AWS Security Services Landscape
Build a mental map of AWS security services: GuardDuty, Inspector, Macie, Security Hub, Detective, and Firewall Manager — and know which one to pick for each scenario.
The problem: too many security services
AWS offers a rich set of security services, and they can blur together. This lesson gives you a clear mental model: "If I need X, I use Y."
We will cover six services that frequently appear on the Cloud Practitioner exam:
- GuardDuty — threat detection
- Inspector — vulnerability scanning
- Macie — sensitive data discovery
- Security Hub — centralized findings
- Detective — investigation and visualization
- Firewall Manager — centralized WAF/Shield management
GuardDuty — threat detection
What it does: Continuously monitors your AWS environment for malicious activity and unauthorized behavior.
How it works: Analyzes multiple data sources:
- CloudTrail management and data events
- VPC Flow Logs
- DNS query logs
GuardDuty uses threat intelligence feeds and machine learning to identify threats like:
- Compromised EC2 instances communicating with known bad IPs
- Unusual API call patterns suggesting stolen credentials
- Cryptocurrency mining on your resources
Tip
Exam keyword: "threat detection" or "malicious activity" → GuardDuty
Inspector — vulnerability scanning
What it does: Automatically discovers and scans workloads for software vulnerabilities and unintended network exposure.
What it scans:
- EC2 instances
- Container images in Amazon ECR
- Lambda functions
What it finds:
- Known CVEs (Common Vulnerabilities and Exposures) in installed packages
- Network reachability issues (ports unintentionally open to the internet)
Tip
Exam keyword: "vulnerability scanning" or "CVE" or "software vulnerabilities" → Inspector
Macie — sensitive data discovery
What it does: Uses machine learning and pattern matching to discover and protect sensitive data stored in Amazon S3.
What it finds:
- Personally Identifiable Information (PII): names, addresses, SSNs, credit card numbers
- Financial data, health records, credentials
- Custom data identifiers you define
Where it looks: S3 buckets only.
Tip
Exam keyword: "sensitive data in S3" or "PII detection" → Macie
Security Hub — centralized findings
What it does: Aggregates, organizes, and prioritizes security findings from multiple AWS services and third-party tools into a single dashboard.
Feeds into Security Hub:
- GuardDuty findings
- Inspector findings
- Macie findings
- Firewall Manager findings
- Third-party partner tools
Why it matters: Instead of checking six different consoles, Security Hub gives you one place to see and prioritize everything.
Tip
Exam keyword: "centralize security findings" or "single dashboard for security" → Security Hub
Detective — investigation and visualization
What it does: Helps you investigate and determine the root cause of security findings. After GuardDuty or Security Hub flags something, Detective helps you dig deeper.
How it works: Automatically collects log data and uses graph models to visualize relationships between resources, IP addresses, and AWS accounts over time.
Key distinction: Security Hub tells you what happened. Detective helps you understand why and how.
Tip
Exam keyword: "investigate security findings" or "root cause analysis" → Detective
Firewall Manager — centralized WAF/Shield management
What it does: Lets you centrally configure and manage WAF rules, Shield Advanced protections, and security group rules across multiple accounts in an AWS Organization.
Key use case: A company with 50 AWS accounts wants the same WAF rules applied everywhere — Firewall Manager does this from one place.
Note
Firewall Manager requires AWS Organizations. It is about centralized management of firewall-type protections, not about detecting threats or scanning for vulnerabilities.
The decision table
| If you need to... | Use this service |
|---|---|
| Detect threats and malicious activity across your account | GuardDuty |
| Scan EC2, containers, or Lambda for software vulnerabilities | Inspector |
| Find sensitive data (PII) in S3 buckets | Macie |
| See all security findings in one dashboard | Security Hub |
| Investigate the root cause of a security finding | Detective |
| Apply WAF/Shield rules across multiple accounts | Firewall Manager |
Tip
Print or screenshot this table. It is one of the highest-value references for the exam.
How they work together
GuardDuty ──┐
Inspector ──┼──→ Security Hub ──→ Detective
Macie ──────┘ (aggregate) (investigate)
Firewall Manager → WAF/Shield rules across accounts- GuardDuty, Inspector, and Macie each find different kinds of issues
- Security Hub collects and prioritizes all their findings
- Detective helps you investigate the most important findings
- Firewall Manager operates independently to enforce firewall rules at scale
Summary
- GuardDuty = threat detection (CloudTrail, VPC Flow Logs, DNS)
- Inspector = vulnerability scanning (EC2, ECR, Lambda)
- Macie = sensitive data in S3 (PII detection)
- Security Hub = centralized security findings dashboard
- Detective = investigate and visualize root causes
- Firewall Manager = manage WAF/Shield rules across accounts
- Use the "If you need X, use Y" table to pick the right service