Management and governance services: choosing the right one

The services at a glance

The Management and Governance category is the largest on the exam, with eighteen services. They fall into four groups. Each service name links to its own tutorial.

Monitor and audit

Service	What it does
Amazon CloudWatch	Metrics, logs, alarms, and dashboards for performance and operations
AWS CloudTrail	Records APIAPI (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entryClose activity: who did what, when, and from where
AWS Config	Records resource configurations over time and checks them against rules
Amazon Managed Service for Prometheus	Managed, Prometheus-compatible monitoring for container metrics
Amazon Managed Grafana	Managed Grafana dashboards over many data sources
AWS Health Dashboard	AWS service events and scheduled changes that affect your account

Govern many accounts

Service	What it does
AWS Organizations	Groups accounts, applies service control policies (SCPsSCP (Service control policy)An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.Glossary entryClose), and consolidates billing
AWS Control Tower	Sets up and governs a multi-account landing zone with built-in controls
AWS Service Catalog	Lets teams launch only approved products, such as CloudFormation templates
AWS License Manager	Tracks and enforces software license usage

Provision and operate

Service	What it does
AWS CloudFormation	Infrastructure as codeIaC (Infrastructure as code)Defining infrastructure, such as networks, servers, and permissions, in text files that are versioned and deployed automatically, instead of setting it up by hand. AWS CloudFormation and the AWS CDK are AWS tools for it.Glossary entryClose: create and update stacks of resources from templates
AWS Systems Manager	Operate fleets: patching, run commands, sessions without SSHSSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entryClose, parameters, automation
AWS Auto Scaling	Scaling plans across several resource types (the exam's "AWS Auto Scaling" service)
AWS Management Console	The web interface for AWS
AWS CLI	The command-line interface for AWS

Optimize

Service	What it does
AWS Trusted Advisor	Checks for cost, performance, security, fault toleranceFault toleranceThe ability of a system to keep working without interruption when a component fails, because enough redundant capacity is already running. It goes further than high availability, which may allow a short failover.Glossary entryClose, and service limits
AWS Compute Optimizer	Right-sizing recommendations for EC2, EBS, Lambda, and more
AWS Well-Architected Tool	Reviews workloads against the AWS Well-Architected Framework

The three monitoring questions

Most questions in this category ask one of three things. Learn to tell them apart:

1. How is it performing? Metrics, logs, and alarms point to CloudWatch.
2. Who did it? API calls point to CloudTrail.
3. What did it look like, and is it compliant? Configuration history and rules point to Config.

Reverse mindmap: from the question to the service

• Monitor and audit
  • Metrics, logs, alarms, dashboards→ leads to CloudWatch
  • Who called the API→ leads to CloudTrail
  • Configuration history and compliance rules→ leads to Config
  • Prometheus metrics from containers→ leads to Managed Service for Prometheus
  • Grafana dashboards→ leads to Managed Grafana
  • AWS outages affecting our resources→ leads to Health Dashboard
• Govern accounts
  • Group accounts and restrict services→ leads to Organizations with SCPs
  • Set up a governed multi-account landing zone→ leads to Control Tower
  • Approved products for self-service→ leads to Service Catalog
  • Track software licenses→ leads to License Manager
• Provision and operate
  • Infrastructure as code→ leads to CloudFormation
  • Patch, run commands, or connect without SSH→ leads to Systems Manager
• Optimize
  • Best-practice checks and service limits→ leads to Trusted Advisor
  • Right-size instances→ leads to Compute Optimizer
  • Review a workload's architecture→ leads to Well-Architected Tool

Commonly confused pairs

If the choice is between	Choose the first when	Choose the second when
CloudWatch or CloudTrail	You need metrics, logs, or alarms	You need a record of API calls
CloudTrail or Config	You need to know who made a change	You need what the resource looked like and whether it complies
Organizations or Control Tower	You manage accounts and SCPs yourself	You want a ready-made, governed landing zone
Trusted Advisor or Compute Optimizer	Broad checks across cost, security, and limits	Detailed right-sizing based on usage
CloudFormation or Service Catalog	Engineers define and deploy infrastructure	Users launch only approved, pre-built products

Key takeaways

• Monitoring and auditing: CloudWatch (performance), CloudTrail (API activity), Config (configuration and compliance).
• Multi-account governance: Organizations, Control Tower, Service Catalog, and License Manager.
• Provisioning and operations: CloudFormation and Systems Manager.
• Optimization: Trusted Advisor, Compute Optimizer, and the Well-Architected Tool.

Sources

• AWS Certification: SAA-C03 in-scope AWS services
• Amazon CloudWatch User Guide: What is Amazon CloudWatch?
• AWS CloudTrail User Guide: What is AWS CloudTrail?
• AWS Config Developer Guide: What is AWS Config?
• AWS Organizations User Guide: What is AWS Organizations?
• AWS Control Tower User Guide: What is AWS Control Tower?
• AWS Systems Manager User Guide: What is AWS Systems Manager?
• AWS CloudFormation User Guide: What is AWS CloudFormation?
• AWS Auto Scaling: What is a scaling plan?