Centralized Audit, Security Hub, GuardDuty, Inspector, and Access Analyzer
Key Takeaways
- An AWS CloudTrail organization trail created from the management account or a CloudTrail delegated administrator logs current and future member accounts; members can view the trail but cannot stop or reconfigure it.
- AWS Security Hub CSPM aggregates findings and evaluates security standards and controls; treat it as the CSPM and findings bus, not as a replacement for CloudTrail or GuardDuty.
- Amazon GuardDuty is threat detection over CloudTrail management events, VPC Flow Logs, and Route 53 Resolver DNS logs, plus optional protection plans; Amazon Inspector is continuous vulnerability and network-exposure scanning of EC2, ECR, and Lambda.
- IAM Access Analyzer external-access analyzers are Regional and reason over resource policies; unused-access analysis is a different analyzer and is not Region-bound the same way.
- AWS Config is detective configuration recording and rules—introduce it here as a Security Hub prerequisite and SOC trigger via EventBridge; preventive SCPs and deep Config design belong in other chapters.
Why detective controls have to be organizational
A single-account CloudTrail trail that an application admin can stop is not an enterprise audit program. Independent OpenExamPrep teaching for SAP-C02 Task 1.2 is about one pipeline: who did what (CloudTrail), what the resource looks like (AWS Config), what looks hostile (Amazon GuardDuty), what is unpatched or reachable (Amazon Inspector), what was shared too widely (IAM Access Analyzer), how findings become one queue (AWS Security Hub CSPM), and who gets paged (Amazon EventBridge). Deeper Config pack design, automated remediation, and patch process live in a later Domain 3 chapter; this section only introduces Config as a detective control and a Security Hub prerequisite.
Northwind Retail has a management account, a security tooling (audit) account, a log-archive account, and dozens of workload accounts in AWS Organizations. The security team must prove PCI-relevant API history, see GuardDuty and Inspector findings next to public-bucket findings, and notify the SOC when a production RDS instance becomes publicly accessible—without blocking the API that made it public (that block would be an SCP or a write-time control, not this detective layer).
Organization CloudTrail
If you have an organization in AWS Organizations, you can create an organization trail that records events for all accounts in that organization. AWS CloudTrail documents that the management account can assign a delegated administrator to create and manage organization trails. When you create the trail, CloudTrail places a copy of the trail with the same name in member accounts.
Member users who have CloudTrail permissions can see the organization trail in the console or via describe-trails. They do not have permission to delete it, turn logging off, or change event selectors. That is the point. Workload owners cannot quietly disable the enterprise audit stream.
Deliver management events to an S3 bucket in the log-archive account with a bucket policy that accepts only the CloudTrail service principal and the organization. Encrypt the bucket with a customer managed KMS key that CloudTrail is allowed to use (the earlier section's key-policy lesson applies). Optional CloudWatch Logs in the security account support metric filters. Turn on log file integrity validation. Enable data events (S3 object-level, Lambda invoke) only where the threat model pays for the volume; do not invent a requirement that every bucket's data events are free or mandatory.
Organization trails are not GuardDuty and are not Config. CloudTrail answers who called which API. GuardDuty analyzes CloudTrail management events (and other sources) for threat findings. Config records resource configuration.
Security Hub CSPM as the findings bus
AWS documentation now names the service AWS Security Hub Cloud Security Posture Management (AWS Security Hub CSPM). On the exam you may still see Security Hub. Treat them as the same control family: a CSPM that collects findings from AWS services and partner products, maps them to security standards and controls, and gives a delegated-administrator view across the organization.
Enable Security Hub CSPM with AWS Organizations, designate a delegated administrator in the security tooling account—not the management/payer account, unless you have a documented exception—and auto-enable member accounts. Cross-Region aggregation rolls Regional findings into one home Region for operators. AWS Config must be recording for a large set of Security Hub controls to evaluate; that is why Config appears in this chapter even though the deep dive is later.
Standards you will see in stems include AWS Foundational Security Best Practices, CIS AWS Foundations, PCI DSS, and NIST. Enabling a standard creates controls that become failed/passed findings. Security Hub CSPM also ingests findings from GuardDuty, Inspector, IAM Access Analyzer, Amazon Macie, and others. It is not a substitute for those generators. AWS Prescriptive Guidance's security reference architecture recommends using the same delegated administrator account for Security Hub CSPM, GuardDuty, and Amazon Detective so console drill-down works.
GuardDuty versus Inspector versus Access Analyzer
Amazon GuardDuty is intelligent threat detection. When you enable it, it immediately analyzes foundational data sources: CloudTrail management events, VPC Flow Logs from EC2 (via an independent stream—you do not have to configure flow logs yourself for GuardDuty to consume them), and Route 53 Resolver DNS query logs when instances use the Amazon DNS resolver. Custom DNS resolvers mean GuardDuty cannot see that DNS source. Optional protection plans add S3 data events, EKS audit and runtime, ECS/EC2 runtime, malware scanning, RDS login activity, Lambda network activity, and similar. GuardDuty is not a CVE scanner and not a resource-policy reasoner.
