Whether you're actively trying to secure your AWS environments, you're studying for the AWS Certified Security Specialty exam, or you're just curious about cloud security, you'll find that AWS offers a large number of security services. That can be daunting at first, but it doesn't have to be.

This post lists the AWS-native security services you can use in your AWS accounts, grouped by what they help protect. Each one has far more features than we can cover here, so think of this as a map: what each service is for, and where it fits.

Cheat sheet

AWS Native Security Services

This represents a list of AWS’ native security services, broken down by category and explained in high-level detail.

Cybr

Identity and Access Management

IAM
Manage identities and access to AWS services and resources. This service lets you create IAM Users, Groups, Roles, Policies, and more
IAM Access Analyzer IAM feature for least privilege: external, internal & unused access findings, policy validation & checks, and policy generation
IAM Identity Center (SSO)
Manage access to multiple AWS accounts and applications, and connect to your corporate directory or the Directory Service
Cognito
Add user sign-up and sign-in to your web or mobile applications
Verified Permissions
Policy-based access control by using roles and attributes with Cedar
Directory Service
Managed Microsoft AD, or AD Connector to an existing on-prem AD, to give AD users & groups access to AWS (can connect to Identity Center)
RAM (Resource Access Manager)
Securely share resources across multiple accounts, like VPC subnets, private certificate authorities, etc...
Organizations
Centrally manage multi-account AWS environments and enable services like Identity Center, Control Tower, and more

Detection and Response

GuardDuty
Continuous threat detection for accounts & workloads, with protection plans for S3, EKS, runtime, RDS, Lambda & malware. Extended Threat Detection correlates multi-stage attacks
Inspector
Automated vulnerability management for EC2, container images, Lambda & source code. Scans for software vulnerabilities, code issues & unintended network exposure
Security Hub
Correlates findings from GuardDuty, Inspector, Macie, Security Hub CSPM & more into prioritized security risks across your accounts
Security Hub CSPM
Automated posture checks against standards like CIS & AWS Foundational Security Best Practices (the original Security Hub)
Security Incident Response
Triage of GuardDuty & Security Hub findings, guided containment, and 24/7 access to the AWS Customer Incident Response Team
Security Lake
Central location to store all of your security data. Then analyze and visualize this data through Athena/OpenSearch/SageMaker, etc...
Detective
Conduct security investigations by analyzing & visualizing security data related to security issues. Integrates with many services on this list
CloudWatch
Monitor your account, applications, and resources on AWS, on-prem, or on other clouds. Collects all sorts of data (not just security related)
CloudTrail
Track API usage and user activity across all of your AWS accounts and regions. Enables incident response & audits, and detects unusual activity
IoT Device Defender
Security for IoT devices & fleets. Audits device configurations against best practices (Detect is closed to new customers)
Elastic Disaster Recovery
Disaster recovery service that lets you test, recover, and fail back cloud-based & on-prem apps

Network and application protection

Firewall Manager
Centrally manage AWS WAF, Shield Advanced, security groups & network ACLs, Network Firewall, Route 53 Resolver DNS Firewall & 3rd party firewalls
Network Firewall
Deploy across your VPCs to control traffic flowing in and out
Shield
DDoS protection for your apps & AWS resources. Standard is free & covers L3/L4. Advanced adds L7 protection with WAF, the Shield Response Team & cost protection
Verified Access
Validates corporate application requests before granting access and removes the need for a VPN
Web Application Firewall (WAF)
Protect web apps from common exploits (like SQLi, XSS, etc...) & bots. Works with CloudFront, ALB, API Gateway, AppSync, Cognito, App Runner, Verified Access & Amplify
Route 53 Resolver DNS Firewall
Firewall for outbound DNS traffic for your VPCs. You can create deny lists and allow lists for domains & protect against common DNS threats

