2.3 AWS Security Services
Key Takeaways
- AWS Shield provides DDoS protection: Standard is free and automatic for all customers; Advanced is paid and adds a 24/7 response team and cost protection.
- AWS WAF protects web apps from exploits like SQL injection and XSS; Amazon GuardDuty uses ML to detect malicious activity from CloudTrail, VPC Flow, and DNS logs.
- Amazon Inspector scans EC2, container images, and Lambda for vulnerabilities; Amazon Macie discovers and protects sensitive data (PII) in S3.
- AWS CloudTrail logs API calls (who/what/when/where) for auditing; AWS Config tracks resource configuration and compliance — do not confuse them.
- AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, and others into a single security dashboard.
AWS provides a comprehensive suite of security services that protect workloads at every layer. For the CLF-C02, you need to know what each service does and when to use it — not how to configure it.
Network and Application Protection
AWS Shield — DDoS Protection
AWS Shield protects against Distributed Denial of Service (DDoS) attacks.
| Feature | Shield Standard | Shield Advanced |
|---|---|---|
| Cost | Free (automatic) | $3,000/month + data transfer |
| Protection | Common network/transport-layer attacks | Sophisticated, large-scale attacks |
| Coverage | All AWS customers, automatic | Enabled per resource |
| DDoS Response Team | No | Yes (24/7 AWS Shield Response Team) |
| Cost Protection | No | Yes (credits for DDoS-related scaling) |
| Integrations | CloudFront, Route 53, ELB | + EC2, Global Accelerator |
On the Exam: DDoS protection → AWS Shield. If the question mentions cost protection during an attack or a 24/7 response team, it is Shield Advanced.
AWS WAF — Web Application Firewall
AWS WAF protects web applications from common exploits and bots using rules that control which traffic reaches your application.
Protects against: SQL injection, cross-site scripting (XSS), geo-based threats (geo-blocking), request floods (rate limiting), and unwanted bots.
Can be deployed on: Amazon CloudFront, Application Load Balancer (ALB), Amazon API Gateway, and AWS AppSync.
AWS Firewall Manager
AWS Firewall Manager centrally administers firewall rules across multiple accounts in an AWS Organization. It works with WAF, Shield Advanced, Security Groups, and AWS Network Firewall.
Threat Detection and Monitoring
Amazon GuardDuty — Intelligent Threat Detection
Amazon GuardDuty continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs using machine learning, anomaly detection, and threat intelligence to detect threats like cryptomining, unauthorized access, and compromised instances. It produces findings with severity levels and requires no infrastructure to manage — enable it with one click.
Amazon Inspector — Vulnerability Assessment
Amazon Inspector automatically scans workloads for software vulnerabilities and unintended network exposure across EC2 instances, container images in Amazon ECR, and Lambda functions. It assigns a risk score to each finding using CVSS plus context like network reachability.
Amazon Detective — Security Investigation
Amazon Detective helps analyze and investigate the root cause of security findings. It automatically collects log data and uses machine learning to build a linked dataset for investigation. Use it when you have a GuardDuty finding and need to understand the full scope of a compromise.
Logging and Auditing
AWS CloudTrail — API Logging
AWS CloudTrail records API calls made in your account — a security camera for AWS activity.
| Detail | Information Captured |
|---|---|
| Who | The IAM identity that made the call |
| What | The API action (e.g., RunInstances, DeleteBucket) |
| When | Date and time |
| Where | Source IP address |
| Which | The resources involved |
Management events are recorded by default with 90 days of viewable history; create a trail to store events in S3 for long-term retention and integrate with CloudWatch Logs.
On the Exam: "Which service records API activity / who made a change?" → AWS CloudTrail. "Which service tracks resource configuration over time / compliance?" → AWS Config.
Amazon CloudWatch — Monitoring
While primarily a monitoring service, CloudWatch has security uses: alarms on unusual activity (e.g., a spike in failed logins), centralized log search via CloudWatch Logs, and automated responses via EventBridge.
Data Protection
AWS KMS
AWS Key Management Service (KMS) creates and manages encryption keys used across AWS services. It supports customer managed keys and AWS managed keys, integrates with S3, EBS, RDS, and more, supports automatic key rotation, and logs all key usage in CloudTrail.
AWS Certificate Manager (ACM)
ACM provisions, manages, and deploys free public SSL/TLS certificates for use with CloudFront, ELB, and API Gateway, with automatic renewal.
Amazon Macie
Amazon Macie uses machine learning to discover, classify, and protect sensitive data in S3 — such as PII, credit card numbers, and Social Security numbers.
AWS Secrets Manager
AWS Secrets Manager protects secrets (passwords, API keys, database credentials) and can automatically rotate them on a schedule.
Security Hub
AWS Security Hub provides a centralized view of your security posture, aggregating findings from GuardDuty, Inspector, Macie, Firewall Manager, and others into one dashboard, with automated checks against standards like CIS and PCI DSS and cross-account visibility through AWS Organizations.
Quick Reference: Which Service for Which Scenario?
| Scenario | Service |
|---|---|
| DDoS protection | AWS Shield |
| Block SQL injection / XSS | AWS WAF |
| Detect cryptomining on EC2 | Amazon GuardDuty |
| Find vulnerabilities in EC2 / containers | Amazon Inspector |
| Track who deleted an S3 bucket | AWS CloudTrail |
| Discover PII in S3 | Amazon Macie |
| Manage encryption keys | AWS KMS |
| Free SSL/TLS certificates | AWS Certificate Manager |
| Centralized view of all findings | AWS Security Hub |
| Investigate a security incident | Amazon Detective |
| Manage firewall rules across accounts | AWS Firewall Manager |
| Store and rotate database passwords | AWS Secrets Manager |
Which AWS service provides managed DDoS protection that is included for free for all AWS customers?
A company needs to protect its web application from SQL injection attacks. Which AWS service should they use?
Which AWS service should you use to find out who deleted an S3 bucket in your account last week?
Amazon Macie is BEST described as a service that:
Which AWS service provides a centralized view of security findings from multiple AWS security services?
A security team has a GuardDuty finding and needs to investigate the full scope and root cause of the potential compromise. Which service is purpose-built for this?