Security and Compliance · Topic 3 of 5
Detection and Audit Services
Know what CloudTrail, GuardDuty, Security Hub, Inspector, Macie, Trusted Advisor and Artifact each do, and which one answers each audit or threat question.
- 5 min
- CloudTrail event history covers 90 days of management events, and a trail is needed for longer storage.
- Data events (S3 objects, Lambda invokes) are off by default.
- GuardDuty reads CloudTrail, VPC flow logs and DNS logs, with no agents for these sources.
What it is
AWS has many security services, and the exam often describes a need and asks which one fits. The key is to remember what each service looks at: API calls, network and account activity, software vulnerabilities, sensitive data or best practice checks.
Most of them send findings to Amazon EventBridge, so you can alert people or start automatic remediation.
How it works
AWS CloudTrail
CloudTrail records API calls and console actions: who, what, when, from where. Management events (such as creating a resource) are recorded by default and can be viewed in event history for the past 90 days. Data events (such as S3 object reads or Lambda invocations) are not recorded by default and must be turned on.
For longer retention, create a trail that delivers logs to S3. A multi Region trail covers all Regions, and an organization trail covers every account.
Log file integrity validation lets you check that logs were not altered. CloudTrail Lake offers queries on stored events with SQL style syntax.
# AWS CLI: create a multi Region trail with integrity validation, then start logging
aws cloudtrail create-trail --name org-audit \
--s3-bucket-name my-audit-logs \
--is-multi-region-trail \
--enable-log-file-validation
aws cloudtrail start-logging --name org-auditAmazon GuardDuty
GuardDuty is a threat detection service. It analyses CloudTrail events, VPC flow logs and DNS logs, with machine learning and threat intelligence, to find activity such as an instance talking to a known bad address or unusual API use. You enable it, and there are no agents to install for the basic data sources.
Amazon Inspector
Inspector scans for software vulnerabilities and unintended network exposure. It covers EC2 instances, container images in Amazon ECR (Elastic Container Registry) and Lambda functions. For EC2 it normally uses the Systems Manager agent (an agentless option also exists), and it scans continuously as new vulnerabilities are published.
Amazon Macie
Macie uses machine learning and pattern matching to find sensitive data, such as personal information, in S3 buckets. It also reports on bucket settings, such as public access.
AWS Security Hub
Security Hub collects findings from services like GuardDuty, Inspector and Macie, and runs checks against standards such as the AWS Foundational Security Best Practices and CIS benchmarks. It gives a score and a central view across accounts and Regions. It does not detect threats by itself, it aggregates and checks.
The standards checking part is now named Security Hub CSPM (Cloud Security Posture Management), so older material may use either name.
Other tools
| Service | Use |
|---|---|
| IAM Access Analyzer | Finds resources shared outside your account or organization |
| Amazon Detective | Helps investigate the root cause of a finding using graphs of related activity |
| AWS Trusted Advisor | Best practice checks in categories such as cost optimization, performance, security, resilience (fault tolerance), operational excellence and service limits, with more checks on higher support plans |
| AWS Artifact | Download AWS compliance reports and accept agreements |
| AWS Health | Notices about events that affect your resources |
Choosing the right one
| Question | Service |
|---|---|
| Who deleted this security group? | CloudTrail |
| Is an instance communicating with a malicious IP? | GuardDuty |
| Does this instance have a known software vulnerability? | Inspector |
| Which S3 buckets contain personal data? | Macie |
| Show me all findings and compliance scores in one place | Security Hub |
| Is this bucket shared with an outside account? | IAM Access Analyzer |
| Where do I get a SOC report for an auditor? | AWS Artifact |
Responding
Findings go to EventBridge. A rule can isolate an instance by changing its security group, snapshot it for forensics, or open a ticket. Use a delegated administrator account to enable GuardDuty, Security Hub and others across the organization.
Match the verb. "Records API calls" is CloudTrail, "detects threats" is GuardDuty, "finds vulnerabilities" is Inspector, "finds sensitive data" is Macie, "aggregates findings" is Security Hub.
What to remember for the exam
- CloudTrail event history covers 90 days of management events, and a trail is needed for longer storage.
- Data events (S3 objects, Lambda invokes) are off by default.
- GuardDuty reads CloudTrail, VPC flow logs and DNS logs, with no agents for these sources.
- Inspector scans EC2, ECR images and Lambda for vulnerabilities.
- Macie finds sensitive data in S3.
- Security Hub aggregates findings and checks standards, and does not detect threats on its own.
- IAM Access Analyzer finds external sharing of resources.
- Trusted Advisor gives best practice checks, and AWS Artifact provides compliance reports.
- Findings from these services go to EventBridge.
Common mistakes
Using CloudTrail to find malware. CloudTrail records calls. GuardDuty and Inspector look for threats and vulnerabilities.
Expecting S3 object access in default logs. Turn on data events for the bucket.
Treating Security Hub as a scanner. It collects results from other services.
Enabling services in one account and one Region only. Threats do not respect those boundaries. Enable across Regions and accounts.
Forgetting the Systems Manager agent for Inspector. Agent based EC2 scanning needs it.
A trail that delivers to an S3 bucket the same account administrators can delete from is weak evidence. Protect the log bucket with restricted access, versioning and integrity validation.
Check yourself
Answer these three.
Which service tells you who stopped an EC2 instance?
AWS CloudTrail, which records API calls with the caller identity.
Which service finds an instance contacting a known malicious address?
Amazon GuardDuty, using VPC flow logs and DNS logs.
Which service finds personal data stored in S3 buckets?
Amazon Macie.
Topic 3 of 5 in Security and Compliance
Test yourself on Security and Compliance
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.