Security services, third-party security tools, and where AWS publishes security information

Why this matters

AWS sells dozens of security services, and their names give little away. A manager approving a budget line for "GuardDuty" or "Shield Advanced" needs to know what each one actually does, and what it does not. A salesperson asked "can AWS stop attacks on our website?" needs to answer with the right service, not the nearest-sounding one. A junior engineer who mixes up a service that finds problems with one that fixes them will leave a gap that nobody notices until it matters.

Security is also a field where the advice changes. New threats appear, AWS releases features, and old guidance goes stale. Knowing where AWS publishes its security information, and which publication answers which kind of question, is as useful as knowing the services themselves.

This lesson gives you a working map: which service blocks, which detects, which investigates, which scans, which manages, and where to read more.

The lesson

Security capabilities that AWS provides

The quickest way to keep AWS security services apart is to sort them by the job they do. Lesson 8 goes deeper into encryption; here the aim is recognition.

Scanning and finding weaknesses

• Amazon Inspector automatically discovers Amazon EC2 instances, container images in Amazon Elastic Container Registry (Amazon ECR) and AWS Lambda functions, and scans them continually for known software vulnerabilities and unintended network exposure. It reports problems; it does not install fixes.
• AWS Systems Manager, through its Patch Manager capability, scans instances for missing patches and installs them on a schedule across a fleet. Inspector tells you what is vulnerable; Systems Manager patches it.
• Amazon Macie uses machine learning and pattern matching to discover sensitive data, such as personally identifiable information, stored in Amazon S3.
• IAM Access Analyzer uses automated reasoning on resource policies to find resources, such as S3 buckets and IAM roles, that are shared with someone outside your account or organisation.

Collecting and investigating

• AWS Security Hub gathers and prioritises findings from GuardDuty, Inspector, Macie and other sources in one place, and runs automated, continuous checks against security standards such as AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark, scoring the results.
• Amazon Detective helps an analyst find the root cause of a finding. It builds a linked model of activity from sources such as AWS CloudTrail, VPC Flow Logs and GuardDuty findings, so related users, IP addresses and resources can be traced together.

Keys, certificates and identity

• AWS Key Management Service (AWS KMS) creates and controls the encryption keys that protect data in services such as Amazon S3 and Amazon EBS, and every use of a key is logged in CloudTrail.
• AWS CloudHSM provides dedicated, single-tenant hardware security modules that the customer alone controls. KMS also uses hardware security modules, but AWS manages them and they are shared across customers, so a single-tenant requirement points to CloudHSM.
• AWS Certificate Manager (ACM) provisions public SSL/TLS certificates for services such as Elastic Load Balancing and Amazon CloudFront, and renews them automatically.
• AWS Directory Service for Microsoft Active Directory, also called AWS Managed Microsoft AD, runs real Active Directory domain controllers that AWS manages, so Windows workloads can join a domain.

Network filtering inside a VPC

• A security group is a stateful virtual firewall for the resources it is attached to, such as EC2 instances. It has allow rules only, and return traffic for an allowed request is let through automatically.
• A network ACL filters traffic at the subnet boundary. It is stateless and supports both allow and deny rules, so blocking one IP range for every instance in a subnet is a network ACL job. Lesson 17 covers both in more detail.

Security-related documentation that AWS provides

AWS publishes guidance as well as services. The most exam-relevant piece is the security pillar of the AWS Well-Architected Framework (lesson 2). It sets out AWS's design principles for securing workloads, among them: implement a strong identity foundation, maintain traceability, apply security at all layers, automate security best practices, protect data in transit and at rest, keep people away from data, and prepare for security events. A question asking where to find principles for protecting data and identities points to the security pillar, not to the reliability pillar, which is about recovering from failure.

Beyond that, AWS publishes security whitepapers, service documentation with a security section for each service, and security bulletins. Compliance reports and agreements come from AWS Artifact (lesson 7), which is a different job: Artifact proves what AWS is certified for, but it does not answer how-to questions or supply software.

AWS WAF, AWS Firewall Manager, AWS Shield and Amazon GuardDuty

These four are the services the exam names most often, and each answers a different question.

AWS WAF is a web application firewall. It inspects HTTP and HTTPS requests before they reach your application, and it attaches to resources that receive web requests, such as Application Load Balancers, Amazon CloudFront distributions and Amazon API Gateway APIs. It cannot protect something that does not serve web requests, such as an Amazon RDS database. You build a set of rules, called a web ACL, that can:

• block SQL injection and cross-site scripting attempts, often using managed rule groups;
• block or allow requests from listed IP addresses;
• apply a rate-based rule, which counts requests from each IP address and blocks any source that exceeds the rate you set.

