# Auditing, Compliance Frameworks, and Automated Remediation

> Chapter 15 of the Courseiva AWS-SECURITY-SPECIALTY curriculum — https://courseiva.com/learn/aws-security-specialty/auditing-and-remediation

**Official objective:** 5.2 — Design and implement auditing and automated remediation

## Introduction

If you misconfigure a cloud server and leave a database open to the internet, a hacker can steal thousands of customer records overnight—that is the real-world consequence of not having auditing and automated remediation. Auditing and automated remediation is the system that watches everything you do in the cloud and, when something breaks the rules, either alerts you or fixes it automatically. For the SCS-C02 exam, understanding how to design this safety net is critical because the exam will test whether you know which AWS services to use, what logs to check, and how to chain them together to prevent or respond to security incidents.

## The Restaurant Health Inspector Analogy

A health inspector is the person who arrives unannounced to check whether a restaurant follows the rules. They walk through the kitchen, check fridge temperatures, look for expired ingredients, and ensure staff wash their hands. They then write a report listing every violation—like a leaky sink or raw chicken stored above salad. The restaurant owner cannot argue that no one saw the leak; the report is evidence. If there are serious issues, the inspector can issue a fine, require a re-inspection, or even shut the restaurant down.

In the cloud world, an auditor uses logs and monitoring tools to check whether your AWS account follows rules called compliance frameworks. Instead of walking through a kitchen, they review an AWS CloudTrail log of every action taken in your account, or a AWS Config report showing whether your servers have the correct security settings. If a server—technically an Amazon EC2 instance—is open to the whole internet when it should be locked down, that is a violation in the report.

Now imagine a smart restaurant that automatically fixes its own violations. When the fridge gets too warm, a sensor triggers the cooling system to turn on before the food spoils. In AWS, that is automated remediation: a rule that detects a non-compliant resource and fixes it—for example, automatically closing a public-facing database port the moment it is opened. The health inspector never even needs to write a ticket, because the restaurant heals itself.

## Core explanation

Let us start with the core idea: every action you take in Amazon Web Services (AWS) is a series of digital commands. You tell the cloud to create a server, open a firewall port, or grant a user permission to delete files. These commands are called API calls, short for Application Programming Interface calls. An API is simply a way for one piece of software to talk to another.

To audit means to record and review every API call so you can later answer the question: Who did what, when, and from where? In AWS, the service that records all API calls is called AWS CloudTrail. Think of it like a black box on an aeroplane—it logs everything. When you enable CloudTrail, it writes a log file to an Amazon S3 bucket (a storage container) containing details like the identity of the person who made the call, the time, the source IP address, and the result (success or failure). These logs are immutable, meaning they cannot be changed after they are written, which prevents someone from tampering with evidence.

Compliance frameworks are sets of rules that your organisation must follow. Examples include PCI DSS for credit card data, HIPAA for health information, and SOC 2 for general security controls. These frameworks tell you exactly what security settings your AWS environment must have—for instance, all data must be encrypted at rest and in transit, or servers must not have direct public internet access. AWS provides a service called AWS Config to help you check compliance. AWS Config evaluates your AWS resources (like servers, databases, and storage buckets) against rules you define. For example, you can create a rule that says: an Amazon S3 bucket must not be publicly readable. AWS Config will continuously evaluate all your buckets and report which ones violate the rule.

Now, what do you do when a violation is found? You could have a human read the report and manually fix the problem, but that takes time—and in security, minutes matter. Automated remediation is the process of setting up automatic responses to compliance violations. In AWS, this is often done by combining AWS Config with AWS Lambda (a serverless function that runs code on demand). The pattern is: AWS Config detects a violation, it sends a notification to Amazon Simple Notification Service (SNS) which triggers a Lambda function. That Lambda function then runs code to fix the issue—for example, removing a public IP address from a database or closing an open security group rule.

