Lesson 06 — AWS Security Services Overview

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 01 – AWS Security Foundations

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand the major AWS Security Services.
Explain the purpose of each service.
Know when each service should be used.
Understand how AWS security services work together.
Build a security-first mindset before diving into individual services.

📚 Lesson Information

Estimated Time: 2.5 Hours

Difficulty: Beginner

Prerequisites: Lessons 01–05

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Enterprise cloud security is never achieved by a single security tool.

Instead, organisations combine multiple AWS services to create layers of defence.

Cloud Security Engineers are responsible for selecting, configuring and monitoring these services to protect workloads, data and users.

This lesson provides an overview of the security services that will be explored in detail throughout the remainder of the course.

🏢 In the Company

CloudNova Technologies has completed the initial AWS account setup.

The CISO asks you to evaluate which AWS security services should be enabled before developers begin deploying applications.

You must understand the purpose of each service before making recommendations.

🏗 Enterprise Security Architecture

                    CloudNova AWS Environment

                    Users
                      │
                      ▼
          IAM / IAM Identity Center
                      │
                      ▼
              AWS Organizations
                      │
                      ▼
                 Amazon VPC
          ┌───────────┴───────────┐
          ▼                       ▼
      EC2 / EKS               RDS / S3
          │                       │
          └───────────┬───────────┘
                      ▼
          KMS • Secrets Manager
                      │
                      ▼
      CloudTrail • CloudWatch • Config
                      │
                      ▼
 GuardDuty • Inspector • Security Hub
                      │
                      ▼
      WAF • Shield • Network Firewall

🔑 Identity & Access Services

Identity is the first security layer.

IAM

Purpose

Users
Groups
Roles
Policies
Permissions

Use Case

Controlling who can access AWS resources.

IAM Identity Center

Previously AWS Single Sign-On (SSO)

Provides

Central Identity
Single Sign-On
Workforce Access
Multi-account Authentication

Used by enterprise organisations.

AWS Organizations

Allows companies to manage:

Multiple AWS Accounts
Governance
Billing
Security Controls
Organizational Units

Ideal for enterprise environments.

🌐 Network Security Services

Amazon VPC

Provides isolated private networks inside AWS.

Used to create:

Public Subnets
Private Subnets
Route Tables
Internet Gateways

Security Groups

Acts as a virtual firewall.

Controls

Inbound Traffic
Outbound Traffic

Applied to:

EC2
RDS
Lambda
EKS

Network ACLs

Subnet-level firewall.

Provides another layer of protection.

AWS Network Firewall

Enterprise managed firewall.

Features

Deep Packet Inspection
Threat Detection
Rule Management

AWS WAF

Protects web applications against:

SQL Injection
Cross Site Scripting
Bots
Web Attacks

AWS Shield

Provides DDoS protection.

Two Editions

Standard
Advanced

🔒 Data Protection Services

AWS KMS

Key Management Service

Manages

Encryption Keys
Key Rotation
Customer Managed Keys

Used by almost every AWS service.

Secrets Manager

Stores

Passwords
Database Credentials
API Keys
Tokens

Automatically rotates secrets.

Systems Manager Parameter Store

Stores

Configuration Values
Secure Strings

Often used by applications.

AWS Backup

Central backup service.

Supports

EC2
RDS
DynamoDB
EFS
EBS

📊 Monitoring & Detection

CloudTrail

Records every AWS API call.

Useful for

Auditing
Compliance
Incident Response

CloudWatch

Monitors

Metrics
Logs
Alarms
Dashboards

AWS Config

Tracks configuration changes.

Answers questions like:

Who changed this?
When was it changed?
Is this resource compliant?

GuardDuty

Threat Detection Service.

Detects

Suspicious Logins
Cryptocurrency Mining
Malware Activity
Credential Theft

Amazon Inspector

Automatically scans

EC2
Lambda
Container Images

Identifies vulnerabilities.

Security Hub

Enterprise security dashboard.

Aggregates findings from:

GuardDuty
Inspector
Config
Partner Products

Amazon Detective

Used during incident response.

Helps investigators understand:

What happened?
When?
Which resources were affected?

🏛 Governance & Compliance

AWS Audit Manager

Automates audit evidence collection.

Supports:

ISO 27001
PCI DSS
SOC 2
HIPAA

Trusted Advisor

Provides recommendations on:

Security
Performance
Cost Optimisation
Fault Tolerance

🔄 How Security Services Work Together

Example

A developer accidentally exposes an EC2 instance.

