Filter concepts by levelShowing all levels.

AWS · Section 31

AWS Security Services

Level
intermediate
Read
12 min
Concepts
1

Thirteen AWS security services split cleanly into four questions: what protects a secret or key (KMS, Secrets Manager, Parameter Store), what stops an attack in the request path (WAF, Shield), what detects a threat or weakness (GuardDuty, Inspector, Macie), and what investigates or audits activity after the fact (Security Hub, Detective, CloudTrail, Config, IAM Access Analyzer). The roadmap is explicit that memorizing every feature of all thirteen is not the goal — recognizing which category a new requirement falls into, and picking the one service built for it, is.

This section
AWS Security Services Explained in 8 MinutesNextWork

What is true here

  1. Protect a secret or key: KMS (encryption keys), Secrets Manager (rotating credentials), Parameter Store (config values, cheaper, no built-in rotation).
  2. Stop an attack in the request path: WAF (Layer 7 HTTP rule filtering) and Shield (Layer 3/4 DDoS mitigation) are the only two that actively block traffic.
  3. Detect a threat or weakness: GuardDuty (continuous threat detection), Inspector (vulnerability scanning), and Macie (sensitive-data discovery in S3) all generate findings — none of them block anything themselves.
  4. Investigate or audit after the fact: Security Hub aggregates findings from the detection services; Detective root-causes a GuardDuty finding; CloudTrail logs API calls; Config tracks resource configuration state; IAM Access Analyzer flags external or unused access.
  5. The useful skill is sorting a new requirement into one of these four categories, not reciting every feature of all thirteen services.

What you will be able to do

  • Name the service that fits a stated security requirement, using the problem it solves rather than the service's popularity
  • Distinguish a detection service (reports a finding) from a blocking service (actively intervenes in traffic)
  • Choose between Secrets Manager and Parameter Store based on whether rotation is required
  • Recognize when a requirement calls for an audit trail (CloudTrail) versus a configuration-state history (Config)

AWS Security Services

The role of each of the thirteen named services, sorted by the problem it solves: protect, stop, detect, or audit.

AWS Security Services: mapping the landscape

coreintermediate

AWS splits security into narrow services, each solving one problem: KMS and Secrets Manager protect secrets and keys, WAF and Shield stop external attacks, GuardDuty/Inspector/Macie/Detective find threats and vulnerabilities, and CloudTrail/Config/IAM Access Analyzer record and audit what already happened. You do not need every feature of all thirteen — you need to recognize which category a new problem falls into, then pick the one service built for it.

Think of it as

Sort every AWS security service into one of three questions it answers. "How do I keep this secret or key safe?" — KMS, Secrets Manager, Parameter Store. "How do I stop an attacker from getting in, or notice one who did?" — WAF, Shield, GuardDuty, Inspector, Macie. "How do I prove what happened and who has access to what?" — CloudTrail, Config, Security Hub, Detective, IAM Access Analyzer. A new requirement almost always maps cleanly to one of the three questions, which narrows thirteen names down to two or three real candidates.

What we're doing: Given a new requirement, pick the right service instead of reaching for the one you remember best.

pick-a-service.txttext
Requirement: "Rotate the RDS password every 30 days without redeploying the app."
-> This is a "protect a secret" problem, and specifically needs rotation.
-> Secrets Manager (native rotation) — not Parameter Store (no rotation) and not KMS (KMS protects keys, not credentials).

Requirement: "Block SQL-injection attempts against our public API before they reach the backend."
-> This is a "stop an external attack" problem at the HTTP layer.
-> WAF on the API Gateway or ALB — not Shield (Shield handles network/transport-layer DDoS, not request content).

Requirement: "Prove which IAM principal deleted a production S3 bucket last Tuesday."
-> This is an "audit what already happened" problem.
-> CloudTrail (the event history is exactly who-called-what-when) — not Config (Config shows resource state, not the API call that changed it).
1
The requirement names an action (rotate) — that keyword alone rules out Parameter Store, which has no built-in rotation.
4
The requirement names the HTTP request itself as the attack surface — that is WAF's domain, not Shield's.
7
The requirement asks "who did this" — that is an activity log question, which is what CloudTrail exists for, not a configuration-state question.

Why this works: The fastest way to choose correctly among thirteen services is to restate the requirement as one of the three questions (protect / stop / detect / audit) and let that narrow the field before comparing feature lists.

Reaching for GuardDuty or Security Hub to fix a problem they only report on

Wrong

text
# "We enabled GuardDuty, so we're protected against DDoS and SQL injection now."

Better

text
# GuardDuty and Security Hub detect and surface threats after the fact —
# WAF (request filtering) and Shield (DDoS mitigation) are the services that
# actually block traffic. Enable the blocking service for the attack itself,
# and the detection service to catch what gets through or happens elsewhere.

