If you misconfigure a cloud server and leave a database open to the internet, a hacker can steal thousands of customer records overnight—that is the real-world consequence of not having auditing and automated remediation. Auditing and automated remediation is the system that watches everything you do in the cloud and, when something breaks the rules, either alerts you or fixes it automatically. For the SCS-C02 exam, understanding how to design this safety net is critical because the exam will test whether you know which AWS services to use, what logs to check, and how to chain them together to prevent or respond to security incidents.
Jump to a section
A simple way to picture Auditing, Compliance Frameworks, and Automated Remediation
A health inspector is the person who arrives unannounced to check whether a restaurant follows the rules. They walk through the kitchen, check fridge temperatures, look for expired ingredients, and ensure staff wash their hands. They then write a report listing every violation—like a leaky sink or raw chicken stored above salad. The restaurant owner cannot argue that no one saw the leak; the report is evidence. If there are serious issues, the inspector can issue a fine, require a re-inspection, or even shut the restaurant down.
In the cloud world, an auditor uses logs and monitoring tools to check whether your AWS account follows rules called compliance frameworks. Instead of walking through a kitchen, they review an AWS CloudTrail log of every action taken in your account, or a AWS Config report showing whether your servers have the correct security settings. If a server—technically an Amazon EC2 instance—is open to the whole internet when it should be locked down, that is a violation in the report.
Now imagine a smart restaurant that automatically fixes its own violations. When the fridge gets too warm, a sensor triggers the cooling system to turn on before the food spoils. In AWS, that is automated remediation: a rule that detects a non-compliant resource and fixes it—for example, automatically closing a public-facing database port the moment it is opened. The health inspector never even needs to write a ticket, because the restaurant heals itself.
Let us start with the core idea: every action you take in Amazon Web Services (AWS) is a series of digital commands. You tell the cloud to create a server, open a firewall port, or grant a user permission to delete files. These commands are called API calls, short for Application Programming Interface calls. An API is simply a way for one piece of software to talk to another.
To audit means to record and review every API call so you can later answer the question: Who did what, when, and from where? In AWS, the service that records all API calls is called AWS CloudTrail. Think of it like a black box on an aeroplane—it logs everything. When you enable CloudTrail, it writes a log file to an Amazon S3 bucket (a storage container) containing details like the identity of the person who made the call, the time, the source IP address, and the result (success or failure). These logs are immutable, meaning they cannot be changed after they are written, which prevents someone from tampering with evidence.
Compliance frameworks are sets of rules that your organisation must follow. Examples include PCI DSS for credit card data, HIPAA for health information, and SOC 2 for general security controls. These frameworks tell you exactly what security settings your AWS environment must have—for instance, all data must be encrypted at rest and in transit, or servers must not have direct public internet access. AWS provides a service called AWS Config to help you check compliance. AWS Config evaluates your AWS resources (like servers, databases, and storage buckets) against rules you define. For example, you can create a rule that says: an Amazon S3 bucket must not be publicly readable. AWS Config will continuously evaluate all your buckets and report which ones violate the rule.
Now, what do you do when a violation is found? You could have a human read the report and manually fix the problem, but that takes time—and in security, minutes matter. Automated remediation is the process of setting up automatic responses to compliance violations. In AWS, this is often done by combining AWS Config with AWS Lambda (a serverless function that runs code on demand). The pattern is: AWS Config detects a violation, it sends a notification to Amazon Simple Notification Service (SNS) which triggers a Lambda function. That Lambda function then runs code to fix the issue—for example, removing a public IP address from a database or closing an open security group rule.
Why does this matter? Without auditing, you are blind. You do not know if someone exposed sensitive data or if an attacker gained access. Without a compliance framework, you do not have a consistent standard to measure against. Without automated remediation, you rely on slow human response. Cloud environments change constantly—new resources are created, permissions change, and misconfigurations happen. Automated auditing and remediation turns security from a reactive chore into an automated safety system.
The key AWS services for this topic are: AWS CloudTrail for logging API calls, AWS Config for continuous compliance monitoring, AWS Lambda for automated fixes, Amazon SNS for notifications, and AWS Organizations if you manage multiple AWS accounts. You must also understand AWS KMS (Key Management Service) for encryption compliance, and Amazon GuardDuty for threat detection (which can also feed into remediation workflows). The exam will expect you to know how these services fit together, not just what each one does alone.
