SAP-C02 + DOP-C02 — Compliance Architecture and Operations
The operational-visibility lesson on 18 June showed how to observe what an agentic system is doing: Bedrock agent traces, X-Ray service maps, CloudTrail events flowing into CloudWatch. Observation tells you what happened. What it does not tell you is whether the record of what happened can be trusted.
Data protection on AWS is the discipline that makes the record irrevocable. When an agentic system runs in a regulated environment — financial services, healthcare, government — the regulator does not ask only whether the system is observable. The regulator asks whether the audit record can be deleted or altered by a compromised operator. The answer must be no. S3 Object Lock in Compliance mode and CloudTrail Lake in immutable-event-store mode are the mechanisms that make the answer no.
Both the SAP-C02 and DOP-C02 exams test this terrain. SAP tests it at the architecture level: which combination of S3, KMS, and CloudTrail features produces a compliant data-protection posture for a multi-region regulated workload? DOP tests it at the operations level: how do you automate the detection of non-compliant configurations, generate audit evidence for a compliance review, and integrate CloudTrail events with a CI/CD pipeline's compliance gate?
Object Lock applies a WORM constraint at the S3 object level. Once written to a bucket with Object Lock enabled, a policy sets a retention period during which the object cannot be deleted or overwritten.
Governance mode allows principals with the s3:BypassGovernanceRetention IAM permission to delete objects early. Suitable for internal retention policies where the organization needs an escape hatch.
Compliance mode allows no deletion before the retention date by anyone, including the AWS account root user. The object stays until the clock runs out. The retention period, once set in Compliance mode, cannot be shortened. It can only be extended.
Legal holds prevent deletion independently of the retention period. A legal hold persists until a principal with s3:PutObjectLegalHold removes it explicitly. Legal holds and retention periods coexist on the same object and are released independently.
Object Versioning must be enabled on the bucket before Object Lock can be enabled. Object Lock applies to specific object versions, not to the bucket as a whole.
CloudTrail Lake stores events in a managed, immutable event data store queryable with SQL. The default retention is seven years. Immutability is built in: there is no delete-events API.
SELECT
userIdentity.arn,
eventName,
eventTime,
requestParameters
FROM eds-id
WHERE eventSource = 'bedrock.amazonaws.com'
AND eventTime > '2026-06-20 00:00:00'
ORDER BY eventTime DESC
This is forensically useful during an incident and evidentially useful during a compliance audit. The traditional CloudTrail-to-S3 model required downloading compressed log files, decompressing, and parsing JSON. Lake removes that friction entirely.
S3 server-side encryption with AWS KMS (SSE-KMS) applies at the object level. Each object is encrypted with a data key derived from a KMS Customer Managed Key (CMK). The CMK never leaves KMS. Automatic key rotation generates new backing cryptographic material every year without changing the CMK's key ID or ARN. Objects encrypted under prior backing keys remain decryptable; KMS keeps all prior backing key versions alive.
KMS key policies control which IAM principals can call kms:Decrypt. A bucket that holds regulated data should deny kms:Decrypt to all principals except the specific agents authorized to read that data.
AWS Backup Vault Lock applies WORM constraints to backup recovery points. Compliance mode for Vault Lock prevents deletion by any principal, including the root user, before the minimum retention period expires. Audit-mode Vault Lock allows testing the configuration without permanently committing.
Macie scans S3 buckets for sensitive data — PII, financial records, credential patterns. For a regulated workload: ongoing monitoring (detecting new objects that contain sensitive data in unexpected buckets) and point-in-time classification (producing audit evidence that a specific bucket held sensitive data of specific types at a specific time).
SAP questions test architectural reasoning. Given a regulatory constraint, which combination of services produces a compliant posture?
Multi-region replication with integrity. A regulated workload retaining audit records for seven years in multiple regions uses S3 Cross-Region Replication (CRR) with Object Lock replication. The source bucket has Object Lock enabled; the destination bucket must also have Object Lock enabled; replication carries the lock status to the destination.