Data Protection

Macie
Uses ML and pattern matching to help protect sensitive data at scale. Example: it can detect PII stored in Amazon S3 and trigger automated remediation with EventBridge & Security Hub workflows
Key Management Service (KMS)
Create, manage, and control cryptographic keys for your applications and services. Used to encrypt or digitally sign data
CloudHSM
Single-tenant hardware security modules (HSMs) so you can generate and use your own encryption keys in instances only used by you & not other customers
Certificate Manager
SSL/TLS certificates you can create, deploy, & manage for use with AWS services and resources
Payment Cryptography
For organizations that process payments and need to secure the data with cryptographic functions and key management
Private Certificate Authority
Issue and manage private certificates. Great for IAM Roles Anywhere, as an example
Backup
Centralized, policy-based backups across AWS services, with Vault Lock & logically air-gapped vaults for ransomware recovery
Secrets Manager
Central management for secrets (passwords, private API keys, tokens, etc..). Works directly with KMS to encrypt secrets. Say bye to hardcoded secrets

Compliance

Artifact
On-demand access to AWS security and compliance reports and select online agreements.
Audit Manager
Continuously audit your AWS environments against compliance frameworks (closed to new customers; AWS points to Config conformance packs)

Honorable mentions

Control Tower
Set up, operate, and enforce multi-account environments security best practices & controls
AWS Systems Manager
Manage your cloud resources for operations, app, change, and node management. Works great with Config, for example
AWS Config
Keeps an eye on configurations of your services & workloads, and enables automated remediation when deviations happen to remain compliant

Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Preview prompt

Identity and Access Management

IAM (Identity and Access Management)

Manage identities and access to AWS services and resources. This service lets you create IAM Users, Groups, Roles, Policies, and more.

IAM Identity Center (formerly SSO)

Manage access to multiple AWS accounts and applications and connect to your corporate directory or the Directory Service.

Creating users through Identity Center is meant to replace creating IAM Users in most cases since it provides multiple benefits, including not having to manage more passwords or access keys.

Cognito

Add user sign-up and sign-in to your web or mobile apps.

Verified Permissions

Policy-based access control by using roles and attributes with Cedar (an open-source language for access control by AWS).

Directory Service

Managed Microsoft Active Directory (AD), or AD Connector to proxy to an existing on-prem AD, to give AD users and groups access to AWS (can connect to Identity Center).

RAM (Resource Access Manager)

Securely share resources across multiple accounts, like VPC subnets, private certificate authorities, etc...

Organizations

Centrally manage multi-account AWS environments and enable services like Identity Center, Control Tower, and more.

Detection and Response

GuardDuty

Automated and continuous threat detection backed by machine learning. It covers account and IAM activity out of the box, with optional protection plans for S3, EKS, ECS and EC2 runtime, Lambda, RDS logins, and malware scanning. Extended Threat Detection correlates signals into multi-stage attack sequences.

Inspector

Automated vulnerability management for EC2 instances, ECR container images, Lambda functions, and (with Code Security) source code repositories. Scans for software vulnerabilities, code issues, and unintended network exposure.

Security Hub

Correlates findings from GuardDuty, Inspector, Macie, Security Hub CSPM, and IAM Access Analyzer into prioritized security risks, so you can see what matters most across your accounts.

Security Hub CSPM

Automated security posture checks against standards like CIS and AWS Foundational Security Best Practices. This was the original Security Hub, renamed in 2025.

Security Incident Response

Helps you prepare for, respond to, and recover from security incidents: it triages GuardDuty and Security Hub findings, can run containment actions with your permission, and gives you 24/7 access to the AWS Customer Incident Response Team (CIRT).

Security Lake

Central location to store all of your security data. Then, you can analyze and visualize this data through Athena, OpenSearch, SageMaker, etc...

Detective

Conduct security investigations by analyzing and visualizing security data related to security issues. It integrates with many services mentioned on this page.

Config

Keeps an eye on configurations of your services and workloads, and enables automated remediation when deviations happen in order to remain compliant.

CloudWatch

Monitor your account, applications, and resources on AWS, on-prem, or on other clouds. It collects all sorts of data, and not just security-related data. For example, it can report back on performance metrics.

