SCS-C03 · Domain 6 of 6

SCS-C03 Domain 6: Security Foundations and Governance

Domain 6 covers the account and policy foundation that every other control rests on: structuring AWS accounts centrally, deploying resources consistently and securely, and proving that resources stay compliant.

Exam weight
14%
Official task statements
3
Estimated questions estimate
~7
Suggested study time estimate
10–14 hrs

About 12 min read Reviewed October 2026

Overview

Security Foundations and Governance has three task statements. Task 6.1 covers central account management: AWS Organizations, AWS Control Tower in new and existing environments with optional and custom controls, organization policies such as SCPs, RCPs, AI service opt-out policies and declarative policies, delegated administrator accounts for security services, and root user credential management, including centralized root access for member accounts, MFA and break-glass procedures.

Task 6.2 covers consistent deployment: CloudFormation StackSets and third-party IaC, CloudFormation Guard and cfn-lint checks, tagging strategies, central enforcement with AWS Firewall Manager, and sharing through Service Catalog and AWS RAM. Task 6.3 covers compliance: AWS Config rules and remediation, Security Hub, evidence collection with Audit Manager and AWS Artifact, and reviews with the AWS Well-Architected Tool.

How it's tested

Domain 6 scenarios usually describe a growing multi-account estate and a governance goal, then ask for the most scalable preventive, detective or proactive control. Answers differ mainly in scope, from one account to the whole organization, and in whether the control stops or only reports.

  • Preventive or detective

    A rule must hold across accounts, and you decide whether an SCP, RCP or declarative policy prevents it or a Config rule detects it.

  • Central deployment

    Baselines, firewall rules or shared resources must reach many accounts, and you choose StackSets, Firewall Manager, Service Catalog or AWS RAM.

  • Prove compliance

    Auditors need evidence or a posture report, and you pick Config conformance packs, Security Hub standards, Audit Manager or AWS Artifact.

Reasoning it through

A company wants to make sure no member account can ever disable CloudTrail or leave the organization, including future accounts. A Config rule would only report the change after it happened. An SCP attached to the root or relevant OUs that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail and organizations:LeaveOrganization prevents both actions for every principal in member accounts, including their root users.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

6.1 Develop a strategy to centrally deploy and manage AWS accountsOrganizations, Control Tower, organization policies, delegated admins and root credentials.
What it means
This task statement covers deploying and configuring AWS Organizations, implementing Control Tower in new and existing environments with optional and custom controls, applying organization policies such as SCPs, RCPs, AI service opt-out policies and declarative policies, centrally managing security services with delegated administrator accounts, and managing root user credentials through centralized root access, MFA and break-glass design.
What to understand
Organize accounts into OUs by function, such as security, log archive, infrastructure, workloads and sandbox. Control Tower sets up a landing zone with log archive and audit accounts and applies preventive, detective and proactive controls. SCPs cap what principals in member accounts can do; RCPs cap what can be done to their resources; declarative policies enforce service configuration such as blocking public AMI sharing. Centralized root access lets the management account remove root credentials from members and perform privileged tasks when needed.
How it shows up
Expect a question about where to apply a guardrail and which policy type stops a principal, protects a resource or locks a configuration.
Common confusion
Believing SCPs restrict the management account; they apply only to member accounts.
6.2 Implement a secure and consistent deployment strategy for cloud resourcesInfrastructure as code, tagging, central policy enforcement and secure resource sharing.
What it means
This task statement covers using infrastructure as code to deploy resources consistently and securely across accounts with CloudFormation StackSets, third-party IaC tools, CloudFormation Guard and cfn-lint, organizing resources with tags by department, cost center or environment, deploying and enforcing policies from a central source with AWS Firewall Manager, and sharing resources securely with AWS Service Catalog and AWS RAM.
What to understand
StackSets with service-managed permissions deploy baselines to every account in an OU and to new accounts automatically. CloudFormation Guard checks templates against policy-as-code rules before deployment, and cfn-lint catches template errors. Tag policies standardize tag keys and values, which also supports ABAC. Firewall Manager centrally applies AWS WAF, Shield Advanced, security group, Network Firewall and Route 53 Resolver DNS Firewall policies across accounts. Service Catalog offers approved products; AWS RAM shares subnets, Transit Gateways and other resources within the organization.
How it shows up
Look for words such as all accounts, automatically and new accounts; they point to organization-integrated deployment rather than per-account work.
Common confusion
Using AWS RAM to give access to S3 buckets; buckets are shared through bucket policies, not RAM.
6.3 Evaluate the compliance of AWS resourcesConfig rules and remediation, Security Hub, audit evidence and architecture reviews.
What it means
This task statement covers creating or enabling rules that detect and remediate noncompliant resources and send notifications with AWS Config aggregation, remediation and Security Hub, collecting and organizing evidence with AWS Audit Manager and AWS Artifact, and evaluating architectures against AWS security best practices with the AWS Well-Architected Tool.
What to understand
AWS Config records configuration history and evaluates managed or custom rules; an aggregator gives an organization-wide view, and automatic remediation runs Systems Manager Automation documents. Security Hub standards such as AWS Foundational Security Best Practices and CIS run Config-based checks and score posture. Audit Manager collects evidence continuously and maps it to frameworks. AWS Artifact provides AWS's own compliance reports and agreements. The Well-Architected Tool reviews workloads against the Security pillar.
How it shows up
Expect to pick the tool that matches the output requested: a rule result, remediation, an evidence package, an AWS report or a design review.
Common confusion
Confusing Audit Manager with AWS Artifact; Artifact supplies AWS's reports, while Audit Manager gathers evidence about your own resources.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Service control policy

