3 AWS Security Services
Learn how AWS security services control access, protect workloads and data, detect risks, support investigation, and coordinate incident response.
How AWS security services fit together
AWS security services address connected but distinct tasks: controlling access, protecting workloads and data, detecting threats and misconfigurations, investigating findings, and coordinating response. They support an organization’s security policies, monitoring, and incident procedures; they do not replace them.
A coordinated approach connects relevant findings and logs, selects services according to the risks, and assigns people responsibility for acting on security issues.
Access and workload protection
controls access to AWS resources and the actions allowed on them. Roles and narrowly scoped permissions help apply least privilege. For example, an application can be permitted to read only the specific storage it needs rather than receiving broad account access.
Other services protect different parts of a workload:
filters web requests using rules that can help block common web exploits.
helps protect applications from distributed denial-of-service (DDoS) attacks.
helps create and manage cryptographic keys used to protect data.
AWS Secrets Manager helps manage secrets such as database credentials, reducing the need to embed them in application code.
These services address different risks. A web firewall filters traffic, while encryption protects data confidentiality.
Detection and security posture
Detection services produce signals that teams need to assess; a finding is not automatic proof of a breach. Different services identify different kinds of activity or risk:
monitors supported account, workload, and data activity for indicators of malicious or unauthorized behavior, then produces findings for investigation.
Amazon Inspector assesses supported workloads for software vulnerabilities and unintended network exposure.
Amazon Macie helps discover and protect sensitive data, such as personally identifiable information stored in Amazon S3.
records resource configurations and can evaluate them against rules or desired settings. It can help identify configuration drift, such as a storage bucket becoming publicly accessible.
records actions taken by users, roles, and AWS services. Its event history can help establish who changed a resource and when.
helps assess security posture against supported standards and best practices. AWS Security Hub provides a unified experience for prioritizing and responding to security issues, including findings from integrated services. Together, these services can help teams view related risks in one place rather than treating each alert in isolation.
Investigation and incident response
A finding needs context: what happened, which resources were involved, whether the activity was expected, and what to do next. helps analyze and investigate findings and suspicious activity by organizing related security data and relationships. Investigators can use it alongside findings from services such as GuardDuty and audit records from CloudTrail to explore a timeline and possible root cause. Detective supports analysis but does not replace the team’s decision-making or response plan.
supports incident handling by reviewing and triaging alerts from services such as GuardDuty and Security Hub CSPM, investigating potential incidents, and guiding teams on containment. It is not a threat-detection service; it works with findings generated by detection tools.
Organizations remain responsible for enabling appropriate logging, validating activity, and carrying out recommended containment or recovery actions unless they have explicitly authorized assistance to act on their behalf.
A practical response flow
A practical response flow connects detection, triage, investigation, and action:
Detect: GuardDuty may report suspicious activity, or Config may identify a risky change.
Triage: Review severity and affected resources in Security Hub, and verify relevant CloudTrail events.
Investigate: Use Detective and available logs to understand the timeline and scope.
Contain and recover: Follow the incident plan. For example, restrict compromised credentials or isolate an affected workload, then correct the cause and document the outcome.
The exact actions depend on the incident. Validate a finding against the environment before taking disruptive steps. Teams should maintain a response process that assigns responsibility for acting on findings.