If a scenario mentions application-layer exploits, web requests or a flood of HTTP requests from a few addresses, think WAF.

AWS Shield protects against distributed denial of service (DDoS) attacks, where many machines flood a target to knock it offline. It comes in two tiers:

• Shield Standard is turned on automatically for every AWS customer at no additional charge, and defends against the most common network and transport layer DDoS attacks.
• Shield Advanced is a paid subscription that adds access to the Shield Response Team, detailed attack reporting, and cost protection against scaling charges caused by a DDoS attack on protected resources.

Shield does not block SQL injection; that is WAF. A scenario about a frequent DDoS target that wants specialist help or protection from attack-driven bills points to Shield Advanced.

AWS Firewall Manager is a management service, not a filter. It centrally configures and enforces rules, including AWS WAF rules, Shield Advanced protections and security group policies, across the accounts in an organisation, and it applies them automatically to new accounts and resources as they appear. It requires AWS Organizations, with a Firewall Manager administrator account designated. The keywords are "many accounts", "centrally" and "the same rules everywhere".

Amazon GuardDuty is continuous threat detection. It analyses CloudTrail events, VPC Flow Logs and DNS logs using threat intelligence and machine learning, and reports likely threats, such as cryptocurrency mining or credential misuse, as findings. Three points are often tested:

• You enable it with a single action. It reads those log sources directly and independently, so you do not need to turn on VPC Flow Logs yourself first.
• It adds analysis on top of CloudTrail. CloudTrail records what happened; GuardDuty judges whether it looks malicious.
• It detects and reports. It does not block API calls or traffic.

A common trap pairs GuardDuty with Inspector. Inspector scans workloads for software vulnerabilities; GuardDuty watches activity for threats. Reversing them is wrong in both directions.

Third-party security products in AWS Marketplace

AWS does not make every security product its customers want. AWS Marketplace is a curated digital catalogue where customers find, subscribe to and deploy third-party software, often billed through their AWS account. Its security section includes next-generation firewalls, intrusion detection, security information and event management (SIEM) products and vulnerability scanners. It is not limited to AWS's own software, and it is not limited to free tools.

Marketplace also sells managed rule groups for AWS WAF, written and kept up to date by security vendors. A subscriber adds them to a web ACL and the vendor maintains the rules. So a company that wants to run the same third-party firewall on AWS as it runs on premises, or wants vendor-maintained WAF rules, goes to Marketplace. Lesson 26 covers Marketplace more broadly.

Where AWS publishes security information

Three named sources come up, and each has a distinct purpose:

• AWS Knowledge Center, part of AWS re:Post, publishes articles and videos answering the questions AWS customers ask most often, such as how to grant a user access to a single bucket. Think "quick, practical answers to common questions".
• AWS Security Center, the security section of the AWS website, brings together security bulletins, whitepapers, best practices and information about AWS security services and compliance programmes. Think "one place for AWS's security overview and bulletins".
• AWS Security Blog publishes articles from AWS about security services, new features, best practices and worked solutions as they are released. Think "keep up with what is new".

Distractors in this area are usually services that publish something else. The AWS Health Dashboard reports AWS service events and scheduled changes affecting your resources, which is operational status, not security guidance. AWS Artifact supplies compliance reports. Cost Explorer, AWS Budgets and the AWS Pricing Calculator are cost tools.

Finding security issues with AWS Trusted Advisor

AWS Trusted Advisor inspects your account against AWS best practices and recommends actions. Its checks are grouped into categories, including security, cost optimisation, performance and fault tolerance. The security category includes checks for:

• security groups that allow unrestricted access to specific ports;
• a root user without MFA;
• IAM access keys that have been exposed in a public code repository.

Fault tolerance checks, by contrast, cover resilience such as backups and redundancy across Availability Zones. The range of checks you can see depends on your support plan (lesson 25).

Trusted Advisor finds gaps and recommends fixes; it does not act on traffic, and it does not watch activity for threats. Blocking malicious requests is WAF's job, and spotting suspicious behaviour is GuardDuty's. A scenario that asks for an automated review of how the account is configured, with recommendations, points to Trusted Advisor.

What the exam is really asking

Most questions here reduce to matching a verb to a service. Block web requests: WAF. Absorb DDoS: Shield. Manage rules across accounts: Firewall Manager. Detect threats in activity: GuardDuty. Scan for vulnerabilities: Inspector. Discover sensitive data: Macie. Aggregate findings and check standards: Security Hub. Investigate a finding: Detective. Review configuration against best practice: Trusted Advisor. Buy third-party tools: Marketplace. Read the scenario for that verb before you read the answers.