Flow

Developer Changes Security Group

↓

AWS Config Detects Configuration Change

↓

GuardDuty Detects Suspicious Activity

↓

Inspector Finds Vulnerability

↓

Security Hub Aggregates Findings

↓

CloudTrail Records Every API Call

↓

CloudWatch Alarm Notifies Security Team

↓

Cloud Security Engineer Investigates

🏢 Enterprise Scenario

CloudNova Technologies has recently launched a customer portal.

The CISO requests the following:

Detect suspicious logins
Monitor configuration changes
Protect customer data
Encrypt sensitive information
Monitor API activity
Protect against DDoS attacks
Produce compliance reports

As the Cloud Security Engineer, identify which AWS services you would recommend for each requirement.

🧪 Enterprise Mission 01 — Explore AWS Security Services

Navigate to:

AWS Console

↓

Security, Identity & Compliance

Review the available services.

Document:

Service Name
Purpose
Business Use Case

🧪 Enterprise Mission 02 — View CloudTrail

Navigate

CloudTrail

↓

Event History

Review

Login Events
API Calls
Resource Changes

CLI

aws cloudtrail lookup-events --max-results 10

🧪 Enterprise Mission 03 — Explore IAM

CLI

aws iam list-users

List Roles

aws iam list-roles

List Policies

aws iam list-policies --scope AWS

Questions

How many AWS managed policies exist?
Why should custom policies eventually replace broad administrator permissions?

🧪 Enterprise Mission 04 — Explore Security Groups

CLI

aws ec2 describe-security-groups

Review

Open Ports
CIDR Ranges
Inbound Rules
Outbound Rules

🧪 Enterprise Mission 05 — Review AWS Config

Open

AWS Config

If Config is enabled:

Review:

Resources
Timeline
Compliance

If not enabled:

Document why it is useful in enterprise environments.

🧪 Enterprise Mission 06 — Review GuardDuty

Navigate

GuardDuty

If enabled:

Review

Findings
Severity
Resource Type

If disabled:

Record why organisations should enable it.

🧪 Enterprise Mission 07 — Review Security Hub

Open

Security Hub

Observe

Security Score
Findings
Compliance Standards
Recommendations

🧪 Enterprise Mission 08 — Review KMS

CLI

aws kms list-keys

Describe a key

aws kms describe-key --key-id YOUR_KEY_ID

Replace

YOUR_KEY_ID

with a valid key from your account.

🧪 Enterprise Mission 09 — Review AWS Backup

Navigate

AWS Backup

↓

Backup Vaults

Questions

Are backups configured?
Which resources are protected?
What backup strategy would you recommend?

🧪 Enterprise Mission 10 — Enterprise Security Mapping

Complete the table.

Requirement	AWS Service
Identity Management	IAM
Multi-Account Governance	Organizations
API Logging	CloudTrail
Encryption Keys	KMS
Secret Storage	Secrets Manager
Threat Detection	GuardDuty
Vulnerability Assessment	Inspector
Security Dashboard	Security Hub
Configuration Monitoring	AWS Config
DDoS Protection	AWS Shield
Web Application Protection	AWS WAF
Backup Management	AWS Backup

📊 Knowledge Check

What is the purpose of IAM?
What does AWS Organizations provide?
Which service records API calls?
Which service manages encryption keys?
Which service stores secrets securely?
Which service detects suspicious activity?
Which service scans EC2 instances for vulnerabilities?
What is AWS Security Hub?
Which service protects against DDoS attacks?
Which service tracks configuration changes?

📝 Assignment

Create an AWS Security Services Overview Report for CloudNova Technologies.

Include:

Overview of each AWS security service.
Primary purpose and business value.
Example enterprise use case.
How services integrate with each other.
Which services should be enabled before production deployment.
Architecture diagram showing the relationship between identity, network, monitoring, data protection and governance services.

Length: 4–5 pages.

💡 Key Takeaways

After completing this lesson, you should understand:

AWS provides a comprehensive set of security services for identity, network protection, monitoring, data protection and governance.
No single service secures an AWS environment on its own; effective security comes from combining multiple services in a layered architecture.
Identity, monitoring, encryption and threat detection should be considered foundational capabilities in every enterprise AWS deployment.
Cloud Security Engineers must understand not only each service individually, but also how they work together to protect cloud workloads.

📚 Further Reading

AWS Security Services Overview
AWS Well-Architected Framework – Security Pillar
AWS IAM User Guide
AWS Security Hub User Guide
Amazon GuardDuty User Guide
AWS KMS Documentation
AWS Config Developer Guide

🚀 Next Lesson

➡️ Lesson 07 — Enterprise Security Scenario & AWS Security Assessment