CloudTrail

Track API usage and user activity across all of your AWS accounts and regions. Enables incident response (IR) and audits, and detects unusual activity. Integrates well with multiple other services on this list, including CloudWatch, Athena, EventBridge, and others.

IoT Device Defender

Security for IoT devices and fleets. It audits device configurations against best practices. (Its Detect feature, for spotting abnormal device behavior, closed to new customers on August 31, 2026.)

Elastic Disaster Recovery

Disaster recovery (DR) service that lets you test, recover, and fail back cloud-based and on-prem applications.

Backup

Centralized, policy-based backups across AWS services, with Vault Lock (WORM) and logically air-gapped vaults for ransomware recovery.

Network and Application Protection

Firewall Manager

Centralizes managing firewall rules including for: AWS WAF, AWS Shield Advanced, VPC security groups and network ACLs, AWS Network Firewall, Route 53 Resolver DNS Firewall, and third-party firewalls.

Network Firewall

Deploy across your VPCs to control traffic flowing in and out.

Shield

DDoS protection for your apps and AWS resources. Standard is free and protects against L3/L4 attacks. Advanced is a paid upgrade that adds enhanced L3/L4 detection, L7 protection with AWS WAF (including automatic application-layer mitigation), 24/7 access to the Shield Response Team, and DDoS cost protection.

Verified Access

Validates corporate application requests before granting access and removes the need for a VPN.

Web Application Firewall (WAF)

Protects web applications from common exploits (like SQLi, XSS, etc...) as well as bot traffic. Can protect CloudFront, ALB, API Gateway REST APIs, AppSync, Cognito user pools, App Runner, Verified Access, and Amplify.

Route 53 Resolver DNS Firewall

Firewall for outbound DNS traffic for your VPCs. You can create deny lists and allow lists for domains and protect against common DNS threats.

Data Protection

Macie

Uses machine learning (ML) and pattern matching to help protect sensitive data at scale. For example, it can help detect personally identifiable information (PII) stored in Amazon S3 and trigger automated remediation with EventBrige and Security Hub workflows, for example.

Key Management Service (KMS)

Create, manage, and control cryptographic keys for your applications and services. Used to encrypt or digitally sign data.

CloudHSM

Single-tenant hardware security modules (HSMs) so you can generate and use your own encryption keys in instances only used by you and not other customers.

Certificate Manager

SSL/TLS certificates you can create, deploy, and manage for use with AWS services and resources.

Payment Cryptography

For organizations that process payments and need to secure the data with cryptographic functions and key management.

Private Certificate Authority

Issue and manage private certificates. Great for IAM Roles Anywhere (for example).

Secrets Manager

Central management for secrets (passwords, private API keys, tokens, etc...). It works directly with KMS to encrypt secrets. You can use this service instead of having to hardcode secrets. For example, if you need to use or process a secret value in an AWS Lambda function, you don't have to hardcode it or pass it in the API call. You can instead give permissions to access the secret in Secrets Manager through a role and resource policy.

Compliance

Artifact

On-demand access to AWS's security and compliance reports (like SOC and ISO reports) and agreements, so you can share them with auditors.

Audit Manager

Centrally and continuously audit your AWS environments to assess risks and compliance. Audit Manager closed to new customers on April 30, 2026, and AWS points new users to AWS Config conformance packs instead.

Honorable mentions

These are either not considered strictly security services, they don't really fit in one of the other categories, or they are features of another service already mentioned. We're including them here because they're very important services/features that deserve a mention of their own:

  • AWS Control Tower - Set up, operate, and enforce multi-account environments security best practices and controls
  • AWS Systems Manager (SSM) - Manage your cloud resources for operations, app, change, and node management. Works great with Config as an example.
  • IAM Access Analyzer - IAM feature that helps achieve least privilege: external and internal access findings, unused access findings, policy validation, custom policy checks, and policy generation from CloudTrail activity. More in How to Achieve Least Privilege in AWS IAM.

Additional Resources