Key Governance, Risk, and Compliance Sessions at re:Inforce 2025

We are incredibly excited to see you at AWS re:Inforce, in Philadelphia, Pennsylvania, on June 16-18, 2025. This year’s Governance, Risk, and Compliance track features sessions on automating compliance, enhancing risk visibility, using generative AI for business growth, and maintaining security at scale, including 5 breakout sessions, 8 builder sessions, 7 chalk talks, 2 code talks, 4 workshops, and 4 lightning talks. You can learn about different session types, focus areas, levels, foundational tracks, and training available at AWS re:Inforce 2025 here.

This blog post highlights key sessions on governance, risk, and compliance that can help you move faster while adhering to your security, operational, and compliance standards.

GRC Breakout Sessions

GRC303 | Empowering critical infrastructure entities through cloud governance

Critical infrastructure entities face unprecedented challenges in protecting vital systems and meeting stringent compliance obligations worldwide. In this session, learn how effective cloud governance empowers organizations to meet security and compliance needs while accelerating innovation using AWS services and best practices. Through architectural discussions, you’ll discover proven strategies for multi-account governance and automated compliance. Featured is a real-world success story from Moeve, showcasing how AWS Control Tower enabled them to deliver efficient and secure environments for their operations.

GRC302 | GenAI governance in action: Building and validating cloud controls

Effective GenAI governance requires both implementing and validating controls across your cloud environment. This technical session demonstrates how to build a comprehensive validation framework for GenAI workloads. Learn to implement core controls using VPC, IAM, and KMS, then discover how to validate their effectiveness through AWS Config rules, AWS CloudTrail, and AWS Control Tower guardrails. Through practical examples, explore automated compliance monitoring, continuous control validation, and governance reporting. See how to create automated compliance dashboards that demonstrate the effectiveness of your GenAI controls to stakeholders and auditors.

GRC Builders’ Sessions

GRC354 | Best practices for using generative AI to manage cloud compliance

Learn how to leverage Amazon Q Developer to streamline cloud compliance management using AWS Config. This hands-on builders’ session demonstrates how to create intelligent compliance checks, automate remediation workflows, and generate detailed compliance reports using generative AI capabilities. Through practical exercises, learn to implement automated compliance monitoring that combines the power of generative AI with AWS Config’s robust compliance framework. You must bring your laptop to participate.

GRC355 | Build automated compliance workflows with Amazon Q

In this builders’ session, you’ll get hands-on experience creating end-to-end compliance workflows in AWS. Working with AWS Systems Manager, AWS Config, AWS CloudTrail, and Amazon Q Developer, you’ll learn to build automated evidence collection pipelines and implement compliance controls. You’ll use Amazon Q to accelerate the development of automation scripts and compliance checks. By the end of the session, you’ll have practical experience in setting up continuous compliance monitoring and automated evidence collection that serves multiple stakeholders. You must bring your laptop to participate.

GRC356 | Agentic AI governance: Managing risk from design to implementation

Deploying AI agents in production requires robust governance to manage risks effectively. This session explores architectural patterns for securing autonomous AI systems using AWS Control Tower controls and AWS Config rules. Through hands-on demonstrations, learn how to monitor agent interactions, establish compliance boundaries, and implement audit controls. See how leading organizations use AWS services to maintain oversight of AI agents while enabling innovation. You must bring your laptop to participate.

GRC Chalk Talks

GRC333 | Building secure automated workflows with AWS Systems Manager

Transform risk management using AWS Systems Manager’s native integration capabilities, including Session Manager for secure shell access. Learn how to leverage Systems Manager’s permission model to orchestrate automated remediation workflows while maintaining precise access control. Through live demonstrations, explore secure remote session management and event-driven pipelines that connect with enterprise service platforms for ticket creation and audit trails. Gain practical insights into implementing automated runbooks that reduce mean-time-to-remediation while ensuring proper governance and compliance.

GRC335 | Strengthen security controls with AWS observability services

Security teams need scalable solutions for log analysis and monitoring. This chalk talk demonstrates how to strengthen security visibility by integrating Amazon CloudWatch logs with OpenSearch. Learn to implement centralized logging, create custom dashboards, and enable real-time security alerting. Through practical examples, discover how to combine Amazon CloudWatch, AWS CloudTrail, and OpenSearch for effective threat detection, compliance monitoring, and automated response across your AWS environment.

GRC336 | AI compliance by design: Building responsible solutions

As organizations deploy AI agents and leverage Amazon Bedrock, maintaining compliance with evolving regulations becomes critical. This session explores practical strategies for implementing compliant AI solutions while enabling innovation. Learn how to configure Bedrock guardrails, implement agent-specific controls, and maintain regulatory alignment across your AI implementations. Through real-world examples, discover how to address key compliance requirements for AI agents – from data privacy and model governance to auditability and responsible AI practices. Walk away with actionable frameworks for scaling compliant AI solutions using Amazon Bedrock while meeting emerging regulatory requirements like the EU AI Act and industry-specific mandates.