Enable AWS CloudTrail in all regions
Create a trail that logs all management events (create, modify, delete actions on resources) across all AWS regions. By default, CloudTrail logs are written to an Amazon S3 bucket. Enable log file validation to protect against tampering, and set a lifecycle policy to move older logs to Amazon S3 Glacier for long-term retention. This step ensures you have a complete audit trail.
Enable AWS Config and define compliance rules
Turn on AWS Config in each region where you have resources. AWS Config will start recording configuration changes. Then create rules—either managed rules provided by AWS (like 's3-bucket-public-read-prohibited') or custom rules using Lambda. Each rule specifies a compliance condition. AWS Config will continuously evaluate all relevant resources against these rules.
Configure Amazon SNS topic for compliance notifications
Create an SNS topic that AWS Config will use to send alerts whenever a resource becomes non-compliant. Subscribe the security team's email addresses to this topic so they receive notifications. Also, create an additional subscription that triggers a Lambda function for automated remediation.
Write and deploy the AWS Lambda remediation function
Write a Lambda function in Python (or Node.js) that receives the compliance event from SNS. The function parses the event to identify the non-compliant resource (e.g., a security group ID). It then uses the AWS SDK to fix the violation—for example, calling the 'revoke_security_group_ingress' API to remove a dangerous rule. Deploy the function with appropriate IAM permissions so it has authority to modify the resource.
Test the end-to-end pipeline
Simulate a violation by manually creating a resource that breaks your compliance rule (e.g., create an S3 bucket with public read access on a test account). Verify that AWS Config detects it within seconds, that the SNS notification fires, that the Lambda function executes, and that the resource is automatically fixed. Also confirm that CloudTrail logs both the original violation creation and the Lambda remediation action. This test validates that your auditing and automated remediation system works as designed.
Sarah is the sole security engineer at a mid-sized e-commerce company. The company stores customer payment data and must comply with PCI DSS. Every quarter, an external auditor asks for evidence that Sarah's AWS environment is secure. Without proper auditing, Sarah would have to manually screenshot console pages and hope the auditor believes her. Instead, she uses AWS CloudTrail to log every API call and AWS Config to prove that all S3 buckets containing payment data are encrypted. The auditor is happy because the logs are unchangeable and show a clean history.
One night, a developer, Mark, deploys a new application server for testing. In his hurry, Mark accidentally creates a security group rule that allows traffic from 0.0.0.0/0 (the entire internet) on port 22 (SSH, used for remote administration). This is a classic misconfiguration that could let an attacker break into the server.
Here is what happens step by step in a properly configured environment:
AWS Config continuously evaluates all security groups against a rule named 'restricted-ssh'. This rule says: no security group may allow inbound traffic on port 22 from 0.0.0.0/0.
When Mark saves the new security group, AWS Config immediately detects a non-compliant resource. It writes a configuration item to its database and sends a notification to Amazon SNS.
The SNS topic has a subscription that triggers an AWS Lambda function named 'auto-remediate-ssh'. The Lambda function receives the details of the violating security group.
The Lambda function runs a script in Python that removes the offending inbound rule from the security group. It also logs the action to CloudTrail for audit purposes.
Simultaneously, the SNS topic sends an email to Sarah and Mark alerting them that a non-compliant rule was created and then automatically removed.
The next morning, Sarah sees the email. She checks CloudTrail logs and sees exactly who created the rule and when, and that Lambda removed it within seconds. She does not need to reprimand Mark—she simply uses the audit trail in a team meeting to discuss why the automated remediation exists and how to avoid repeating the mistake.
When the quarterly auditor arrives, Sarah provides two reports: one from AWS Config showing the compliance score (100% for the quarter, because violations were fixed in seconds), and one from CloudTrail showing that only authorised users made changes. The auditor leaves satisfied, and Sarah avoids a PCI DSS fine. This concrete scenario shows how auditing, compliance frameworks, and automated remediation work together to protect the company, satisfy auditors, and reduce manual work.
