Security and Compliance · Topic 5 of 5
Detection and Data Protection
Learn AWS threat detection and data protection for CLF-C02: GuardDuty, Inspector, Macie, Security Hub, KMS, Secrets Manager, CloudHSM and encryption.
- 4 min
- GuardDuty detects threats from logs and activity.
- Inspector scans for software vulnerabilities and unintended exposure.
- Macie discovers sensitive data in S3.
What it is
Security does not stop at blocking traffic. You also need to detect threats, find weaknesses and protect data with encryption.
AWS provides services for each of these jobs. The exam asks you to match a described need to the right service name.
This page covers detection and vulnerability services first, then encryption and secrets.
How it works
Threat detection and investigation
| Service | What it does |
|---|---|
| Amazon GuardDuty | Watches account activity and network logs to detect suspicious behaviour, using machine learning and threat intelligence |
| Amazon Inspector | Scans workloads such as Amazon Elastic Compute Cloud (EC2) instances, container images and Lambda functions for software vulnerabilities |
| Amazon Macie | Finds and reports sensitive data such as personal information in Amazon Simple Storage Service (S3) |
| AWS Security Hub | Gathers findings from several services and checks your setup against security standards in one place |
| Amazon Detective | Helps investigate the cause and scope of a security finding |
GuardDuty looks at things like CloudTrail events, Virtual Private Cloud (VPC) flow logs and Domain Name System (DNS) logs. You turn it on and it needs no agents to install for these sources.
Inspector is about weaknesses in software on your resources. GuardDuty is about signs of an attack in progress.
Encryption basics
Encryption turns readable data into unreadable data using a key. Encryption at rest protects stored data, such as files on disk. Encryption in transit protects data as it moves across a network, usually with Transport Layer Security (TLS).
Many AWS services support both. For example, you can turn on encryption for an S3 bucket or a database volume.
Managing keys
| Service | Purpose |
|---|---|
| AWS Key Management Service (KMS) | Create and manage encryption keys and control who can use them |
| AWS CloudHSM | Dedicated hardware security module that you control, for strict key control needs |
| AWS Certificate Manager (ACM) | Provision and manage TLS certificates for secure websites |
| AWS Secrets Manager | Store, retrieve and rotate secrets such as database passwords and application programming interface (API) keys |
KMS is the default answer for managed keys. Choose CloudHSM when a rule requires that you alone control the hardware that holds the keys.
Secrets Manager keeps passwords out of application code. The application asks for the secret at run time, and the secret can be rotated on a schedule.
An example together
A company stores customer files in S3. Macie checks the bucket for personal data, KMS holds the key that encrypts the files, and AWS Identity and Access Management (IAM) limits who can read them.
GuardDuty watches for odd access patterns, and Security Hub shows any findings alongside the rest of the account. No single service does the whole job, which is why the exam describes needs one at a time.
Reviewing your own setup
AWS Trusted Advisor gives checks across several areas, including security. For example, it can flag a security group that is open to the world or an account without multi factor authentication (MFA) on the root user.
AWS Config rules can also check resource settings against your own baseline, as described on the governance page.
Choosing quickly
- Unusual behaviour or a possible compromise: GuardDuty.
- Vulnerabilities in servers, containers or functions: Inspector.
- Personal data in S3: Macie.
- One dashboard of findings: Security Hub.
- Investigate how an event happened: Detective.
- Manage encryption keys: KMS. Dedicated hardware keys: CloudHSM.
- Store and rotate passwords: Secrets Manager.
- Website TLS certificates: ACM.
What to remember for the exam
- GuardDuty detects threats from logs and activity.
- Inspector scans for software vulnerabilities and unintended exposure.
- Macie discovers sensitive data in S3.
- Security Hub centralises findings and checks against standards.
- Detective investigates the root cause of findings.
- KMS manages encryption keys. CloudHSM gives dedicated hardware you control.
- Secrets Manager stores and rotates secrets. ACM manages TLS certificates.
- Encryption at rest protects stored data. Encryption in transit protects data moving on the network.
The service names hint at the job. Guard is a guard, Inspector checks, Macie spots sensitive data, and Detective investigates.
Common mistakes
Mixing up GuardDuty and Inspector. GuardDuty detects suspicious activity. Inspector finds vulnerabilities before they are exploited.
Choosing KMS when dedicated hardware is required. That need points to CloudHSM.
Storing passwords in code. Use Secrets Manager instead.
Assuming encryption is automatic everywhere. Many services offer it, but you must check and often enable it.
Macie analyses data stored in S3. Do not pick it for finding personal data in a database or on a server disk.
Check yourself
Which service scans EC2 instances and container images for vulnerabilities?
Amazon Inspector.
Which service finds sensitive data such as personal information in S3?
Amazon Macie.
Which service stores and rotates database passwords?
AWS Secrets Manager.
Topic 5 of 5 in Security and Compliance
Test yourself on Security and Compliance
The full AWS CLF-C02 question bank has 832 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.