Why does this matter? Without auditing, you are blind. You do not know if someone exposed sensitive data or if an attacker gained access. Without a compliance framework, you do not have a consistent standard to measure against. Without automated remediation, you rely on slow human response. Cloud environments change constantly—new resources are created, permissions change, and misconfigurations happen. Automated auditing and remediation turns security from a reactive chore into an automated safety system.

The key AWS services for this topic are: AWS CloudTrail for logging API calls, AWS Config for continuous compliance monitoring, AWS Lambda for automated fixes, Amazon SNS for notifications, and AWS Organizations if you manage multiple AWS accounts. You must also understand AWS KMS (Key Management Service) for encryption compliance, and Amazon GuardDuty for threat detection (which can also feed into remediation workflows). The exam will expect you to know how these services fit together, not just what each one does alone.

## Real-world context

Sarah is the sole security engineer at a mid-sized e-commerce company. The company stores customer payment data and must comply with PCI DSS. Every quarter, an external auditor asks for evidence that Sarah's AWS environment is secure. Without proper auditing, Sarah would have to manually screenshot console pages and hope the auditor believes her. Instead, she uses AWS CloudTrail to log every API call and AWS Config to prove that all S3 buckets containing payment data are encrypted. The auditor is happy because the logs are unchangeable and show a clean history.

One night, a developer, Mark, deploys a new application server for testing. In his hurry, Mark accidentally creates a security group rule that allows traffic from 0.0.0.0/0 (the entire internet) on port 22 (SSH, used for remote administration). This is a classic misconfiguration that could let an attacker break into the server.

Here is what happens step by step in a properly configured environment:

- AWS Config continuously evaluates all security groups against a rule named 'restricted-ssh'. This rule says: no security group may allow inbound traffic on port 22 from 0.0.0.0/0.
- When Mark saves the new security group, AWS Config immediately detects a non-compliant resource. It writes a configuration item to its database and sends a notification to Amazon SNS.
- The SNS topic has a subscription that triggers an AWS Lambda function named 'auto-remediate-ssh'. The Lambda function receives the details of the violating security group.
- The Lambda function runs a script in Python that removes the offending inbound rule from the security group. It also logs the action to CloudTrail for audit purposes.
- Simultaneously, the SNS topic sends an email to Sarah and Mark alerting them that a non-compliant rule was created and then automatically removed.

The next morning, Sarah sees the email. She checks CloudTrail logs and sees exactly who created the rule and when, and that Lambda removed it within seconds. She does not need to reprimand Mark—she simply uses the audit trail in a team meeting to discuss why the automated remediation exists and how to avoid repeating the mistake.

When the quarterly auditor arrives, Sarah provides two reports: one from AWS Config showing the compliance score (100% for the quarter, because violations were fixed in seconds), and one from CloudTrail showing that only authorised users made changes. The auditor leaves satisfied, and Sarah avoids a PCI DSS fine. This concrete scenario shows how auditing, compliance frameworks, and automated remediation work together to protect the company, satisfy auditors, and reduce manual work.

## Exam focus

The SCS-C02 exam devotes an entire domain (5.2) to designing and implementing auditing and automated remediation. You will see scenario-based multiple-choice questions that test your ability to choose the correct AWS service for a given requirement. The exam is heavy on the differences between services—do not just know what each service does; know when to use one versus another.

Common question types:
- 'A company needs to record all API calls made in their AWS account and retain them for seven years. Which service should they use?' The answer is AWS CloudTrail (with an S3 bucket that has a lifecycle policy to move logs to Amazon S3 Glacier for long-term storage). Trap: they might offer AWS Config as a distractor, but Config evaluates resource configurations, not API calls.
- 'A security team wants to automatically revoke a security group rule that exposes a database to the internet. Which combination of services should they use?' Correct answer: AWS Config + AWS Lambda. Trap: they might suggest AWS CloudTrail + Amazon EventBridge, but CloudTrail logs actions—it does not evaluate compliance. AWS Config is the one that checks rules.
- 'An auditor requires proof that all S3 buckets are encrypted at rest. What is the most efficient way to prove this?' Answer: Use AWS Config with a managed rule called 's3-bucket-server-side-encryption-enabled'. Trap: manually checking each bucket in the console is inefficient and error-prone.