Amazon Inspector (the current Inspector v2 family) is vulnerability management. It discovers and continually scans Amazon EC2 (agent-based with SSM or agentless using EBS snapshots, depending on the scan mode), container images in Amazon ECR, and AWS Lambda functions for software vulnerabilities and unintended network exposure. Findings publish to Security Hub CSPM when that integration is on. Inspector is not CloudTrail and does not replace GuardDuty credential-exfiltration findings.
IAM Access Analyzer uses automated reasoning on resource-based policies to find resources shared with external principals (other accounts, organizations, or the public). External-access analyzers are Regional: enable them in each Region where you have supported resources (S3 buckets, KMS keys, IAM roles, Lambda, and the rest of the documented list). Unused access analyzers look for unused IAM permissions and are not something you must recreate in every Region the same way. An unused-access analyzer will not be the tool that flags a public bucket policy; that is external access.
Config as a detective control (preview)
AWS Config records configuration items for supported resources, stores history, and evaluates rules (AWS managed or custom). Conformance packs bundle rules. An aggregator or organization-level setup in the security account gives a multi-account, multi-Region inventory. Config is detective: a rule can report NON_COMPLIANT after someone makes an RDS instance publicly accessible. Config does not by itself deny ModifyDBInstance. Prevention is service control policies, resource policies, IAM, or other write-time controls taught in the governance and identity chapters.
Security Hub CSPM depends on Config for many control evaluations. If Config is off in a Region, do not expect those controls to be meaningful. Recording can be expensive at huge scale; professional stems still expect Config on in Regions you claim to govern, not a promise that every possible resource type is free.
Northwind enables Config in every governed Region, sets the delegated administrator to the security tooling account, and uses a small set of managed rules here (public RDS, public S3, disabled CloudTrail) as the SOC trigger. Custom Lambda rules, remediation runbooks, and retention design wait for the later Config chapter.
Centralized security event notifications
Findings and compliance changes should not wait for someone to refresh a console. Amazon EventBridge is the routing layer:
- GuardDuty finding events
- Security Hub CSPM custom actions and imported findings (including aggregated GuardDuty, Inspector, and Access Analyzer items)
- Config compliance change events and Config rules
Rules in the security tooling account (and in the aggregation Region) fan out to Amazon SNS, a Lambda enricher, AWS Chatbot, or a ticketing API. Prefer Security Hub CSPM as the single EventBridge source for human SOC queues so operators are not subscribed to four overlapping finding streams. Keep GuardDuty → Detective (or equivalent investigation) as the deep-forensics path, with matching delegated administrators so the console link works.
Multi-account event notifications in Task 1.4 (Control Tower, organization-wide EventBridge) overlap this design. Here the content is the security finding path: organization trail for forensics, Config for drift, GuardDuty/Inspector/Access Analyzer for generators, Security Hub CSPM for posture and standards, EventBridge for pages.
| Service | Question it answers | Not the answer for |
|---|---|---|
| Organization CloudTrail | Who called which API, with integrity-validated logs in log-archive | Blocking the API; CVE lists |
| AWS Config | What is the resource configuration, and is it compliant with a rule? | Threat intel on C2 domains |
| GuardDuty | Does this activity look like a threat? | Patch status of an AMI |
| Inspector | Are EC2/ECR/Lambda images vulnerable or unexpectedly reachable? | Public KMS key policy reasoning |
| IAM Access Analyzer (external) | Does this resource policy grant external access? | Process-level malware on EC2 |
| Security Hub CSPM | What is the aggregated posture against standards, and where do I triage? | Replacing CloudTrail storage |
| EventBridge + SNS/Lambda | Who is notified, how fast? | Authoritative log retention |
Northwind pattern and exam traps
Production pattern: organization trail from the CloudTrail delegated administrator to a locked log-archive bucket; Config recording in governed Regions; GuardDuty, Inspector, Access Analyzer, and Security Hub CSPM delegated to the same security tooling account; PCI DSS standard enabled in Security Hub CSPM because Northwind processes cards; EventBridge rules on Security Hub findings for P1/P2 severity to SNS; no expectation that Config or CloudTrail prevents the misconfiguration.
Traps. Per-account trails that app admins can delete. Using GuardDuty as the PCI vulnerability scanner. Using Inspector to evaluate KMS key policies. Using an unused-access analyzer to find public buckets. Enabling Security Hub CSPM without Config. Putting the Security Hub delegated administrator on the management account because it is convenient for billing staff. Expecting CloudTrail to page the SOC with no EventBridge rule. Claiming AWS publishes an exam pass rate—this guide never will, and detective design is scored on architecture, not folklore.
Northwind Retail wants one immutable stream of CloudTrail management events from every current and future AWS Organizations account, and application teams must not be able to stop logging. Which design matches that requirement?
Northwind must show publicly shared KMS keys and S3 buckets in the same operator console as GuardDuty threat findings and Inspector CVEs, mapped to PCI DSS controls, under a security tooling delegated administrator. Which approach produces that view?
The SOC must be notified within minutes when a production RDS instance becomes publicly accessible, without blocking the ModifyDBInstance API that made it public. Which design is the detective notification path?