    Organization policy that limits maximum permissions of principals in member accounts.

    Remember
    Never grants; does not affect the management account.
    Tested as
    Preventive guardrail questions.
    Trap
    Expecting it to grant access.

  • Resource control policy

    Organization policy that limits what can be done to member account resources.

    Remember
    Applies even to external principals.
    Tested as
    Data perimeter questions.
    Trap
    Confusing it with an SCP.

  • Declarative policies

    Organization policies that enforce a service configuration baseline.

    Remember
    Hold even when new APIs appear.
    Tested as
    Configuration lock questions.
    Trap
    Using Config rules to prevent changes.

  • AI service opt-out policy

    Organization policy to opt out of AWS AI services using content for improvement.

    Remember
    Applied across accounts centrally.
    Tested as
    Data use governance.
    Trap
    Setting it per account by hand.

  • AWS Control Tower

    Landing zone automation with preventive, detective and proactive controls.

    Remember
    Can enroll existing accounts.
    Tested as
    Multi-account setup questions.
    Trap
    Building everything manually with scripts.

  • Centralized root access

    Management account removes member root credentials and performs privileged root actions.

    Remember
    Reduces long-term root credentials.
    Tested as
    Root management questions.
    Trap
    Keeping root passwords in every account.

  • Delegated administrator

    Member account assigned to run a security service for the organization.

    Remember
    Keeps the management account minimal.
    Tested as
    Central security management.
    Trap
    Running everything from the management account.

  • CloudFormation StackSets

    Deploy stacks across accounts and Regions from one template.

    Remember
    Service-managed mode auto-deploys to new accounts.
    Tested as
    Baseline deployment.
    Trap
    Deploying stacks in each account manually.

  • CloudFormation Guard

    Policy-as-code checks for templates before deployment.

    Remember
    Proactive control.
    Tested as
    Shift-left compliance.
    Trap
    Relying only on post-deployment Config rules.

  • AWS Firewall Manager

    Central management of WAF, Shield Advanced, security groups and Network Firewall policies.

    Remember
    Requires Organizations and Config.
    Tested as
    Central firewall enforcement.
    Trap
    Configuring WAF per account.

  • AWS Config aggregator and remediation

    Organization-wide compliance view with automatic fixes.

    Remember
    Remediation uses Systems Manager Automation.
    Tested as
    Detect and remediate questions.
    Trap
    Treating Config as preventive.

  • Audit Manager vs. Artifact

    Evidence about your resources versus AWS's own compliance reports.

    Remember
    Different audiences.
    Tested as
    Audit evidence questions.
    Trap
    Downloading Artifact reports as proof of your controls.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Organization policy types

ConceptMeaningKey differenceCommon trap
SCP Limits principals in member accounts Identity side Expecting it to grant permissions
RCP Limits actions on member account resources Resource side, includes external callers Using it to restrict IAM users' actions
Declarative policy Enforces a service configuration Durable baseline Expecting it to manage permissions
Tag policy Standardizes tag keys and values Consistency, not access Thinking it blocks untagged resource creation by itself

Control types

ConceptMeaningKey differenceCommon trap
Preventive Stops the action SCPs, RCPs, declarative policies Choosing detection when prevention is required
Detective Reports after the fact Config rules, Security Hub Expecting it to block changes
Proactive Checks before deployment Guard and CloudFormation hooks Confusing it with preventive SCPs

Compliance evidence

ConceptMeaningKey differenceCommon trap
AWS Config Configuration history and rule evaluation Resource compliance state Using it as an audit report
Audit Manager Collects evidence mapped to frameworks Your controls Confusing it with Artifact
AWS Artifact AWS compliance reports and agreements AWS's controls Treating it as evidence of your setup

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Config rule for prevention

    What candidates pick
    Create a Config rule to stop users from making buckets public.
    Why it looks right
    Config tracks bucket settings.
    Why it's wrong
    Config evaluates after the change; prevention needs an SCP, RCP, S3 Block Public Access at the account level or a declarative policy.

