AWS Security Services

AWS provides a comprehensive suite of security services that protect your workloads at every layer. For the CLF-C02 exam, you need to know what each service does and when to use it.

Network and Application Protection

AWS Shield — DDoS Protection

AWS Shield protects against Distributed Denial of Service (DDoS) attacks.

On the Exam: If a question asks about DDoS protection, the answer is AWS Shield. If they mention COST protection during a DDoS attack or access to a 24/7 response team, it is Shield Advanced.

AWS WAF — Web Application Firewall

AWS WAF protects web applications from common web exploits and bots. It lets you create rules that control which traffic reaches your applications.

What WAF protects against:

• SQL injection — Malicious SQL code in input fields
• Cross-site scripting (XSS) — Injecting malicious scripts into web pages
• Geo-blocking — Block traffic from specific countries
• Rate limiting — Prevent abuse by limiting request rates
• Bot management — Block or allow specific bots

WAF can be deployed on:

• Amazon CloudFront (CDN)
• Application Load Balancer (ALB)
• Amazon API Gateway
• AWS AppSync

AWS Firewall Manager

AWS Firewall Manager simplifies the administration of firewall rules across multiple accounts and resources in an AWS Organization. It works with WAF, Shield Advanced, Security Groups, and Network Firewall.

Threat Detection and Monitoring

Amazon GuardDuty — Intelligent Threat Detection

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior.

How it works:

• Analyzes AWS CloudTrail logs, VPC Flow Logs, and DNS logs
• Uses machine learning, anomaly detection, and integrated threat intelligence
• Detects threats like cryptocurrency mining, unauthorized access, compromised instances
• Generates findings with severity levels (Low, Medium, High)

No infrastructure to manage — just enable it with one click.

Amazon Inspector — Vulnerability Assessment

Amazon Inspector automatically discovers and scans workloads for software vulnerabilities and unintended network exposure.

What Inspector scans:

• EC2 instances — OS vulnerabilities, missing patches
• Container images in Amazon ECR — Known vulnerabilities (CVEs)
• Lambda functions — Code vulnerabilities and dependencies

Key feature: Provides a risk score for each finding based on the Common Vulnerability Scoring System (CVSS) and additional context like network reachability.

Amazon Detective — Security Investigation

Amazon Detective makes it easy to analyze, investigate, and quickly identify the root cause of security findings. It automatically collects log data from AWS resources and uses machine learning to build a linked set of data for security investigation.

Use Detective when: You have a GuardDuty finding and need to investigate the full scope of the compromise.

Logging and Auditing

AWS CloudTrail — API Logging

AWS CloudTrail records all API calls made in your AWS account. Think of it as a security camera for your AWS activity.

What CloudTrail records:

Key features:

• Enabled by default for management events (90-day history)
• Create a trail to store events in S3 for long-term retention
• Integrates with CloudWatch Logs for real-time monitoring
• Essential for compliance auditing and forensic investigation

On the Exam: If a question asks "which service records API activity" or "who made changes to resources," the answer is AWS CloudTrail.

Amazon CloudWatch — Monitoring and Observability

While primarily a monitoring service, CloudWatch has security applications:

• CloudWatch Alarms — Alert on unusual activity (e.g., spike in failed logins)
• CloudWatch Logs — Centralize and search log data
• CloudWatch Events / EventBridge — Trigger automated responses to security events

Data Protection

AWS Key Management Service (KMS)

AWS KMS lets you create and manage encryption keys used to encrypt your data across AWS services.

Key features:

• Create customer managed keys (CMKs) or use AWS managed keys
• Integrates with most AWS services (S3, EBS, RDS, etc.)
• Automatic key rotation (annually for AWS managed keys)
• All key usage is logged in CloudTrail

AWS Certificate Manager (ACM)

ACM provisions, manages, and deploys SSL/TLS certificates for use with AWS services and internal resources.

• Free public SSL/TLS certificates for use with AWS services
• Automatic certificate renewal
• Used with CloudFront, ELB, API Gateway

Amazon Macie — Data Discovery and Protection

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3 (like personally identifiable information — PII, credit card numbers, social security numbers).

AWS Secrets Manager

AWS Secrets Manager helps you protect secrets (passwords, API keys, database credentials) needed to access your applications. It can automatically rotate secrets on a schedule.

Security Hub and Compliance

AWS Security Hub

AWS Security Hub provides a comprehensive view of your security posture across AWS. It aggregates findings from GuardDuty, Inspector, Macie, Firewall Manager, and other tools into a single dashboard.

Key features:

• Centralized security findings dashboard
• Automated security checks against industry standards (CIS, PCI DSS)
• Cross-account security visibility via AWS Organizations

Quick Reference: Which Service for Which Scenario?