5.3 Security Services Deep Dive

Quick Answer: This deep dive separates the identity services the exam confuses — IAM (AWS account access), IAM Identity Center (SSO across many accounts), and Cognito (your application's end users) — then covers encryption at rest and in transit, KMS key types, and the detective/compliance services (GuardDuty, Inspector, Macie, Config, CloudTrail, Security Hub).

Identity Services

AWS IAM Identity Center (formerly AWS SSO)

IAM Identity Center provides centralized single sign-on to multiple AWS accounts and business applications.

Amazon Cognito

Amazon Cognito adds authentication and authorization to your web and mobile apps.

On the Exam: Cognito = authentication for your APPLICATION'S users. IAM = access control for your AWS ACCOUNT. This exact distinction is tested repeatedly.

AWS Directory Service

---

Encryption Deep Dive

Encryption at Rest

Encryption in Transit

AWS KMS Key Types

On the Exam: "Most control over keys" = Customer Managed Keys. For automatically rotating secrets like database passwords, the answer is AWS Secrets Manager (not KMS, which manages the encryption keys themselves).

---

Advanced Security Services

AWS WAF

A web application firewall with managed rules (OWASP Top 10, bot control), custom rules (IP, geo, string/regex match), and rate-based rules that auto-block IPs exceeding a request rate. WAF protects Layer-7 web traffic on CloudFront, ALB, and API Gateway.

Amazon GuardDuty

Intelligent threat detection that analyzes CloudTrail events, VPC Flow Logs, DNS logs, EKS audit logs, and more using ML to surface findings such as cryptomining, communication with command-and-control servers, and unusual API calls — with no agents to deploy.

AWS Network Firewall

A managed, stateful network firewall for VPCs with intrusion prevention, web filtering, and Suricata-compatible custom rules.

AWS Shield

Managed DDoS protection. Shield Standard is automatic and free; Shield Advanced adds enhanced protections, cost-protection guarantees, and DDoS response support.

---

Compliance and Detective Services

On the Exam: Match the verb: detect threats = GuardDuty; scan for vulnerabilities = Inspector; find PII in S3 = Macie; log API calls = CloudTrail; download audit reports = Artifact; central security dashboard = Security Hub. These one-line mappings answer most Security-domain questions.

---

The Shared Responsibility Model in Practice

Every security question ultimately sits on the Shared Responsibility Model: AWS secures the cloud (hardware, the global infrastructure, the managed-service software), while the customer secures what is in the cloud (data, identity, configuration, and access). The line moves with the service. For EC2 (IaaS), the customer patches the guest OS, configures security groups, and manages encryption. For a managed service like RDS, AWS patches the OS and engine, but the customer still controls data, IAM access, and whether encryption is enabled.

For fully managed and serverless services like S3, DynamoDB, or Lambda, the customer's job narrows mostly to data, access policies, and configuration.

Three responsibilities are always the customer's, regardless of service: protecting the root user (enable MFA, avoid daily use), enforcing least-privilege IAM, and classifying and encrypting their own data. Many exam questions phrase this as "who is responsible for X?" — and the answer follows from whether X concerns the underlying infrastructure (AWS) or the data, identities, and configuration on top of it (customer). Reading each scenario through that lens turns a large share of Security-domain questions into quick, confident answers.