[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"content-guides-api-gateway-governance-controls":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"contributorPaths":9,"menuType":11,"contentName":12,"slug":13,"readingTime":14,"menu":15,"nextDocItem":35,"previousDocItem":19},"\u003Cp>There are four main types of security controls as documented in the prescriptive guidance \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fsecurity-control-types.html\">Implementing security controls on AWS\u003C\u002Fa>:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cem>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fpreventative-controls.html\">Preventative controls\u003C\u002Fa>\u003C\u002Fem> are security controls that are designed to prevent an event from occurring. These guardrails are a first line of defense to help prevent unauthorized access or unwanted changes to your network. An example of a preventative control is an AWS Identity and Access Management (IAM) role that has read-only access because it helps prevent unintended write actions from unauthorized users.\u003C\u002Fli>\n\u003Cli>\u003Cem>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fproactive-controls.html\">Proactive controls\u003C\u002Fa>\u003C\u002Fem> are security controls that are designed to prevent the creation of noncompliant resources. These controls can reduce the number of security events handled by responsive and detective controls. These controls make sure that deployed resources are compliant before they are deployed; therefore, there is no detection event that requires response or remediation.\u003C\u002Fli>\n\u003Cli>\u003Cem>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fdetective-controls.html\">Detective controls\u003C\u002Fa>\u003C\u002Fem> react to the changes in the resource configuration or new resources created. They may perform actions to address issues found or correct configuration based on the logic implemented in the control. Examples of such controls could be AWS Config rules that flag non-compliant resources or change their configuration to address the issue (e.g. change resource policy or security group to prevent access to the non-compliant resource).\u003C\u002Fli>\n\u003Cli>\u003Cem>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fresponsive-controls.html\">Responsive controls\u003C\u002Fa>\u003C\u002Fem> are security controls that are designed to drive remediation of adverse events or deviations from your security baseline. Examples of technical responsive controls include patching a system, quarantining a virus, shutting down a process, or rebooting a system.\u003C\u002Fli>\n\u003C\u002Ful>\n",{"title":6,"order":7},"Security controls",2,"There are four main types of security controls as documented in the prescriptive guidance [Implementing security controls on AWS](https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fsecurity-control-types.html):\n\n* *[Preventative controls](https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fpreventative-controls.html)* are security controls that are designed to prevent an event from occurring. These guardrails are a first line of defense to help prevent unauthorized access or unwanted changes to your network. An example of a preventative control is an AWS Identity and Access Management (IAM) role that has read-only access because it helps prevent unintended write actions from unauthorized users.\n* *[Proactive controls](https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fproactive-controls.html)* are security controls that are designed to prevent the creation of noncompliant resources. These controls can reduce the number of security events handled by responsive and detective controls. These controls make sure that deployed resources are compliant before they are deployed; therefore, there is no detection event that requires response or remediation.\n* *[Detective controls](https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fdetective-controls.html)* react to the changes in the resource configuration or new resources created. They may perform actions to address issues found or correct configuration based on the logic implemented in the control. Examples of such controls could be AWS Config rules that flag non-compliant resources or change their configuration to address the issue (e.g. change resource policy or security group to prevent access to the non-compliant resource).\n* *[Responsive controls](https:\u002F\u002Fdocs.aws.amazon.com\u002Fprescriptive-guidance\u002Flatest\u002Faws-security-controls\u002Fresponsive-controls.html)* are security controls that are designed to drive remediation of adverse events or deviations from your security baseline. Examples of technical responsive controls include patching a system, quarantining a virus, shutting down a process, or rebooting a system.",[10],"content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","LIST","Amazon API Gateway governance in depth","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fcontrols","2 min",[16,55,84],{"title":17,"content":18},"Amazon API Gateway governance",[19,32,35,42,49],{"title":20,"order":21,"authors":22,"callout":24,"time":28,"path":29,"id":30,"link":31},"Introduction",1,[23],"Giedrius Praspaliauskas",{"title":25,"description":26,"link":27},"Building an API platform on AWS","This guide summarizes the API lifecycle and provides an AWS point of view on building an API platform using Amazon API Gateway. It provides prescriptive guidance on 3rd party and AWS services to cover the end-to-end needs of the API lifecycle.","https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction","1 min","introduction","introduction.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction",{"title":6,"order":7,"time":14,"path":33,"id":34,"link":13},"controls","controls.md",{"title":36,"order":37,"time":38,"path":39,"id":40,"link":41},"Tools",3,"7 min","tools","tools.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Ftools",{"title":43,"order":44,"time":45,"path":46,"id":47,"link":48},"API management access control",4,"4 min","management_access","management_access.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement_access",{"title":50,"order":51,"time":28,"path":52,"id":53,"link":54},"API management audit",5,"audit_track","audit_track.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faudit_track",{"title":56,"content":57},"Use cases and examples",[58,64,71,78],{"title":59,"order":60,"time":28,"path":61,"id":62,"link":63},"Use-cases overview",6,"use_cases","use_cases.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fuse_cases",{"title":65,"order":66,"time":67,"path":68,"id":69,"link":70},"Enforcing observability for governance",8,"3 min","observability","observability.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fobservability",{"title":72,"order":73,"time":74,"path":75,"id":76,"link":77},"Enforcing security for governance",9,"5 min","access_control","access_control.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faccess_control",{"title":79,"order":80,"time":45,"path":81,"id":82,"link":83},"Enforcing management control",10,"management","management.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement",{"title":85,"content":86},"Summary",[87,93],{"title":88,"order":89,"time":28,"path":90,"id":91,"link":92},"Index of examples",11,"index","index.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Findex",{"title":94,"order":95,"time":28,"path":96,"id":97,"link":98},"Additional resources",12,"additional_resources","additional_resources.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fadditional_resources",1792578865318]