Key concepts to memorise:
- AWS CloudTrail: logs API calls. Use for forensics and compliance reporting. Immutable when stored in an S3 bucket with versioning enabled.
- AWS Config: evaluates resource configurations against rules. Provides a compliance scorecard. Can trigger automated remediation via Lambda.
- AWS Lambda: serverless compute. Used to run remediation code in response to events from Config or SNS.
- Amazon SNS: notification service. Used to trigger Lambda functions or email humans when violations occur.
- AWS Organizations: use with Config to enable compliance across multiple accounts (multi-account strategy).
- AWS KMS: Key Management Service. Required for encryption compliance rules.

Trap patterns to watch for:
- They will ask for a solution that 'records user activity'—that is CloudTrail, not Config.
- They will ask for 'continuous compliance monitoring'—that is Config, not CloudTrail.
- They will offer Amazon Inspector as a remediation tool, but Inspector only scans for vulnerabilities—it does not fix them.
- They will suggest AWS Systems Manager Automation instead of Lambda. Both can run remediation, but Lambda is the standard for event-driven automated remediation triggered by Config. Systems Manager Automation is better for operational tasks like patching, but for compliance violations, Lambda is the expected answer.
- They will distract you with 'Amazon Macie' (which discovers sensitive data) or 'AWS Trusted Advisor' (which gives best-practice recommendations but does not evaluate compliance frameworks).

The exam expects you to design a pipeline: detection (Config) -> notification (SNS) -> action (Lambda) -> logging (CloudTrail). If a question describes a scenario where a misconfiguration must be fixed within minutes, and the answer does not include Lambda or a similar automation, it is wrong.

## Step by step

1. **Enable AWS CloudTrail in all regions** — Create a trail that logs all management events (create, modify, delete actions on resources) across all AWS regions. By default, CloudTrail logs are written to an Amazon S3 bucket. Enable log file validation to protect against tampering, and set a lifecycle policy to move older logs to Amazon S3 Glacier for long-term retention. This step ensures you have a complete audit trail.
2. **Enable AWS Config and define compliance rules** — Turn on AWS Config in each region where you have resources. AWS Config will start recording configuration changes. Then create rules—either managed rules provided by AWS (like 's3-bucket-public-read-prohibited') or custom rules using Lambda. Each rule specifies a compliance condition. AWS Config will continuously evaluate all relevant resources against these rules.
3. **Configure Amazon SNS topic for compliance notifications** — Create an SNS topic that AWS Config will use to send alerts whenever a resource becomes non-compliant. Subscribe the security team's email addresses to this topic so they receive notifications. Also, create an additional subscription that triggers a Lambda function for automated remediation.
4. **Write and deploy the AWS Lambda remediation function** — Write a Lambda function in Python (or Node.js) that receives the compliance event from SNS. The function parses the event to identify the non-compliant resource (e.g., a security group ID). It then uses the AWS SDK to fix the violation—for example, calling the 'revoke_security_group_ingress' API to remove a dangerous rule. Deploy the function with appropriate IAM permissions so it has authority to modify the resource.
5. **Test the end-to-end pipeline** — Simulate a violation by manually creating a resource that breaks your compliance rule (e.g., create an S3 bucket with public read access on a test account). Verify that AWS Config detects it within seconds, that the SNS notification fires, that the Lambda function executes, and that the resource is automatically fixed. Also confirm that CloudTrail logs both the original violation creation and the Lambda remediation action. This test validates that your auditing and automated remediation system works as designed.

