AWS Security Services [Cheat Sheet]
Whether you’re actively trying to secure your AWS environments, you’re studying for the Certified Security Specialty exam, or you’re just curious and want to learn…
Whether you’re actively trying to secure your AWS environments, you’re studying for the Certified Security Specialty exam, or you’re just curious and want to learn more about AWS and cloud security, you’ll find that AWS offers quite a large number of security-focused services and features. This can be daunting when you’re first getting started, but it doesn’t have to be!
Each of these services can be categorized under core security pillars. Let’s see where each service fits in:
Identity & Access Management:
IAM: Your cornerstone for securely managing access to AWS services and resources
IAM Access Analyzer: Fine-tune access with granular permissions (Tip: use this to give least privilege permissions!)
AWS Organizations: Manage and govern multiple AWS accounts
IAM Identity Center: Simplify workforce access across AWS accounts, services, and apps
Data Protection:
Amazon Macie: Discover and shield sensitive data at scale
AWS KMS: Your locksmith, managing cryptographic keys with finesse
AWS Secrets Manager: A secure vault, safeguarding and rotating your secrets (Tip: Use to get rid of hard-coded and plaintext secrets)
AWS Certificate Manager: Provision and deploy SSL/TLS certs
Edge & Network Protection:
AWS WAF: Block web threats like SQL injection and XSS
AWS Shield: Guard against DDoS attacks
AWS Firewall Manager: Manage firewall rules, SGs, and Shield, across your AWS Organization
AWS Network Firewall: Fortify network security across Amazon VPCs by filtering traffic
Threat Detection & Response:
Amazon GuardDuty: A relentless threat detection service, continuously monitoring for malicious activities
Amazon Detective: Dive deep into security data and visualize threats
Amazon Inspector: Discover workloads and scan them for software vulnerabilities
AWS CloudTrail: A meticulous recorder, logging user activity and API usage (Tip: push to CloudWatch Logs for tracking & to generate metrics and alerts)
AWS Config: A detailed observer, recording and evaluating configurations of AWS resources (Tip: use with SSM and Lambda for automated remediation)
AWS Security Hub: Unified security command center, providing a comprehensive view of alerts and posture
Compliance:
AWS Audit Manager: Continuously auditing AWS usage against prebuilt and custom frameworks
AWS Artifact: Your gateway to compliance reports from AWS and ISVs
AWS Control Tower: Account deployment and governance
More & Conclusion
There are more not covered above you can view here: https://aws.amazon.com/products/security/
Remember that you do not need to be using all of these services. It depends on your use case/workload/business requirements. You may also find third-party solutions that offer a better approach.
That’s also why I’m here! To get you started, check out our Introduction to AWS Security course (now with Hands-On Labs!)
AWS Native Security Services
This represents a list of AWS’ native security services, broken down by category and explained in high-level detail.
Identity and Access Management
- IAM
- Manage identities and access to AWS services and resources. This service lets you create IAM Users, Groups, Roles, Policies, and more
- IAM Identity Center (SSO)
- Manage access to multiple AWS accounts and applications, and connect to your corporate directory or the Directory Service
- Cognito
- Add user sign-up and sign-in to your web or mobile applications
- Verified Permissions
- Policy-based access control by using roles and attributes with Cedar
- Directory Service
- Managed Microsoft Active Directory service to provide existing AD users & groups with access to AWS (can connect to Identity Center)
- RAM (Resource Access Manager)
- Securely share resources across multiple accounts, like VPC subnets, private certificate authorities, etc...
- Organizations
- Centrally manage multi-account AWS environments and enable services like Identity Center, Control Tower, and more
Detection and Response
- GuardDuty
- Automated & continuous threat detection backed by machine learning. Can find account-level threats & workload threats
- Inspector
- Automated vulnerability management for instance/container/serverless workloads. Scans for software vulnerabilities & unintended network exposure
- Security Hub
- Automated compliance security checks & alerting to help you follow best practices. Aggregates security findings from multiple sources
- Security Lake
- Central location to store all of your security data. Then analyze and visualize this data through Athena/OpenSearch/SageMaker, etc...
- Detective
- Conduct security investigations by analyzing & visualizing security data related to security issues. Integrates with many services on this list
- CloudWatch
- Monitor your account, applications, and resources on AWS, on-prem, or on other clouds. Collects all sorts of data (not just security related)
- CloudTrail
- Track API usage and user activity across all of your AWS accounts and regions. Enables incident response & audits, and detects unusual activity
- IoT Device Defender
- Security for IoT devices and fleets. Find vulnerabilities, malicious behavior, and get alerts
- Elastic Disaster Recovery
- Disaster recovery service that lets you test, recover, and fail back cloud-based & on-prem apps
Network and application protection
- Firewall Manager
- Centralizes managing firewall rules including for: AWS WAF, AWS Network Firewall, AWS Shield, Route 53 Resolver DNS Firewall, Security Groups, & 3rd party
- Network Firewall
- Deploy across your VPCs to control traffic flowing in and out
- Shield
- DDoS protection for your apps & AWS resources. Standard is free & protects against L3/L4 attacks. Advanced is an upgrade & protects against L3/L7 attacks
- Verified Access
- Validates corporate application requests before granting access and removes the need for a VPN
- Web Application Firewall (WAF)
- Protect web applications from common exploits (like SQLi, XSS, etc...) as well as bot traffic. Can sit in front of CloudFront, ALB, API Gateway, or AppSync
- Route 53 Resolver DNS Firewall
- Firewall for outbound DNS traffic for your VPCs. You can create deny lists and allow lists for domains & protect against common DNS threats
Data Protection
- Macie
- Uses ML and pattern matching to help protect sensitive data at scale. Example: it can detect PII stored in Amazon S3 and trigger automated remediation with EventBridge & Security Hub workflows
- Key Management Services (KMS)
- Create, manage, and control cryptographic keys for your applications and services. Used to encrypt or digitally sign data
- CloudHSM
- Single-tenant hardware security modules (HSMs) so you can generate and use your own encryption keys in instances only used by you & not other customers
- Certificate Manager
- SSL/TLS certificates you can create, deploy, & manage for use with AWS services and resources
- Payment Cryptography
- For organizations that process payments and need to secure the data with cryptographic functions and key management
- Private Certificate Authority
- Issue and manage private certificates. Great for IAM Roles Anywhere, as an example
- Secrets Manager
- Central management for secrets (passwords, private API keys, tokens, etc..). Works directly with KMS to encrypt secrets. Say bye to hardcoded secrets
Compliance
- Artifact
- On-demand access to AWS security and compliance reports and select online agreements.
- Audit Manager
- Centrally and continuously audit your AWS environments to assess risks and compliance
Honorable mentions
- Control Tower
- Set up, operate, and enforce multi-account environments security best practices & controls
- AWS Systems Manager
- Manage your cloud resources for operations, app, change, and node management. Works great with Config, for example
- AWS Config
- Keeps an eye on configurations of your services & workloads, and enables automated remediation when deviations happen to remain compliant
Use this cheat sheet with AI
Copy a ready-to-use prompt into your preferred AI assistant.