The SCS-C02 exam devotes an entire domain (5.2) to designing and implementing auditing and automated remediation. You will see scenario-based multiple-choice questions that test your ability to choose the correct AWS service for a given requirement. The exam is heavy on the differences between services—do not just know what each service does; know when to use one versus another.
Common question types: - 'A company needs to record all API calls made in their AWS account and retain them for seven years. Which service should they use?' The answer is AWS CloudTrail (with an S3 bucket that has a lifecycle policy to move logs to Amazon S3 Glacier for long-term storage). Trap: they might offer AWS Config as a distractor, but Config evaluates resource configurations, not API calls. - 'A security team wants to automatically revoke a security group rule that exposes a database to the internet. Which combination of services should they use?' Correct answer: AWS Config + AWS Lambda. Trap: they might suggest AWS CloudTrail + Amazon EventBridge, but CloudTrail logs actions—it does not evaluate compliance. AWS Config is the one that checks rules. - 'An auditor requires proof that all S3 buckets are encrypted at rest. What is the most efficient way to prove this?' Answer: Use AWS Config with a managed rule called 's3-bucket-server-side-encryption-enabled'. Trap: manually checking each bucket in the console is inefficient and error-prone.
Key concepts to memorise:
AWS CloudTrail: logs API calls. Use for forensics and compliance reporting. Immutable when stored in an S3 bucket with versioning enabled.
AWS Config: evaluates resource configurations against rules. Provides a compliance scorecard. Can trigger automated remediation via Lambda.
AWS Lambda: serverless compute. Used to run remediation code in response to events from Config or SNS.
Amazon SNS: notification service. Used to trigger Lambda functions or email humans when violations occur.
AWS Organizations: use with Config to enable compliance across multiple accounts (multi-account strategy).
AWS KMS: Key Management Service. Required for encryption compliance rules.
Trap patterns to watch for:
They will ask for a solution that 'records user activity'—that is CloudTrail, not Config.
They will ask for 'continuous compliance monitoring'—that is Config, not CloudTrail.
They will offer Amazon Inspector as a remediation tool, but Inspector only scans for vulnerabilities—it does not fix them.
They will suggest AWS Systems Manager Automation instead of Lambda. Both can run remediation, but Lambda is the standard for event-driven automated remediation triggered by Config. Systems Manager Automation is better for operational tasks like patching, but for compliance violations, Lambda is the expected answer.
They will distract you with 'Amazon Macie' (which discovers sensitive data) or 'AWS Trusted Advisor' (which gives best-practice recommendations but does not evaluate compliance frameworks).
The exam expects you to design a pipeline: detection (Config) -> notification (SNS) -> action (Lambda) -> logging (CloudTrail). If a question describes a scenario where a misconfiguration must be fixed within minutes, and the answer does not include Lambda or a similar automation, it is wrong.
AWS CloudTrail records every API call in your account for auditing and forensic investigation.
AWS Config continuously evaluates your resource configurations against compliance rules and provides a running compliance score.
Automated remediation uses AWS Config to detect violations and AWS Lambda to fix them without human intervention.
Compliance frameworks like PCI DSS and HIPAA require evidence of ongoing monitoring, which both CloudTrail and Config provide.
CloudTrail logs are immutable when stored in an S3 bucket with versioning enabled, making them tamper-proof for auditors.
A complete auditing and remediation pipeline is: AWS Config detects violation, sends to Amazon SNS, triggers AWS Lambda, which runs remediation code and logs to CloudTrail.
Exam questions frequently test your ability to differentiate between CloudTrail (logging) and Config (compliance monitoring).
Never rely on manual checks for compliance—automated services are the only scalable solution for cloud environments.
These come up on the exam all the time. Here's how to tell them apart.
AWS CloudTrail
Logs API calls made by users, roles, or services
Provides a history of who did what and when
Useful for forensic investigations and user accountability
AWS Config
Records and evaluates resource configurations
Checks resources against compliance rules
Useful for ongoing compliance monitoring and scorecards
Manual Remediation
A human must read alerts and manually fix issues
Slow response time—minutes to hours
Prone to human error and inconsistent fixes
Automated Remediation
A Lambda function or Systems Manager Automation fixes issues in seconds
Consistent and repeatable for every violation
Requires upfront coding and testing but scales infinitely
Compliance Framework (e.g., PCI DSS)
Mandatory set of controls with legal penalties for non-compliance
Audited by external third parties
Requires specific evidence like audit logs and config reports
Security Best Practice (e.g., AWS Trusted Advisor)
Optional recommendations for improving security posture
No legal requirement to follow them
Used for guidance, not regulatory evidence
AWS Lambda for Remediation
Event-driven: triggered by SNS or Config
Ideal for simple, idempotent fixes like deleting a rule
Runs custom code in Python, Node.js, etc.
