3.5 Management and Governance Services

AWS Certified Cloud Practitioner CLF-C02

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips

2 Domain 1: Cloud Concepts (24%)

1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics

3 Domain 2: Security and Compliance (30%)

2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security

4 Domain 3: Cloud Technology and Services (34%)

3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services

5 Domain 4: Billing, Pricing, and Support (12%)

4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services

6 AWS Services Deep Dive

5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions

3.5 Management and Governance Services

Key Takeaways Explain This Topic AI

AWS CloudFormation is Infrastructure as Code (IaC) — define AWS resources in YAML or JSON templates and deploy them consistently.

AWS Systems Manager provides a unified interface for managing AWS resources at scale, including patch management and parameter store.

AWS CloudWatch monitors AWS resources and applications, collecting metrics, setting alarms, and providing dashboards.

AWS Trusted Advisor provides guidance across six categories: cost optimization, performance, security, fault tolerance, service limits, and operational excellence.

AWS Health Dashboard shows the status of AWS services that affect your specific resources and account.

Last updated: October 2026

Quick Answer: AWS management and governance tools let you define infrastructure as code (CloudFormation/CDK), monitor resources (CloudWatch), audit activity (CloudTrail), get recommendations (Trusted Advisor), manage at scale (Systems Manager), and track service status (AWS Health). The CLF-C02 leans hard on distinguishing CloudWatch from CloudTrail and knowing Trusted Advisor's check categories.

• Infrastructure as Code (IaC)
• AWS CloudFormation

AWS CloudFormation models and provisions AWS resources from declarative templates written in JSON or YAML .

Key benefits:

• Repeatable deployments — the same template builds identical environments every time
• Version control — store templates in Git to track infrastructure changes
• Automatic rollback — if creation fails, CloudFormation rolls the stack back
• Free — you pay only for the resources a template creates
• Stacks — a collection of resources managed as one unit; delete the stack to remove everything

Example: define a full web app (VPC, EC2, RDS, S3, CloudFront) in one template, deploy it to dev/staging/prod identically, then tear it all down by deleting the stack.

AWS CDK (Cloud Development Kit)

The AWS CDK lets you define infrastructure using real programming languages (TypeScript, Python, Java, C#, Go); it synthesizes CloudFormation templates under the hood — ideal for developers who prefer code over YAML.

• Monitoring and Observability
• Amazon CloudWatch

Amazon CloudWatch is the primary monitoring and observability service.

• Feature Description
• Metrics Collect CPU, network, disk, and custom metrics from AWS services
• Alarms Trigger actions on thresholds (e.g., scale out when CPU > 70%)
• Logs Centralize, search, and analyze application/system logs
• Dashboards Build visualizations of metrics and alarms
• EventBridge React to state changes across AWS resources

Common uses: drive Auto Scaling from CPU utilization, set billing alarms to catch runaway spend, centralize logs for troubleshooting, and build operational dashboards.

On the Exam: CloudWatch = monitoring (metrics, alarms, logs, dashboards — "how are my resources performing?"). CloudTrail = auditing (who made which API call, when, from where). Do not confuse them; this exact pairing appears repeatedly.

AWS X-Ray

AWS X-Ray traces and debugs distributed applications and microservices, giving an end-to-end view of a request as it crosses services to pinpoint bottlenecks and errors.

• Advisory and Optimization
• AWS Trusted Advisor

Trusted Advisor gives recommendations across six categories :

• Category What It Checks
• Cost Optimization Idle/underutilized instances, unattached EBS volumes
• Performance Overutilized resources, high-utilization instances
• Security Open security groups, MFA on root, exposed access keys
• Fault Tolerance Missing Multi-AZ, missing backups
• Service Limits Resources approaching service quota limits
• Operational Excellence Missing logging and monitoring, such as VPC flow logs or S3 access logs

• Support Tier Trusted Advisor Checks
• Basic All Service Limits checks plus selected Security and Fault Tolerance checks

Business Support+, Enterprise Support & Unified Operations Full set of checks + Trusted Advisor API access (Enterprise Support and Unified Operations add Trusted Advisor Priority)

On the Exam: Know the six categories: cost optimization, performance, security, fault tolerance, service limits, and operational excellence. The full set of checks requires Business Support+ or higher.

AWS Compute Optimizer

Uses machine learning to recommend optimal compute resources (EC2 instances, Auto Scaling groups, EBS volumes, Lambda functions, ECS on Fargate) based on actual utilization.

• Account and Resource Management
• AWS Systems Manager

Systems Manager is a unified interface for operating resources at scale:

• Feature Description
• Session Manager Secure shell to EC2 with no SSH keys or bastion hosts
• Patch Manager Automate OS and software patching
• Parameter Store Centralized config and secrets storage
• Run Command Execute commands across a fleet of instances
• Inventory Collect metadata about managed instances
• AWS Config

AWS Config records resource configurations over time and evaluates them against rules for compliance — answering "what did this resource look like last Tuesday, and is it compliant?" It complements CloudTrail (which records the API calls themselves).

AWS Health Dashboard

• View What It Shows
• Service health General AWS service status across Regions
• Your account health Events affecting your specific account and resources

On the Exam: The account-specific (personal) view of AWS Health shows events affecting your resources; the service view shows general AWS status.

Deployment and Developer Tools

• Service Purpose
• AWS CodeCommit Managed Git repositories (open to new customers again since November 24, 2025)
• AWS CodeBuild Managed build service (compile, test, package)
• AWS CodeDeploy Automated deployment to EC2, Lambda, ECS
• AWS CodePipeline CI/CD pipeline orchestration tying the stages together
• AWS CloudShell Browser-based shell with the AWS CLI pre-configured
• Quick Reference

• Need Service
• Infrastructure as Code CloudFormation or CDK
• Monitor metrics and set alarms CloudWatch
• Audit API activity CloudTrail
• Track config history/compliance AWS Config
• Optimization recommendations Trusted Advisor
• Patch and operate fleets Systems Manager
• CI/CD pipeline CodePipeline
• Debug microservices X-Ray
• Governing Multiple Accounts

Larger organizations rarely run everything in one account. AWS Organizations groups many accounts under one management account, enabling consolidated billing , centralized policy, and grouping accounts into organizational units. Service Control Policies (SCPs) then set permission guardrails across those accounts — they cap what any identity in an account can do, even an administrator, regardless of individual IAM permissions.

For new multi-account setups, AWS Control Tower automates a secure, well-architected landing zone using Organizations, SCPs, and best-practice configurations out of the box. On the exam, "enforce guardrails across many accounts" points to SCPs in Organizations, and "set up a governed multi-account environment quickly" points to Control Tower.