other job.
- KMS supports encryption keys and authorization; ACM manages TLS certificates; Secrets Manager manages secret values and rotation lifecycle.
- Security Hub aggregates and normalizes findings; GuardDuty, Inspector, Macie, Config, and other integrations generate domain-specific evidence.
- KMS key rotation changes cryptographic key material according to key behavior; secret rotation changes a credential value and consumer lifecycle.
Scenario examples
- Scenario: Unknown S3 objects may contain sensitive fields. Establish classification requirements and use Macie evidence before applying handling controls.
- Scenario: A role can read an encrypted object but cannot decrypt it. Inspect KMS key policy, IAM or grant, key state/Region, service path, and encryption context.
- Scenario: A rotated database credential works in Secrets Manager but applications keep the old value. Validate rotation labels and make clients retrieve or safely refresh the current secret.
Exam traps
- Do not use encryption state as the data classification.
- Do not use an ACM certificate for at-rest data encryption.
- Do not assume Security Hub originates every finding.
- Do not auto-apply broad agent recommendations without validating scope and evidence.
Key takeaways
- Classify before selecting handling controls.
- Treat data permission and key permission as separate.
- Separate TLS identity and trust from network reachability.
- Route findings through prioritized, auditable remediation.
How it works
- Establish the classification or finding evidence and the resource and identity it concerns.
- Inspect the relevant key, certificate, secret-stage, detector, or aggregation configuration without widening unrelated access.
- Remediate through the approved workflow and verify data access, TLS, secret refresh, or finding state at the originating surface.
When to use it
- Use classification to decide required handling and encryption to protect data; do not infer either control from the presence of the other.
- Choose AWS KMS for encryption keys and key authorization, ACM for supported TLS certificates, and Secrets Manager for secret values and their rotation lifecycle.
- Use AWS Security Hub to aggregate and normalize findings; investigate GuardDuty, Inspector, Macie, Config, or another integration when you need the domain-specific source evidence.
- Rotate an AWS KMS key according to its cryptographic key-material behavior; rotate a secret when the credential value and every consuming application must move through a new lifecycle.
Security and governance implications
- Authorize access to protected data and use of its KMS key independently; neither permission implies the other.
- Keep secret values and security findings out of broad logs while retaining enough audit history to review remediation.
Failure signals and diagnosis
- For KMS denial, inspect principal, key policy/grant, action, key state, Region, encryption context, and service integration.
- For TLS failure, inspect hostname, chain, status, Region, attachment, listener, and client trust before opening filters.
- For stale secrets, inspect rotation stages, provider integration, client cache, refresh behavior, and connection reuse.
More detail
- Use Macie evidence for supported S3 sensitive-data discovery and apply the organization's declared handling requirement separately.
- Distinguish KMS key authorization, ACM certificate lifecycle, and Secrets Manager value and rotation lifecycle.
- Treat GuardDuty, Inspector, Macie, Security Hub, and AWS Security Agent according to their detection, aggregation, or recommendation role.
Ready for the quiz?
- An encrypted S3 bucket may contain sensitive data. Which evidence determines its classification, and which evidence shows whether Amazon Macie discovery is working?
- Which service generates the evidence, and which service only aggregates its finding and workflow state?
- A principal can read an encrypted object but cannot decrypt it; which KMS policy, grant, key-state, Region, and context evidence should be checked?
Related objectives
- D4.2 — Task 4.2: Implement strategies to protect data and infrastructure.
- 4.2.1 — Implement and enforce a data classification scheme.
- 4.2.2 — Implement, configure, and troubleshoot encryption at rest (for example, AWS KMS).
- 4.2.3 — Implement, configure, and troubleshoot encryption in transit (for example, AWS Certificate Manager [ACM]).
- 4.2.4 — Securely store secrets by using AWS services.
- 4.2.5 — Configure reports and remediate findings from AWS services (for example, AWS Security Hub, Amazon GuardDuty, AWS Config, Amazon Inspector, AWS Security Agent).