SOC for Cloud Environments · Topic 2 of 3
AWS SOC Architecture and AWS Security Hub
Learn the AWS SOC architecture, AWS Security Hub, GuardDuty, CloudTrail, Detective, Inspector, Macie and the AWS log sources a SOC uses, for CSA 312-39.
- 5 min
- CloudTrail records API activity; VPC Flow Logs record network traffic; Config records configuration history.
- GuardDuty detects threats; Inspector finds vulnerabilities; Macie finds sensitive data in S3; Detective investigates.
- Security Hub centralizes and prioritizes findings; Security Hub CSPM runs standards based posture checks.
What it is
An AWS SOC monitors Amazon Web Services accounts using AWS logging, detection and posture services, often feeding a SIEM. AWS Security Hub sits at the center, collecting and prioritizing findings from other AWS security services and partner products in one place.
AWS secures the cloud infrastructure; the customer secures what it puts in the cloud, including IAM, data, network configuration and workloads.
How it works
Main AWS log sources
| Source | What it records |
|---|---|
| AWS CloudTrail | API calls and console actions: who did what, when, from where |
| VPC Flow Logs | IP traffic to and from network interfaces in a VPC |
| Route 53 Resolver query logs | DNS queries made from resources in a VPC |
| Amazon CloudWatch Logs | Application, operating system and service logs |
| Elastic Load Balancing access logs | Requests sent to the load balancer |
| Amazon S3 server access logs | Requests made to a bucket |
| AWS WAF logs | Web requests and the rules that matched |
| AWS Config | Resource configuration history and compliance with rules |
CloudTrail is the most important source for cloud investigations, because almost every action in AWS is an API call.
AWS security services
| Service | Role in the SOC |
|---|---|
| Amazon GuardDuty | Threat detection using CloudTrail events, VPC Flow Logs and DNS logs, such as calls from known malicious IPs, crypto mining and credential misuse |
| Amazon Inspector | Automated vulnerability scanning of EC2 instances, container images and Lambda functions |
| Amazon Macie | Discovers and protects sensitive data, such as personal data, in S3 |
| Amazon Detective | Investigation using linked graphs of activity, to find the scope and root cause of a finding |
| IAM Access Analyzer | Finds resources shared outside the account and unused access |
| AWS Config | Records configuration changes and checks them against rules |
| AWS WAF and AWS Shield | Web application filtering and DDoS protection |
| Amazon Security Lake | Centralizes security data in the Open Cybersecurity Schema Framework (OCSF) format |
AWS Security Hub and Security Hub CSPM
AWS Security Hub CSPM (the original Security Hub, now renamed) runs automated checks against security standards such as AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, PCI DSS and NIST. It collects findings from GuardDuty, Inspector, Macie and partner products in the AWS Security Finding Format (ASFF) and supports automation rules and EventBridge actions.
The current AWS Security Hub builds on this. It correlates and enriches signals from posture checks, Inspector, Macie, GuardDuty and IAM Access Analyzer to find exposures and prioritize active risks, and it formats findings in OCSF.
| Concept | Meaning |
|---|---|
| Finding | One security issue from a check or an integrated service |
| Security standard and control | A best practice set and its individual checks |
| Security score | How well the account meets the enabled standards |
| Cross Region aggregation | Collects findings from several Regions into one |
| Administrator account | Manages Security Hub for member accounts in an organization |
Automating response in AWS
Findings can be sent to Amazon EventBridge, which triggers actions such as an AWS Lambda function that isolates an EC2 instance by changing its security group, revokes an IAM key, or opens a ticket. Findings can also go to a SIEM or SOAR platform.
A worked example
GuardDuty reports that an EC2 instance is communicating with an address associated with crypto mining. The finding appears in Security Hub, and an EventBridge rule runs a Lambda function that moves the instance into a quarantine security group with no outbound access.
The analyst uses Detective and CloudTrail to find that an exposed access key launched the instance. The key is deactivated, the instance is preserved for analysis (an EBS snapshot), and Config history shows the security group change that exposed it.
How the exam asks about this
- "Which AWS service records API calls made in an account?" → AWS CloudTrail.
- "Which AWS service gives a central view of findings from GuardDuty, Inspector and Macie?" → AWS Security Hub.
- "Which AWS service detects threats by analyzing CloudTrail, VPC Flow Logs and DNS logs?" → Amazon GuardDuty.
What to remember for the exam
- CloudTrail records API activity; VPC Flow Logs record network traffic; Config records configuration history.
- GuardDuty detects threats; Inspector finds vulnerabilities; Macie finds sensitive data in S3; Detective investigates.
- Security Hub centralizes and prioritizes findings; Security Hub CSPM runs standards based posture checks.
- EventBridge and Lambda automate response to findings.
- AWS secures the infrastructure; the customer secures IAM, data, network settings and workloads.
Do not mix up GuardDuty and Inspector. GuardDuty detects active threats from logs; Inspector scans for software vulnerabilities and exposures.
Common mistakes
Calling Security Hub the main detector. It mainly aggregates, correlates and prioritizes findings; GuardDuty, Inspector and Macie do most of the detecting.
Terminating a compromised instance at once. That destroys evidence; isolate it with a security group and snapshot its volumes first.
Forgetting Regions. Many AWS security services are Regional, so an unmonitored Region can hide attacker activity.
Check yourself
Which service would you use to see who deleted an S3 bucket?
AWS CloudTrail, which records the API call, the identity, the time and the source IP.
How can a GuardDuty finding trigger automatic containment?
Through an EventBridge rule that runs an action such as a Lambda function to quarantine the instance.
What does Amazon Macie do?
It discovers and helps protect sensitive data stored in Amazon S3.
Topic 2 of 3 in SOC for Cloud Environments
Test yourself on SOC for Cloud Environments
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.