Sort AWS security services by the job they do, in your own account

Steps

1. Confirm who you are before anything else. Open CloudShell from the console toolbar and run:

aws sts get-caller-identity --query Arn --output text

An IAM Identity Center sign-in prints an ARN containing assumed-role/AWSReservedSSO_; an IAM user prints one containing user/ and your user name. If the ARN ends in :root, do not go on: sign out and sign back in as your administrative identity. 2. Read the state of AWS Shield. The Shield API answers in US East (N. Virginia), so name that Region:

aws shield get-subscription-state --region us-east-1 --query SubscriptionState --output text

It prints INACTIVE. That word describes Shield Advanced, the paid subscription with the Shield Response Team and cost protection. Shield Standard needs no subscription: it already protects every AWS customer against common network and transport layer DDoS attacks. Do not subscribe to Shield Advanced from the Shield console; it is a paid subscription with a long commitment. 3. Read whether Amazon GuardDuty is on in this Region, without changing it:

aws guardduty list-detectors --query 'length(DetectorIds)'

0 means GuardDuty is off here; 1 means someone, perhaps your organisation, turned it on. Leave it as it is. GuardDuty detects: it analyses CloudTrail events, VPC Flow Logs and DNS logs and reports likely threats as findings, and it never blocks a request. This lesson's capstone turns it on and off again safely. 4. Turn on IAM Access Analyzer for this account. The type ACCOUNT is the external access analyzer, which looks for resources shared with someone outside your account:

aws accessanalyzer create-analyzer --analyzer-name clf-lab11-analyzer --type ACCOUNT
aws accessanalyzer get-analyzer --analyzer-name clf-lab11-analyzer --query 'analyzer.status' --output text

The second command prints CREATING for a moment and then ACTIVE; run it again until it says ACTIVE. Use only the ACCOUNT type here. The unused access type is a different analyzer that is charged, as the IAM Access Analyzer pricing page explains. 5. Give the analyzer two or three minutes for its first scan, then list what it found:

ARN=$(aws accessanalyzer get-analyzer --analyzer-name clf-lab11-analyzer --query 'analyzer.arn' --output text)
aws accessanalyzer list-findings --analyzer-arn "$ARN" --filter '{"status": {"eq": ["ACTIVE"]}}' --query 'findings[].[resourceType,resource]' --output text

Each line is a resource, such as an S3 bucket or an IAM role, that a principal outside this account can reach. An empty result is normal in a new account. If a line appears that you did not expect, open it in the IAM console under Access analyzer and read who it is shared with. Access Analyzer finds and reports; it changes nothing. 6. Open AWS Trusted Advisor from the console search bar, choose Recommendations, and look at the Security category. Read the names of the checks listed there, such as Security Groups - Specific Ports Unrestricted and MFA on Root Account, and the status of each. Trusted Advisor reviews how the account is configured against best practice and recommends fixes; it does not watch traffic or block anything. How many checks you can open depends on the account's support plan. 7. Find the two kinds of outside help the lesson names. In the console search bar open AWS Marketplace, choose Discover products, and filter by the Security category to see firewalls, intrusion detection and SIEM products from other vendors. Browse only: do not subscribe to anything or start a trial. Then open the three places AWS publishes security information: the AWS Security Blog (aws.amazon.com/blogs/security), the AWS Knowledge Center on AWS re:Post (repost.aws/knowledge-center) and the AWS Security Center (aws.amazon.com/security). 8. In your own notes, write one line for each verb in the lesson's summary and the service that does it: block web requests, absorb DDoS, manage rules across accounts, detect threats, scan for vulnerabilities, discover sensitive data, aggregate findings, investigate a finding, review configuration, find resources shared outside the account, buy third-party tools. Mark the four you looked at in this lab.