Security Services

Security Services Quick Notes

Who Does What

Service: Question it answers

IAM: Who can call which API?

WAF: L7 HTTP attacks (SQLi, XSS, bots, geo, rate)

Shield: DDoS (volumetric / protocol; Advanced adds more)

GuardDuty: Is something shady in the logs?

Inspector: Is this host/path vulnerable / reachable?

Macie: Sensitive data in S3?

Config: What changed / is it compliant?

Security Hub: One pane for findings

CloudTrail: Who called which API?

Trusted Advisor: Best-practice / quota checks

AWS WAF

• Attach to CloudFront, ALB, API Gateway, AppSync.
• Geo match + IP set exceptions (block countries but allow specific IPs).
• Rate-based rules: Throttle abusive request rates.
• Prefer WAF on CloudFront when traffic is edge-terminated — not instance SGs as the first control.

AWS Shield

• Standard: Free with edge services (CloudFront / R53 / Global Accelerator class).
• Advanced: Explicit enable; ~monthly fee per org.
• Consolidated billing: So Advanced monthly fee is charged once across member accounts.
• Shield ≠ XSS (that’s WAF).

Firewall Manager

• Centrally apply WAF, Shield Advanced, and VPC security group policies across an Organization.

GuardDuty

• Sources: VPC Flow Logs, DNS logs, CloudTrail (mgmt + S3 data events).
• Not sources: CloudFront logs, API Gateway logs, ELB logs alone.
• Disable vs suspend: Disable stops monitoring and deletes findings.
• Pair with Macie when you need both threat detection and sensitive-data discovery on S3.

Inspector

• EC2 / container vulnerability and reachability assessments.
• Do not swap with GuardDuty.

AWS Config

• Records configuration history; evaluates rules; does not prevent changes.
• Imported ACM certs: Use Config managed rule for expiry-within-N-days → SNS (imported certs do not auto-renew).

KMS

• Regional key management; DEKs for data > ~4 KB.
• Pending deletion: Waiting period — you can cancel and recover while pending.
• Root/Support cannot magically restore fully deleted key material.

Secrets Manager vs Parameter Store

• Secrets Manager: Secrets with automatic rotation (often via Lambda) — passwords every N days.
• Parameter Store: Hierarchical config; overlap on secret strings, weaker rotation story.

Cognito (auth for apps)

• User pools: “Who are you?” → JWT (built-in user directory).
• Identity pools: “Here are temporary AWS keys” via federation.
• ALB auth with minimal code → Cognito User Pools on the ALB.