    Clue to watch for The scenario says must not be able to.

  2. SCP on management account

    What candidates pick
    Attach an SCP to restrict administrators in the management account.
    Why it looks right
    SCPs restrict accounts.
    Why it's wrong
    SCPs never apply to the management account, which is why workloads and daily users should not live there.

    Clue to watch for Principals in the management account.

  3. Per-account WAF

    What candidates pick
    Script AWS WAF rules into each account's ALBs.
    Why it looks right
    Scripts are automated.
    Why it's wrong
    Firewall Manager applies and maintains WAF policies across all accounts and new resources automatically with less drift.

    Clue to watch for Many accounts and new resources keep appearing.

  4. RAM for buckets

    What candidates pick
    Share an S3 bucket with another account through AWS RAM.
    Why it looks right
    RAM shares resources.
    Why it's wrong
    S3 buckets are not RAM-shareable; cross-account bucket access uses bucket policies or access points.

    Clue to watch for The shared resource is an S3 bucket.

  5. Artifact as your evidence

    What candidates pick
    Give auditors AWS SOC reports as proof of the company's controls.
    Why it looks right
    They are official compliance reports.
    Why it's wrong
    Artifact reports cover AWS's side of shared responsibility; Audit Manager collects evidence about the customer's configuration.

    Clue to watch for Auditors ask about the company's own controls.

  6. Root passwords in every account

    What candidates pick
    Store each member account's root password and MFA in a vault.
    Why it looks right
    Break-glass access stays available.
    Why it's wrong
    Centralized root access removes member root credentials and lets the management account perform the few root-only tasks, reducing exposure.

    Clue to watch for Many member accounts and root credential risk.

Answer framework

Use these steps for Domain 6 questions about accounts, guardrails, deployment and compliance.

  1. Determine the scope: one account, an OU, the whole organization or future accounts as well, since scope rules out many per-account options.
  2. Decide whether the requirement needs prevention, proactive checks before deployment, or detection and remediation after a change has already happened in an account.
  3. Choose the policy type for prevention: SCP for principals, RCP for resources, declarative policy for service configuration, remembering none of them grant access.
  4. Deploy baselines and shared controls centrally with Control Tower, StackSets, Firewall Manager, Service Catalog or AWS RAM so new accounts inherit them.
  5. Prove compliance with Config aggregators and remediation, Security Hub standards, Audit Manager evidence and Well-Architected reviews.

Practice question

A company uses AWS Organizations with 200 member accounts. It must stop any principal outside the organization from accessing S3 objects in member accounts, even if a developer writes a bucket policy that grants public or cross-organization access. What is the most scalable solution?

Want more like this? The SCS-C03 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with the organization model. Sketch a landing zone with management, security tooling, log archive and workload OUs, and note which guardrails attach where. Learn the four organization policy types side by side: SCPs, RCPs, declarative policies and AI service opt-out policies. For each, write one example requirement it solves and one it cannot.

Then practice central deployment. If you have a sandbox organization, enable Control Tower or create StackSets with service-managed permissions and watch a new account receive the baseline. Run CloudFormation Guard against a template that creates an unencrypted bucket. Configure a Firewall Manager security group policy and see it applied across accounts.

Finish with compliance tooling. Create a Config aggregator, deploy a conformance pack and attach an automatic remediation. Compare what Audit Manager produces with what you download from AWS Artifact. Review the Security pillar of the Well-Architected Framework. In practice questions, label each answer as preventive, proactive or detective before choosing, since that single distinction settles many Domain 6 items.

FAQ

How much of SCS-C03 is Domain 6?

Security Foundations and Governance is 14% of scored content, around seven of the fifty scored questions, across three task statements.

Is this the same as SCS-C02 Domain 6?

It replaces Management and Security Governance at the same 14% weight under a new name. The SCS-C02 task on finding security gaps through architecture reviews and cost analysis was removed.

What are RCPs and declarative policies?

Resource control policies limit what can be done to resources in member accounts, even by external principals. Declarative policies lock service configurations, such as blocking public sharing of AMIs, across the organization.

Does an SCP grant permissions?

No. SCPs only set the maximum permissions for principals in member accounts. An IAM policy must still allow the action.

When should I use Firewall Manager?

Use it when WAF, Shield Advanced, security group, Network Firewall or DNS Firewall policies must be applied consistently across many accounts and to new resources automatically.

What is centralized root access?

A feature that lets the management account remove root user credentials from member accounts and perform root-only actions centrally, reducing long-term root credentials to manage.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered account structure, organization policies, root management, consistent deployment and compliance evaluation. Check how quickly you pick the right scope and control type.

Take the SCS-C03 practice test Check your SCS-C03 readiness

Keep going