Governing an AI system means being able to answer an auditor's questions with evidence: who did what, how resources were set up, whether anything is vulnerable, and whether AWS itself meets the standards you rely on. AWS has a different service for each of those questions. The exam tests whether you can match a governance or compliance need to the right one, and several of these services sound alike, so this lesson focuses on telling them apart.
Recording Activity and Configuration
AWS CloudTrail records API activity in your account: which identity made a call, what it called, when, and from where. Every action against Amazon Bedrock or SageMaker AI, such as creating a guardrail or deleting a custom model, shows up as an event. The event history keeps the last 90 days of management events at no extra setup; for longer retention you create a trail that delivers events to Amazon S3, or use CloudTrail Lake.
AWS Config records how your resources are configured and how that configuration changes over time, including how resources relate to each other. Config rules then evaluate those settings continuously, for example "every S3 bucket holding training data must have default encryption", and flag resources that break the rule as noncompliant.
A quick way to separate them: CloudTrail answers "who did this?", while Config answers "what did this resource look like, and is it compliant?"
Finding Vulnerabilities and Sensitive Data
Amazon Inspector scans workloads such as Amazon EC2 instances, container images and Lambda functions for software vulnerabilities and unintended network exposure, and reports each issue as a finding. It matters for self-hosted models, where you run the operating system and libraries yourself.
Amazon Macie is a different job: it discovers sensitive data, such as personal information, stored in Amazon S3. If the question is about vulnerable software, think Inspector; if it's about personal data sitting in a bucket, think Macie.
Compliance Evidence From AWS
AWS Artifact is a self-service portal for AWS's own security and compliance documents: reports such as SOC reports, ISO certifications and PCI attestations, plus agreements you can accept with AWS. When an auditor wants proof that the AWS services under your AI system meet a standard, Artifact is where you download it.
Recommendations and Monitoring
AWS Trusted Advisor inspects your account and recommends improvements across six categories: cost optimization, performance, security, fault tolerance, service limits and operational excellence. Its security checks include things like public S3 bucket permissions and missing MFA on the root user.
Amazon CloudWatch collects metrics and logs and raises alarms when a value crosses a threshold. Amazon Bedrock, for example, publishes invocation counts, latency and token counts to CloudWatch, so a team can be alerted to unusual usage.
Which Service Answers Which Audit Question
| Question from an auditor or governance team | Service |
|---|---|
| Who deleted that guardrail, and when? | AWS CloudTrail |
| Was this bucket encrypted last month, and is it compliant now? | AWS Config |
| Does the model server have vulnerable software? | Amazon Inspector |
| Is there personal data in our training-data buckets? | Amazon Macie |
| Where is AWS's SOC or PCI report? | AWS Artifact |
| What should we fix for cost, security and resilience? | AWS Trusted Advisor |
| Alert us when token usage spikes | Amazon CloudWatch |
On the Exam
The common traps are the look-alike pairs. CloudTrail and Config both "track changes", but only CloudTrail records the identity behind each API call. Inspector and Macie both "find problems", but Inspector looks for software vulnerabilities and Macie looks for sensitive data. Artifact gives you AWS's compliance reports; it doesn't check your own resources.