---
title: "Detective Controls"
weight: 12
---

This section will use [Cloud Control API](https://docs.aws.amazon.com/cloudcontrolapi/latest/userguide/what-is-cloudcontrolapi.html), [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html), and [cfn-guard](/pac-tools/cfn-guard) to validate deployed workloads against cfn-guard policies. It will use the same cfn-guard rules that was created with the [AWS CDK and Cloudformation](/pac-action/preventative/cfn-validation) of the workshop.