AWS Security Services

AWS Key Management Service (KMS) is a managed service that creates, stores, and controls the cryptographic keys used to encrypt and decrypt data across AWS. It integrates natively with services such as S3, EBS, RDS, and Lambda, letting teams enforce encryption at rest without running key infrastructure themselves. Internally it uses FIPS-validated hardware security modules (HSMs) behind a managed API. The key exam distinction is between KMS and CloudHSM: KMS is multi-tenant and AWS-managed, the default for most workloads, while CloudHSM gives a dedicated, single-tenant HSM for regulatory needs demanding customer-exclusive hardware. Customer managed keys control rotation and access policies.

AWS Shield is a managed DDoS protection service with two tiers. Shield Standard is enabled automatically at no extra cost for all customers and defends against common network and transport layer attacks (layers 3 and 4), such as SYN floods and UDP reflection. Shield Advanced is a paid upgrade adding protection against larger, more sophisticated layer 7 (application layer) attacks, near-real-time attack visibility, and access to the AWS DDoS Response Team. The key exam distinction is that Shield guards against volumetric DDoS attacks aimed at overwhelming infrastructure, while AWS WAF filters malicious HTTP/S requests at the application layer. They are often deployed together but are not interchangeable.

AWS WAF (Web Application Firewall) operates at the application layer (Layer 7) to inspect HTTP and HTTPS traffic, letting you define rules that block common web exploits such as SQL injection, cross-site scripting (XSS), and bad bots before requests reach your application. It integrates with Amazon CloudFront, Application Load Balancer, API Gateway, and AWS AppSync. The key exam distinction is WAF versus AWS Shield: WAF filters malicious application-layer request content using rule-based logic, while Shield defends against DDoS attacks. They address different threat types, and the two are commonly used together for layered protection.

Amazon GuardDuty is a managed threat-detection service that continuously analyzes AWS CloudTrail event logs, VPC Flow Logs, and DNS query logs to identify suspicious behavior such as unusual API calls, crypto-mining activity, or communication with known malicious IP addresses. It uses machine learning and threat intelligence feeds to surface findings without requiring the customer to deploy or manage any additional software. The key exam distinction is scope: GuardDuty detects active threats and anomalous behavior, while Amazon Inspector assesses EC2 instances and container images for software vulnerabilities. GuardDuty does not fix anything—it generates findings that can trigger EventBridge rules for automated remediation.

Amazon Inspector is an automated vulnerability management service that continuously scans EC2 instances, container images in Amazon ECR, and Lambda functions for known software vulnerabilities (CVEs) and unintended network exposure. It generates risk-scored, prioritized findings in a centralized view so security teams can remediate the most critical issues first. The key exam distinction is scope: Inspector assesses your resources for weaknesses that could be exploited, while GuardDuty analyzes logs and traffic to detect active threats at runtime. Inspector finds what is vulnerable; it does not detect intrusions.

Amazon Macie is a fully managed data security service that uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3. It scans buckets for personally identifiable information (PII), financial records, and credentials, then generates findings with severity ratings so teams can prioritize remediation. The key exam distinction is scope: Macie focuses on data classification within S3, while GuardDuty detects account-level threats like unusual API calls or compromised credentials across the broader environment. A common trap is assuming Macie covers all AWS storage — it works on S3, not EBS or RDS.

AWS Secrets Manager is a managed service that securely stores and retrieves sensitive values such as database passwords, API keys, and OAuth tokens, keeping them out of application source code and configuration files. It encrypts secrets at rest using AWS KMS and controls access through IAM policies. The most exam-relevant distinction is between Secrets Manager and AWS Systems Manager Parameter Store: both can store secrets, but only Secrets Manager offers built-in automatic rotation, invoking a Lambda function on a configurable schedule to rotate credentials. Parameter Store can hold encrypted SecureString values for free, while Secrets Manager charges per secret but adds native rotation.

AWS CloudTrail is a governance and auditing service that records API calls and account activity across AWS services. Every action through the Management Console, CLI, SDK, or another service becomes an event capturing who made the request, the source IP, the time, and what changed. By default it logs control-plane management events (like creating an S3 bucket or editing an IAM policy); high-volume data events (such as individual S3 object reads and writes) must be enabled separately at extra cost. CloudTrail answers auditing and accountability questions, while CloudWatch monitors performance metrics and logs.

AWS Config continuously records the configuration state of AWS resources and evaluates those states against rules you define or select from a managed library. When a resource drifts out of compliance — for example, an S3 bucket becomes publicly accessible or a security group opens port 22 — Config flags the violation and can trigger automatic remediation through Systems Manager Automation. The key exam distinction is that Config answers “what does my resource look like, and was it ever different?” while CloudTrail answers “who made a change, and when?” Both support compliance, but Config focuses on resource state and rule evaluation, not API call logging.