## Comparisons

### AWS CloudTrail vs AWS Config

**AWS CloudTrail:**
- Logs API calls made by users, roles, or services
- Provides a history of who did what and when
- Useful for forensic investigations and user accountability

**AWS Config:**
- Records and evaluates resource configurations
- Checks resources against compliance rules
- Useful for ongoing compliance monitoring and scorecards

### Manual Remediation vs Automated Remediation

**Manual Remediation:**
- A human must read alerts and manually fix issues
- Slow response time—minutes to hours
- Prone to human error and inconsistent fixes

**Automated Remediation:**
- A Lambda function or Systems Manager Automation fixes issues in seconds
- Consistent and repeatable for every violation
- Requires upfront coding and testing but scales infinitely

### Compliance Framework (e.g., PCI DSS) vs Security Best Practice (e.g., AWS Trusted Advisor)

**Compliance Framework (e.g., PCI DSS):**
- Mandatory set of controls with legal penalties for non-compliance
- Audited by external third parties
- Requires specific evidence like audit logs and config reports

**Security Best Practice (e.g., AWS Trusted Advisor):**
- Optional recommendations for improving security posture
- No legal requirement to follow them
- Used for guidance, not regulatory evidence

### AWS Lambda for Remediation vs AWS Systems Manager Automation

**AWS Lambda for Remediation:**
- Event-driven: triggered by SNS or Config
- Ideal for simple, idempotent fixes like deleting a rule
- Runs custom code in Python, Node.js, etc.

**AWS Systems Manager Automation:**
- Runbook-based: follows a predefined workflow
- Better for multi-step operations like patching or restarting services
- Uses pre-built or custom automation documents (SSM documents)

## Diagram

_An end-to-end auditing and automated remediation pipeline: user actions are logged by CloudTrail, AWS Config checks compliance, and violations automatically trigger Lambda to fix the issue while logging everything for auditors._

```mermaid
flowchart TD
    A[User makes API call] --> B[AWS CloudTrail logs action]
    B --> C[S3 bucket for audit logs]
    D[AWS Config evaluates resource]
    D --> E{Compliant?}
    E -- Yes --> F[No action needed]
    E -- No --> G[Amazon SNS notification]
    G --> H[AWS Lambda remediation function]
    H --> I[Fix the violation]
    I --> J[Log fix to CloudTrail]
    C --> K[Auditor reviews logs]
    F --> K
```

## Common misconceptions

- **Misconception:** AWS CloudTrail and AWS Config do the same thing, so you only need one of them. **Reality:** CloudTrail logs API calls (who did what), whereas Config evaluates resource configurations (what is the current state of my resources). You need both for a complete audit and compliance solution. (The names sound similar and both generate logs. Beginners often see them both as 'logging services' without understanding the different data they capture.)
- **Misconception:** If I enable CloudTrail, I automatically become compliant with all compliance frameworks like PCI DSS. **Reality:** CloudTrail is just one logging tool. Compliance frameworks require a whole set of controls—encryption, access management, network security, and more. CloudTrail alone does not make you compliant. (Marketing materials for AWS often highlight CloudTrail as a key audit tool, leading beginners to overestimate its role. They forget that compliance requires assessment against specific rules, which is what AWS Config does.)
- **Misconception:** Automated remediation means I never need to look at my environment again. **Reality:** Automated remediation fixes specific, defined misconfigurations, but it cannot handle every scenario. You still need human oversight to review logs, update remediation rules, and handle complex threats that automation cannot predict. (The word 'automated' gives a false sense of total safety. Beginners think it is like setting a robot cleaner and forgetting about it, but security requires ongoing human attention.)
- **Misconception:** AWS Config rules are the same as security group rules. **Reality:** AWS Config rules are compliance policies (like 'no public S3 buckets'), whereas security group rules are network firewall rules (like 'allow HTTP traffic from IP 1.2.3.4'). They operate at completely different levels. (Both are called 'rules' and both deal with security. Beginners conflate the two because the term 'rule' is overloaded in cloud security.)
- **Misconception:** If I use AWS Organizations, I do not need to enable CloudTrail in each individual account. **Reality:** AWS Organizations can enable CloudTrail across all accounts from a central place, but CloudTrail must still be active in each account to capture logs. There is no way to log an account's API calls without CloudTrail running in that account. (Central management consoles like AWS Organizations create the illusion that settings propagate automatically. In reality, CloudTrail is a per-account or per-Region service that must be configured explicitly.)

