AWS Native Security Services

This represents a list of AWS’ native security services, broken down by category and explained in high-level detail.

Cybr

Identity and Access Management

IAM: Manage identities and access to AWS services and resources. This service lets you create IAM Users, Groups, Roles, Policies, and more
IAM Identity Center (SSO): Manage access to multiple AWS accounts and applications, and connect to your corporate directory or the Directory Service
Cognito: Add user sign-up and sign-in to your web or mobile applications
Verified Permissions: Policy-based access control by using roles and attributes with Cedar
Directory Service: Managed Microsoft Active Directory service to provide existing AD users & groups with access to AWS (can connect to Identity Center)
RAM (Resource Access Manager): Securely share resources across multiple accounts, like VPC subnets, private certificate authorities, etc...
Organizations: Centrally manage multi-account AWS environments and enable services like Identity Center, Control Tower, and more

Detection and Response

GuardDuty: Automated & continuous threat detection backed by machine learning. Can find account-level threats & workload threats
Inspector: Automated vulnerability management for instance/container/serverless workloads. Scans for software vulnerabilities & unintended network exposure
Security Hub: Automated compliance security checks & alerting to help you follow best practices. Aggregates security findings from multiple sources
Security Lake: Central location to store all of your security data. Then analyze and visualize this data through Athena/OpenSearch/SageMaker, etc...
Detective: Conduct security investigations by analyzing & visualizing security data related to security issues. Integrates with many services on this list
CloudWatch: Monitor your account, applications, and resources on AWS, on-prem, or on other clouds. Collects all sorts of data (not just security related)
CloudTrail: Track API usage and user activity across all of your AWS accounts and regions. Enables incident response & audits, and detects unusual activity
IoT Device Defender: Security for IoT devices and fleets. Find vulnerabilities, malicious behavior, and get alerts
Elastic Disaster Recovery: Disaster recovery service that lets you test, recover, and fail back cloud-based & on-prem apps

Network and application protection

Firewall Manager: Centralizes managing firewall rules including for: AWS WAF, AWS Network Firewall, AWS Shield, Route 53 Resolver DNS Firewall, Security Groups, & 3rd party
Network Firewall: Deploy across your VPCs to control traffic flowing in and out
Shield: DDoS protection for your apps & AWS resources. Standard is free & protects against L3/L4 attacks. Advanced is an upgrade & protects against L3/L7 attacks
Verified Access: Validates corporate application requests before granting access and removes the need for a VPN
Web Application Firewall (WAF): Protect web applications from common exploits (like SQLi, XSS, etc...) as well as bot traffic. Can sit in front of CloudFront, ALB, API Gateway, or AppSync
Route 53 Resolver DNS Firewall: Firewall for outbound DNS traffic for your VPCs. You can create deny lists and allow lists for domains & protect against common DNS threats

Data Protection

Macie: Uses ML and pattern matching to help protect sensitive data at scale. Example: it can detect PII stored in Amazon S3 and trigger automated remediation with EventBridge & Security Hub workflows
Key Management Services (KMS): Create, manage, and control cryptographic keys for your applications and services. Used to encrypt or digitally sign data
CloudHSM: Single-tenant hardware security modules (HSMs) so you can generate and use your own encryption keys in instances only used by you & not other customers
Certificate Manager: SSL/TLS certificates you can create, deploy, & manage for use with AWS services and resources
Payment Cryptography: For organizations that process payments and need to secure the data with cryptographic functions and key management
Private Certificate Authority: Issue and manage private certificates. Great for IAM Roles Anywhere, as an example
Secrets Manager: Central management for secrets (passwords, private API keys, tokens, etc..). Works directly with KMS to encrypt secrets. Say bye to hardcoded secrets

Compliance

Artifact: On-demand access to AWS security and compliance reports and select online agreements.
Audit Manager: Centrally and continuously audit your AWS environments to assess risks and compliance

Honorable mentions

Control Tower: Set up, operate, and enforce multi-account environments security best practices & controls
AWS Systems Manager: Manage your cloud resources for operations, app, change, and node management. Works great with Config, for example
AWS Config: Keeps an eye on configurations of your services & workloads, and enables automated remediation when deviations happen to remain compliant

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Use this Cybr cheat sheet as reference: AWS Native Security Services
Source: https://cybr.com/cheat-sheets/aws-security-services/

My goal: Help me choose services

Help me map AWS security services to my needs. Ask about my workloads and security goals, then recommend a focused set of services and explain the role and integrations of each. Compare commonly confused services and identify overlap and remaining coverage gaps.

Use the included reference material even if you cannot open the source URL. Ask for missing context rather than inventing my environment. Explain assumptions. For version-sensitive service behavior or commands, consult current official documentation when available, cite it, and explain any differences from this reference. If you cannot verify something, say so.

Reference material from the cheat sheet (structured text or a curated summary):

AWS native security services span identity and access (IAM, IAM Identity Center, Cognito), detection and response (GuardDuty, Security Hub, Detective), network protection (WAF, Shield, Network Firewall), data protection (KMS, CloudHSM, Secrets Manager, Macie), and compliance (Artifact, Audit Manager). CloudTrail records account activity and Config records resource configuration and evaluates rules. These services address different layers and often work together.

More cheat sheets