GRC337 | Build compliant AI: Implementing controls for emerging regulations

As AI adoption accelerates, organizations face increasing regulatory scrutiny and compliance requirements. In this session, learn about the evolving global regulatory landscape for AI, data privacy, and data sovereignty, then see how you can map regulatory requirements and security controls to AWS services and features. We will demonstrate how generative AI can work as a tool for assessment, risk classification and generating compliance guidance. We also show you how to use the latest threat modelling resources developed by AWS. Security professionals and AI practitioners will learn actionable strategies for building compliant AI systems while maintaining innovation velocity.

GRC Code Talks 

GRC442 | Beyond shift-left: Embedding controls in infrastructure pipelines

Regulated industries require rigorous compliance controls throughout their infrastructure lifecycle. This session demonstrates how to embed automated compliance checks within infrastructure deployments using AWS CDK and Terraform. Learn to implement non-bypassable guardrails that enforce security policies while maintaining development velocity. Through real-world infrastructure examples, discover proven patterns for compliance-as-code, automated policy enforcement, and security control implementation. Security teams will gain practical tools to strengthen infrastructure compliance without impeding builder productivity.

GRC Workshops

GRC372 | Practical data privacy and compliance controls for sensitive workloads

Navigating data privacy is a critical business requirement. In this workshop we will show you how to assess risks in your workload and implement technical controls to meet privacy needs. First, we shift left to review the regulations, create a threat model, and select controls to mitigate those risks. Next, we shift right to deploy AWS Services and features to implement and automate these controls. Finally, we create audit evidence for compliance checks. Risk owners will gain practical experience of how AWS simplifies risk management. Technical folks will gain tools they can apply immediately. You must bring your laptop to participate.

GRC373 | Hands-on security monitoring: Implementing AWS observability controls

Get hands-on experience building security monitoring and compliance controls using AWS observability services. In this workshop, learn to implement real-time threat detection by configuring CloudWatch, CloudTrail and AWS Config. Practice creating dashboards, setting up automated alerts, and building response workflows. Through guided exercises, develop skills.

Lightning Talks

GRC225 | Use generative AI for business growth amid the regulatory landscape

The rapid evolution of AI regulations requires careful consideration when implementing business solutions. In this talk, explore how organizations can leverage AWS AI/ML services while adhering to emerging regulatory requirements. Learn practical approaches for developing responsible AI practices, implementing governance frameworks, and driving business value through compliant AI solutions. Discover strategies for balancing innovation with compliance as you scale AI capabilities across your organization.

GRC321 | Build multi-account security controls using Q CHAT CLI

Implementing standardized security controls across AWS accounts requires efficient automation tools. This technical session shows how Amazon Q CLI chat simplifies security baseline deployment through natural language interactions. Learn to generate AWS CloudFormation templates for AWS Config rules, Security Hub standards, and automated remediation workflows. Discover practical approaches to implementing and validating compliance controls at scale.

GRC421 | Build security monitoring and response at scale

Managing security and compliance at scale requires advanced monitoring. This lighting talk demonstrates how to use AWS CloudTrail Lake, including new VPC endpoint network events, for comprehensive security monitoring. Learn to implement mechanisms to audit operation for security and compliance. Explore enhanced filtering options, generative AI–powered natural language query generation, and comprehensive dashboard capabilities. Gain practical insights to enhance your security posture, with emphasis on securing private network communications in large cloud environments.

Reserve a seat in your favorite session!

If you found any of these sessions relevant or interesting, we recommend that you reserve a seat quickly. Reserved seating is available for registered attendees to secure seats in the sessions of their choice. Reserve a seat by signing in to the attendee portal and navigating to “Event,” then “Sessions.”

Conclusion

AWS re:Inforce 2025 offers a variety of sessions on governance, risk management, and compliance in its GRC track to meet you wherever you are in your security journey. Whether you’re looking to automate security controls, implement compliance for agentic AI, use generative AI to build your compliance strategy, or increase visibility and security at scale, the GRC track offers space to learn best practices and implementation details, participate in interactive discussions, and get actionable insights to solve complex challenges. If any of these GRC sessions pique your interest, register for AWS re:Inforce 2025 and reserve seats in your favorite sessions. We also encourage you to visit our GRC kiosk at the AWS Village in the Expo.

If you are unable to join us in-person, Breakout Sessions will be available via the AWS YouTube channel after the event. Contact your AWS Account Team if you are interested in learning more about any of these sessions or want to hear how we can bring our experts to you.