## Key takeaways

- AWS CloudTrail records every API call in your account for auditing and forensic investigation.
- AWS Config continuously evaluates your resource configurations against compliance rules and provides a running compliance score.
- Automated remediation uses AWS Config to detect violations and AWS Lambda to fix them without human intervention.
- Compliance frameworks like PCI DSS and HIPAA require evidence of ongoing monitoring, which both CloudTrail and Config provide.
- CloudTrail logs are immutable when stored in an S3 bucket with versioning enabled, making them tamper-proof for auditors.
- A complete auditing and remediation pipeline is: AWS Config detects violation, sends to Amazon SNS, triggers AWS Lambda, which runs remediation code and logs to CloudTrail.
- Exam questions frequently test your ability to differentiate between CloudTrail (logging) and Config (compliance monitoring).
- Never rely on manual checks for compliance—automated services are the only scalable solution for cloud environments.

## FAQ

**What is the difference between AWS CloudTrail and AWS Config?**

CloudTrail logs every API call (who did what, when, and from where), while Config records and evaluates the configuration of your resources (e.g., is this S3 bucket public?). Think of CloudTrail as the security camera and Config as the rulebook that checks if the room is in order.

**Do I need to pay extra for AWS CloudTrail and AWS Config?**

Yes. CloudTrail has a free tier (one trail per account for management events), but additional trails and data events cost money. AWS Config charges per configuration item recorded and per rule evaluation. Both are relatively low cost for standard use but can become expensive at very large scales.

**Can I use AWS Config to automatically fix security issues?**

Yes, AWS Config can be set up with automatic remediation using AWS Systems Manager Automation or AWS Lambda. When a violation is detected, Config can trigger a remediation action that runs a predefined script to fix the issue.

**What is a compliance framework and do I have to use one?**

A compliance framework is a set of security standards and controls, like PCI DSS for credit card data or HIPAA for health data. You do not have to use one unless your industry requires it, but using a framework helps you prove to auditors that your environment is secure.

**How long should I keep CloudTrail logs?**

It depends on your compliance requirements. PCI DSS requires logs to be retained for at least one year, with immediate access for three months. Many organisations keep logs for seven years using Amazon S3 Glacier to reduce cost. The exam expects you to know that you can use S3 lifecycle policies to move logs to colder storage.

**What happens if my Lambda remediation function fails?**

You should set up error handling. The Lambda function can log the failure to CloudTrail and send a notification via SNS to an administrator. You can also configure a dead-letter queue (Amazon SQS) to capture failed events for later investigation. The exam tests your ability to design resilient remediation workflows.

## Check your understanding

1. **Which AWS service would you use to record every time a user creates an Amazon EC2 instance in your account?**

   Answer: AWS CloudTrail, because it logs all API calls including EC2 instance creation requests.

2. **A company needs to be notified whenever an S3 bucket becomes publicly readable, and the bucket should be automatically made private again. Which combination of AWS services should be used?**

   Answer: AWS Config to detect the non-compliant bucket, Amazon SNS to notify, and AWS Lambda to run a script that makes the bucket private.

3. **What is the primary difference between AWS CloudTrail and AWS Config?**

   Answer: CloudTrail logs API calls (actions), while Config evaluates the configuration of resources against compliance rules.

4. **Why is it important to enable log file validation on an S3 bucket storing CloudTrail logs?**

   Answer: Log file validation creates a digital signature for each log file, making it possible to detect tampering and prove the logs are authentic to an auditor.

5. **If an exam question describes a scenario where a company must 'continuously evaluate whether their EC2 instances are using a specific Amazon Machine Image (AMI)' what service should you choose?**

   Answer: AWS Config, because it can continuously evaluate resources against rules, including checking the AMI ID of running instances.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/aws-security-specialty/auditing-and-remediation