Security Services#

AWS provides a deep security services portfolio — from encryption key management to threat detection. This section covers the services you need to protect production workloads.

AWS KMS (Key Management Service)#

Centrally managed encryption keys for data at rest and in transit.

Concept	Description
CMK (Customer Master Key)	The root key — never leaves KMS hardware
Data key	Generated by KMS, used to encrypt your data (envelope encryption)
Key policy	IAM-like policy attached to the key (who can use/manage it)
Key rotation	Automatic annual rotation (AWS-managed keys) or manual
Key alias	Human-readable name (`alias/my-app-key`)

Envelope Encryption Pattern#

1. App calls KMS → GenerateDataKey → plaintext data key + encrypted data key
2. App encrypts data with plaintext data key
3. App stores encrypted data + encrypted data key together
4. App discards plaintext data key from memory
5. To decrypt: send encrypted data key to KMS → get plaintext data key → decrypt data

Services That Integrate with KMS#

S3 (SSE-KMS), EBS, RDS, DynamoDB, Secrets Manager, SQS, SNS, CloudWatch Logs, ECS, Lambda environment variables.

AWS WAF (Web Application Firewall)#

Protects CloudFront, ALB, API Gateway, and AppSync from common web exploits.

Rule Type	What It Blocks
AWS Managed Rules	OWASP Top 10, known bad inputs, bot traffic
Rate-based rules	DDoS, brute force (e.g., >2000 requests per 5 min from one IP)
IP set rules	Block/allow specific IPs or CIDR ranges
Geo-match rules	Block/allow by country
Regex pattern rules	Custom patterns in headers, body, URI
SQL injection rules	`' OR 1=1`, union-based injection patterns
XSS rules	`<script>` tags, event handlers in input

AWS Shield#

	Shield Standard	Shield Advanced
Cost	Free	~$3,000/month
Protection	L3/L4 DDoS (SYN flood, UDP reflection)	L3/L4/L7 + dedicated DDoS response team
Response	Automatic	24/7 DDoS Response Team (DRT)
Cost protection	No	Yes (DDoS scaling cost credits)

Amazon GuardDuty#

Threat detection service — analyses CloudTrail, VPC Flow Logs, and DNS logs to find suspicious activity.

Finding Type	Example
Recon	Port scan from known malicious IP
Credential compromise	API calls from unusual location or impossible travel
Crypto mining	EC2 instance communicating with Bitcoin mining pool
Data exfiltration	Unusual S3 bucket access patterns
Privilege escalation	IAM user creating admin policies

No agents, no infrastructure to manage. Enable it per account/region and it starts analysing immediately.

AWS Security Hub#

Aggregates findings from GuardDuty, Inspector, Macie, Config, Firewall Manager, and third-party tools into a single dashboard.

Compliance Standards#

Standard	What It Checks
AWS Foundational Security Best Practices	200+ checks across all services
CIS AWS Foundations Benchmark	50+ controls (IAM, logging, networking)
PCI DSS	Payment card industry requirements
NIST 800-53	US government security controls

Amazon Inspector#

Automated vulnerability scanning:

Target	What It Scans
EC2 instances	OS packages (CVEs), network reachability
ECR container images	OS packages and application dependencies
Lambda functions	Application dependencies

Findings include CVE ID, severity (CVSS), affected package, and remediation guidance.

Amazon Macie#

Discovers and protects sensitive data in S3:

Scans S3 buckets for PII (names, addresses, credit cards, SSNs)
Identifies buckets with public access, no encryption, or overly permissive policies
Generates findings for compliance (GDPR, HIPAA)

AWS Config#

Continuously evaluates resource configurations against rules:

Config Rule: "All S3 buckets must have encryption enabled"
→ Evaluates every bucket
→ Flags non-compliant resources
→ Optional: auto-remediation via SSM Automation

Common Config Rules#

Rule	Checks
`s3-bucket-server-side-encryption-enabled`	Encryption on all buckets
`rds-storage-encrypted`	RDS encryption enabled
`restricted-ssh`	No 0.0.0.0/0 on port 22 in security groups
`iam-root-access-key-check`	No access keys on root account
`cloudtrail-enabled`	CloudTrail active in all regions

Security Architecture Pattern#

Internet → CloudFront + WAF → ALB → Security Groups → ECS/EC2
                                          ↓
                                    KMS (encryption at rest)
                                    Secrets Manager (credentials)
                                    GuardDuty (threat detection)
                                    Config (compliance)
                                    Security Hub (aggregation)
                                    CloudTrail (audit log)

Key Takeaways#

KMS for encryption key management. Use envelope encryption — never encrypt data with the master key directly.
WAF on CloudFront/ALB for L7 protection (OWASP rules, rate limiting, geo-blocking). Shield for DDoS.
GuardDuty for threat detection — enable it in every account, zero infrastructure.
Security Hub aggregates findings from all security services into one dashboard.
Inspector for vulnerability scanning (EC2, ECR, Lambda). Macie for PII discovery in S3.
AWS Config for continuous compliance — detect and auto-remediate configuration drift.