AWS CloudTrail — records API activity across an account for audit and investigation.
AWS CloudTrail records API calls across an AWS account, capturing the caller identity, timestamp, source IP, and request metadata for each action. For AI workloads, Amazon Bedrock calls such as InvokeModel, ListFoundationModels, and CreateModelCustomizationJob are logged, giving compliance teams an audit trail of who invoked which model and when. CloudTrail captures the API activity, not the prompt or model output itself — that inference payload is recorded separately by Bedrock model invocation logging in CloudWatch Logs or S3. CloudTrail answers who did what and when, while CloudWatch handles operational metrics like latency and invocation counts. To prove a specific IAM user ran a Bedrock job, the answer is CloudTrail.
AWS Config — tracks resource configurations and evaluates them against compliance rules.
AWS Config is a continuous monitoring service that records the configuration history of AWS resources and evaluates those configurations against rules you define. When a resource drifts out of compliance — say, an Amazon SageMaker notebook instance loses encryption at rest — Config flags it and can trigger automated remediation via AWS Systems Manager Automation. The exam distinguishes Config from AWS CloudTrail carefully: CloudTrail captures who did what (API calls and user activity), while Config captures what the resource looks like at any point in time. For AI workloads, Config commonly checks that Bedrock or SageMaker resources stay compliant with data-governance baselines.
AWS Audit Manager continuously collects evidence from services like CloudTrail, AWS Config, and Security Hub, mapping it to controls within prebuilt frameworks such as SOC 2, HIPAA, GDPR, and NIST. This matters for AIF-C01 because AI workloads on Amazon Bedrock or SageMaker must meet data-governance requirements, and Audit Manager supplies the audit trail proving those controls are in place. The key exam distinction is purpose: it gathers ongoing compliance evidence, not real-time threats. Don’t confuse it with Security Hub (aggregates findings) or AWS Config (checks configuration rules); Audit Manager consumes their outputs to build audit-ready reports.
AWS Artifact — on-demand access to AWS compliance reports such as SOC and ISO.
AWS Artifact is a self-service portal giving customers on-demand access to AWS’s own compliance documentation — SOC 1/2/3 reports, ISO certifications, PCI DSS attestations, and similar third-party audit artifacts. Because those reports cover the AWS infrastructure layer, they supply the provider’s half of shared-responsibility audit evidence without contacting AWS support. The key exam distinction: Artifact reflects AWS’s compliance posture, not the customer’s. For AI workloads, customers still use services like Amazon Macie or AWS Security Hub to demonstrate their own application-layer controls; Artifact alone does not prove a customer’s workload is compliant.
Policies and controls for data quality, access, retention, and lifecycle.
Data governance is the framework of policies and controls that determines who can access data, how it is classified, how long it is retained, and how it moves through its lifecycle. In AI contexts, governance extends to training-data provenance and keeping datasets free of prohibited content before they feed a model. On the AIF-C01 exam, it connects to Amazon Macie for automated sensitive-data discovery in S3 and to AWS Lake Formation for fine-grained access controls on data lakes. The key distinction: governance sets the rules, while data lineage tracks how data actually flowed.
System and Organization Controls — audit reports on a provider's security controls.
System and Organization Controls (SOC) reports are independent third-party audits of a cloud provider’s internal controls. SOC 1 addresses controls relevant to financial reporting, while SOC 2 covers the trust services criteria: security, availability, processing integrity, confidentiality, and privacy. AWS maintains SOC 1, 2, and 3 reports across in-scope services, including AI services like Amazon Bedrock and SageMaker. The key exam distinction: SOC 2 is a restricted, detailed report requiring an NDA, whereas SOC 3 is a publicly shareable summary of the same audit. Customers download these on demand through AWS Artifact at no cost.
International standards such as ISO 27001 for information security management.
ISO standards set internationally recognized requirements for how organizations manage security and quality. The two most exam-relevant are ISO/IEC 27001, covering information security management systems, and ISO/IEC 42001, the newer AI management system standard for responsible AI governance. AWS holds accredited certifications under both, spanning services such as Amazon Bedrock and Amazon SageMaker. The key distinction from SOC: an ISO certification attests that AWS follows a defined management-system standard, while a SOC report (notably SOC 2 Type II) gives auditor-tested evidence of specific control effectiveness over a period. Both are available through AWS Artifact at no charge.
More Security, Compliance, and Governance for AI Solutions study sets