Detection & Compliance Services

## Why there are several services, not one Security questions on AWS fall into distinct shapes, and AWS ships a separate managed service per shape. Knowing which one answers which question is the single most-asked thing about this layer, because it is the first step of almost every AWS security design discussion. The four detection questions are: 1. *Is someone doing something malicious right now?* — behavioural, log-driven, real time. 2. *Does my infrastructure still match the baseline I agreed to?* — configuration state, evaluated against rules. 3. *Does the software I am running have known vulnerabilities?* — package inventory matched against a CVE feed. 4. *Is regulated or personal data sitting somewhere it should not be?* — data content classification. ## GuardDuty — threat detection from telemetry GuardDuty consumes AWS-side logs and applies threat intelligence, anomaly detection and machine learning to them. It produces *findings* with a structured type string and a severity, for example `UnauthorizedAccess:EC2/SSHBruteForce` or `CryptoCurrency:EC2/BitcoinTool.B!DNS`. It is behavioural: it tells you an instance's credentials were used from an unusual location, not that the instance is misconfigured. You turn it on per account and per Region; there is nothing to deploy for the foundational sources. ## AWS Config — configuration state and drift Config records a *configuration item* every time a supported resource changes, storing a timeline of resource state. Rules — AWS-managed ones such as `S3_BUCKET_PUBLIC_READ_PROHIBITED` or `IAM_USER_MFA_ENABLED`, or custom ones — evaluate resources as COMPLIANT or NON_COMPLIANT. Config answers historical questions ("was this security group ever open to the world, and who changed it?") that a live API call cannot. It is the compliance and drift engine, not a threat engine. ## Amazon Inspector — vulnerability scanning Inspector builds a software inventory of EC2 instances, container images in ECR and Lambda functions, matches it against vulnerability databases, and continuously re-evaluates when new CVEs are published — so a finding can appear on an instance you have not touched in months. Findings carry the CVE, a score and whether a fix exists. ## Macie — sensitive data discovery Macie inventories S3 buckets (including their public-access and encryption posture) and samples object content, classifying it with managed data identifiers for things like credit-card numbers, names and credentials. You can also run targeted classification jobs over specific buckets. Because it reads object bytes, it is priced per gigabyte inspected, which is why sampling exists. ## Security Hub — aggregation, not detection Security Hub is the fan-in point. Other services (and third-party tools) send findings in the **AWS Security Finding Format (ASFF)**, a normalised JSON schema, so a GuardDuty finding, an Inspector CVE and a failed control all carry comparable severity, resource and account fields. On top of ingestion it runs *security standards* — packaged control sets such as the AWS Foundational Security Best Practices standard and the CIS AWS Foundations Benchmark — and reports a score per standard. In an Organization you nominate a delegated administrator account and aggregate findings from every member account into one Region. The common misconception to avoid: Security Hub is not a detector with its own sensors. Its own controls are largely evaluated through AWS Config rules, so a Security Hub with Config switched off will show controls that never evaluate. ## How they compose ```text GuardDuty (threats) \ Inspector (CVEs) >--> Security Hub (ASFF) --> EventBridge --> ticket / chat / Lambda Macie (data) / Config (drift) / ``` Every one of these is **regional**: enabling a service in one Region tells you nothing about activity in another, which is exactly why attackers favour Regions nobody watches. Enable them in every Region you allow, and use Organizations auto-enable so new accounts are covered on creation rather than by someone remembering. ## What an interviewer is checking That you can map a scenario to a service in one sentence, that you know Security Hub aggregates rather than detects, and that you do not reach for Config to catch an attacker or for GuardDuty to prove a bucket was never public.