Encryption in transit. S3 bucket policies can enforce aws:SecureTransport as a deny condition, rejecting any API call that arrives over unencrypted HTTP. Combined with SSE-KMS at rest, the regulated data has encryption coverage across both dimensions.
The cost-tiering question. SAP-C02 tests cost optimization alongside compliance. A seven-year retention period does not require seven years of S3 Standard storage pricing. S3 Intelligent-Tiering for Object Lock-enabled objects automatically moves infrequently-accessed objects to cheaper tiers while preserving the Object Lock retention. S3 Intelligent-Tiering is compatible with Object Lock.
aws:SourceVpce so requests arriving from outside the VPC fail.
DOP questions test operational procedure and automation. Given a running environment, how do you detect non-compliance, remediate, and generate evidence?
AWS Config for continuous compliance monitoring. The s3-bucket-object-lock-enabled managed Config Rule checks that Object Lock is enabled on S3 buckets that require it. When a non-compliant bucket appears, Config raises a finding. An EventBridge rule calls a Lambda function that either remediates automatically or opens a ticket for human review.
CloudTrail integration with the CI/CD pipeline. The CI/CD pipeline includes a compliance-verification stage that queries CloudTrail Lake for IAM policy changes in the last 24 hours, checks whether any changes affected the KMS key policy governing the regulated data bucket, and fails the build if an unauthorized change appears. The pipeline becomes a compliance gate.
Evidence generation for auditors. AWS Audit Manager automates evidence collection from Config, CloudTrail, and Security Hub, mapping controls in common frameworks (SOC 2, PCI DSS, CIS) to AWS evidence sources. A DOP question might ask how to generate a quarterly compliance report covering CloudTrail integrity, S3 Object Lock coverage, and KMS key rotation status — the answer involves Audit Manager framework assessment plus an S3 export of the collected evidence.
A Bedrock orchestration agent writes inference results to S3. Regulatory requirements demand the output record cannot be altered or deleted for five years.
The architecture: S3 output bucket with Object Lock Compliance mode, five-year retention default, SSE-KMS with automatic rotation and a key policy restricting kms:Decrypt to the Bedrock agent's execution role and the compliance team's IAM role. S3 CRR to a secondary region's bucket, also Object Lock Compliance mode. CloudTrail Lake event data store, seven-year retention. Config rule with EventBridge remediation that enforces Object Lock on any new bucket matching the regulated-data prefix. Macie continuous scan on the output bucket.
A compliance auditor asking "prove these records cannot have been deleted" receives the Object Lock configuration export (retention date per object, Compliance mode enabled), the CloudTrail Lake query result showing zero DeleteObject calls on the prefix, and the Macie classification evidence that the objects contain the expected data types.
The Ops lesson established the tamper-evidence discipline: hash at write, HMAC-tag the envelope, write the audit record to a WORM store. S3 Object Lock Compliance mode is the AWS implementation of that WORM store.
The Python lesson implemented the envelope. The sign() method produces the payload_sha256 and hmac_sha256 fields. Writing the signed envelope to the Object Lock bucket means those fields are themselves WORM-committed. CloudTrail Lake records the S3 PutObject API call that wrote the envelope. The WORM record in S3 and the CloudTrail record in Lake together form a chain: this principal, at this time, wrote this payload with this content hash. Neither record can be deleted before the retention period expires.
s3:BypassGovernanceRetention. Legal hold is independent of retention. MFA Delete does not prevent deletion by authenticated MFA-enabled principals.Object Lock Compliance mode makes deletion impossible before the retention date. CloudTrail Lake makes the audit record immutable and queryable. KMS CMK rotation limits the blast radius of a key compromise. AWS Config with EventBridge remediation keeps the posture from drifting.
These are not four separate tools. They are one architecture: the data cannot be altered (Object Lock), the record that it was written cannot be altered (CloudTrail Lake), the data cannot be decrypted by an unauthorized principal (KMS key policy), and any deviation from this posture is detected and corrected within minutes (Config + EventBridge).
SAP questions ask whether you can design this architecture from a compliance requirement. DOP questions ask whether you can operate and audit it. Both certs expect the same underlying knowledge of what these services do and how they interlock.