What you see: A team believes it is protected because a detection dashboard is green, but an actual SQL-injection or volumetric attack still reaches the application unmodified — GuardDuty and Security Hub only ever generate a finding, they never block a request.

Why: Detection services (GuardDuty, Security Hub, Inspector, Macie, Detective) all answer "did something bad happen or could it" — none of them sit in the request path. Only WAF and Shield actively intervene in traffic; conflating "we have visibility" with "we are protected" leaves the actual attack surface unchanged.

AWS security services, grouped by the problem they solve

Protect secrets & keys

KMS

Encryption keys

Secrets Manager

Rotating credentials

Parameter Store

Config values

Stop external attacks

WAF

Layer 7 HTTP rules

Shield

Layer 3/4 DDoS

Detect threats & weaknesses

GuardDuty

Threat detection

Inspector

Vulnerability scans

Macie

Sensitive-data discovery in S3

Investigate & audit

Security Hub

Aggregates findings

Detective

Root-causes a finding

CloudTrail

Who called what, when

Config

Resource state over time

IAM Access Analyzer

External/unused access

  • Protect secrets & keys
    • KMS — Encryption keys
    • Secrets Manager — Rotating credentials
    • Parameter Store — Config values
  • Stop external attacks
    • WAF — Layer 7 HTTP rules
    • Shield — Layer 3/4 DDoS
  • Detect threats & weaknesses
    • GuardDuty — Threat detection
    • Inspector — Vulnerability scans
    • Macie — Sensitive-data discovery in S3
  • Investigate & audit
    • Security Hub — Aggregates findings
    • Detective — Root-causes a finding
    • CloudTrail — Who called what, when
    • Config — Resource state over time
    • IAM Access Analyzer — External/unused access

The 13 services, by the problem each one solves

The 13 services, by the problem each one solves
ServiceCategoryProblem it solvesWhen it belongs
KMSProtectCreate and control encryption/signing keysAny workload encrypting data at rest or in transit needs managed keys
Secrets ManagerProtectStore and auto-rotate credentials, API keys, tokensAn app needs a database password or third-party API key with rotation
Parameter StoreProtectCentralized config values, optionally encryptedNon-secret config (AMI IDs, endpoints) or secrets without rotation, at lower cost
WAFStopFilters HTTP requests by rule (SQLi, XSS, rate limits)A public web app, API, or CloudFront distribution needs Layer 7 filtering
ShieldStopMitigates network/transport and application-layer DDoSStandard is automatic for every account; Advanced when DDoS resilience is a contractual SLA
GuardDutyDetectContinuously watches CloudTrail/VPC Flow Logs/DNS logs for threatsBaseline threat detection for any AWS account, minimal setup
InspectorDetectScans EC2, ECR images, and Lambda for known vulnerabilitiesWorkloads running third-party packages or container images that need CVE scanning
MacieDetectFinds sensitive data (PII, credentials) sitting in S3S3 buckets that might hold customer or regulated data and need discovery
Security HubInvestigateAggregates findings from GuardDuty/Inspector/Macie/etc. into one viewMore than one detection service is in use and findings need a single pane of glass
DetectiveInvestigateGraphs CloudTrail/VPC Flow Log activity around a findingA GuardDuty finding needs root-cause investigation, not just an alert
CloudTrailAuditLogs every API call — who, what, whenAny account needing an activity trail for security review or compliance (own full section, §34)
ConfigAuditTracks a resource's configuration state over timeCompliance checks or drift detection need "what did this look like on date X" (own full section, §35)
IAM Access AnalyzerAuditFlags resource policies granting external or unused accessPeriodic review of who can reach an S3 bucket, KMS key, or IAM role from outside the account

Together

incident-response-flow.txttext
A public S3 bucket holding customer PII gets flagged:
1. Macie      -> discovers the PII sitting in the bucket
2. GuardDuty   -> flags the bucket's public exposure as anomalous
3. Security Hub -> surfaces both findings together, ranked by severity
4. Detective   -> graphs the CloudTrail/VPC Flow Log activity around the bucket
5. IAM Access Analyzer -> confirms which external principals could reach it
6. CloudTrail  -> the API call history that made the bucket public in the first place
7. Config      -> shows exactly when the bucket's policy changed to public

Remember: Sort by the question, not the name: protect a secret or key (KMS, Secrets Manager, Parameter Store), stop an attack in the request path (WAF, Shield), detect a threat or weakness (GuardDuty, Inspector, Macie), or investigate/audit what already happened (Security Hub, Detective, CloudTrail, Config, IAM Access Analyzer). Detection services report; only WAF and Shield actually block traffic.

Advertisement