AWS Systems Manager Automation
Runbook-based: follows a predefined workflow
Better for multi-step operations like patching or restarting services
Uses pre-built or custom automation documents (SSM documents)
Mistake
AWS CloudTrail and AWS Config do the same thing, so you only need one of them.
Correct
CloudTrail logs API calls (who did what), whereas Config evaluates resource configurations (what is the current state of my resources). You need both for a complete audit and compliance solution.
The names sound similar and both generate logs. Beginners often see them both as 'logging services' without understanding the different data they capture.
Mistake
If I enable CloudTrail, I automatically become compliant with all compliance frameworks like PCI DSS.
Correct
CloudTrail is just one logging tool. Compliance frameworks require a whole set of controls—encryption, access management, network security, and more. CloudTrail alone does not make you compliant.
Marketing materials for AWS often highlight CloudTrail as a key audit tool, leading beginners to overestimate its role. They forget that compliance requires assessment against specific rules, which is what AWS Config does.
Mistake
Automated remediation means I never need to look at my environment again.
Correct
Automated remediation fixes specific, defined misconfigurations, but it cannot handle every scenario. You still need human oversight to review logs, update remediation rules, and handle complex threats that automation cannot predict.
The word 'automated' gives a false sense of total safety. Beginners think it is like setting a robot cleaner and forgetting about it, but security requires ongoing human attention.
Mistake
AWS Config rules are the same as security group rules.
Correct
AWS Config rules are compliance policies (like 'no public S3 buckets'), whereas security group rules are network firewall rules (like 'allow HTTP traffic from IP 1.2.3.4'). They operate at completely different levels.
Both are called 'rules' and both deal with security. Beginners conflate the two because the term 'rule' is overloaded in cloud security.
Mistake
If I use AWS Organizations, I do not need to enable CloudTrail in each individual account.
Correct
AWS Organizations can enable CloudTrail across all accounts from a central place, but CloudTrail must still be active in each account to capture logs. There is no way to log an account's API calls without CloudTrail running in that account.
Central management consoles like AWS Organizations create the illusion that settings propagate automatically. In reality, CloudTrail is a per-account or per-Region service that must be configured explicitly.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
CloudTrail logs every API call (who did what, when, and from where), while Config records and evaluates the configuration of your resources (e.g., is this S3 bucket public?). Think of CloudTrail as the security camera and Config as the rulebook that checks if the room is in order.
Yes. CloudTrail has a free tier (one trail per account for management events), but additional trails and data events cost money. AWS Config charges per configuration item recorded and per rule evaluation. Both are relatively low cost for standard use but can become expensive at very large scales.
Yes, AWS Config can be set up with automatic remediation using AWS Systems Manager Automation or AWS Lambda. When a violation is detected, Config can trigger a remediation action that runs a predefined script to fix the issue.
A compliance framework is a set of security standards and controls, like PCI DSS for credit card data or HIPAA for health data. You do not have to use one unless your industry requires it, but using a framework helps you prove to auditors that your environment is secure.
It depends on your compliance requirements. PCI DSS requires logs to be retained for at least one year, with immediate access for three months. Many organisations keep logs for seven years using Amazon S3 Glacier to reduce cost. The exam expects you to know that you can use S3 lifecycle policies to move logs to colder storage.
You should set up error handling. The Lambda function can log the failure to CloudTrail and send a notification via SNS to an administrator. You can also configure a dead-letter queue (Amazon SQS) to capture failed events for later investigation. The exam tests your ability to design resilient remediation workflows.
You've finished Auditing, Compliance Frameworks, and Automated Remediation. Continue through the SCS-C02 study guide to build a complete picture of the exam.
Done with this chapter?