Security Services in AWS

Explore the cost of data breach and IBM’s 277-day breach-response timeline. See how AWS security services integrate to identify, contain, and secure infrastructure.

Explore the AWS security lifecycle from identify to recover with foundational and layered services like KMS, GuardDuty, Macie, Security Hub, CloudTrail, and Detective.

Discover a multi-account strategy with AWS Organizations to improve governance, compliance (PCI, GDPR, HIPAA), reduce blast radius, and manage cost and operations across accounts.

Explore AWS organizations to structure multiple accounts with a management account, root, and organizational units. Enforce policy with service control policies, invite member accounts, and manage billing.

Explore service control policies (SCP) in AWS, learn how SCPs set maximum permissions and act as an allow list or deny list, interacting with IAM policies to determine effective access.

Learn how AWS Control Tower provides a base foundation of best practices for a secure, compliant multi-account environment, with automated landing zone, guardrails, account factory, and an organization-wide dashboard.

Explore how AWS Control Tower automatically creates a secure landing zone with guardrails for a well-architected, multi-account environment, organized OUs, and SSO.

Discover AWS protection services, focusing on data and network encryption, DDoS mitigation with Shield and Firewall Manager, and authentication and authorization via IAM, Identity Center, Cognito, and Directory Services.

Discover encryption basics, including keys, algorithm, cipher text, and decryption, using bank card analogies, and learn how AWS encryption is implemented.

Discover how encryption in transit and at rest secure AWS architectures, using certificate manager for SSL/TLS and KMS for key management across typical three tier apps.

Discover how AWS Certificate Manager provisions, manages, and renews public and private TLS certificates, including private certificate authority, with integration to CloudFront, API Gateway, and load balancer for encryption.

Learn how key management service creates and manages keys for encryption and decryption, using symmetric and asymmetric keys, hardware security module backing, and policies for key administrators and key users.

Demonstrate envelope encryption with KMS by using a two tier key hierarchy: generate data keys encrypted by a master key, encrypt data, and securely decrypt with access checks.

Compare cms and cloud hsm, deploy a cloud hsm cluster, and manage keys with customer control in a vpc and backups.

Learn how distributed denial of service attacks flood a site with fraudulent traffic, how botnets enable them, and how to mitigate volume-based, protocol-level, and low-and-slow attacks.

Discover how AWS WAF protects your application at the application layer with web ACLs that allow or block traffic, and how to use managed rule groups and IP sets.

Protects AWS-hosted apps from DDoS attacks at network and transport layers. Shield Advanced provides larger-attack protection, 24/7 Shield Response Team support, and price protection.

Explore how AWS Firewall Manager centralizes policy across AWS Organizations to configure Web ACLs, security groups, and Route 53 Resolver DNS Firewall across accounts.

Learn authentication and authorization and how directory services manage user credentials and access in AWS, including Microsoft Active Directory, AD Connector, Simple AD, and Amazon Cognito user pools.

Explore AWS directory services, including managed Microsoft AD, simple AD, AD Connector, and cloud directory, and learn how to choose and configure the right option for your use cases.

Discover Amazon cloud directory, a serverless, high‑performance, graph‑based hierarchical data store for person records, devices, and organizations. Define schemas, store data without a relational database, and access via API.

Explore Amazon Cognito and its user pools, a managed directory that handles authentication and authorization for web and mobile apps, including sign up, verification, and federated logins.

Enable single sign-on across accounts and applications with AWS Identity Center, using a portal, diverse identity sources, and permission sets for fine-grained access.

Discover how Resource Access Manager securely shares resources across accounts or within an organization, using managed permissions and IAM roles to grant access to resources like glue databases and tables.

Secrets Manager securely stores and retrieves database credentials and API keys at runtime, encrypts them with IAM controls, and enables rotation with Lambda for RDS.

Identify and respond to security events using artificial intelligence and machine learning through AWS detection services, including Amazon GuardDuty, Amazon Inspector, Amazon Macie, and AWS Security Hub, with anomaly alerts.

Enable amazon guardduty to continuously monitor your accounts and workloads, collect vpc flow logs, cloudtrail events, and dns logs, and transform them into actionable findings with risk scores for remediation.

Amazon Inspector provides continuous vulnerability management by scanning EC2 instances, containers, and Lambda functions, and integrates with Security Hub and Eventbridge for automated remediation and reporting.

Discover how AWS security hub centralizes findings from GuardDuty, Inspector, Macie, Firewall Manager and third parties, applies benchmarks like PCI DSS and CIS, and enables automated remediation across accounts.

Amazon Macie uses machine learning and pattern matching to discover sensitive data in S3, generating findings and enabling automated protection against risks like publicly accessible buckets and PII.

Automate responses to security events using CloudWatch, Step Functions, Lambda, and Systems Manager automation. Investigate with CloudWatch, CloudTrail, Personal Health Dashboard, and Route 53 to support automated workflows.

Explore AWS Systems Manager as an operations hub for EC2, applications, and hybrid multi-cloud environments, delivering inventory, patching, automation, and host management at scale.

Learn how AWS Systems Manager Session Manager provides secure, port-free access to EC2 instances via browser or CLI, with encryption, logging, and fleet-wide session management.

Discover AWS Systems Manager documents that define actions on managed instances, using Json or yaml. Create custom documents to run commands and automate tasks across Windows and Linux.

State manager automates keeping managed nodes in a defined state, auto updating the SSM agent and patches on a schedule or in response to events, using associations and automation documents.

Explore Patch Manager in AWS Systems Manager to scan, report, and automatically install missing patches for Windows and Linux, using baselines, auto-approval rules, and targets by tags.

Execute administrative tasks on managed nodes with run command to install CloudWatch agent, configure settings, and target instances via the management console, command line interface, or software development kit.

Discover how AWS Systems Manager Change Manager enforces enterprise change management with pre-approved templates, approvals, runbooks, and audits for changes to EC2 and infrastructure.

Explore how AWS incident manager guides the incident lifecycle, from detection and runbook-driven response to escalation and automation, enriching security and service recovery.

Learn how to configure AWS Incident Manager with a complete response plan, including replication, contacts, escalation, runbooks, and EventBridge-driven detection to automate root login incidents.

Explore how Amazon Detective uses a behavior graph to analyze alerts, investigate incidents, and hunt threats by correlating data from VPC, CloudTrail, and GuardDuty; it surfaces findings for rapid containment.

Automate security incident response with EventBridge, Step Functions, and Lambda, using CloudWatch and CloudTrail for investigation and orchestration, with policy validation, approvals, and Route 53 health checks.

Learn how Route 53 health checks monitor your application from global edge locations, assessing latency and availability with HTTP, HTTPS, or TCP checks on a domain or IP.

Discover the AWS Health Dashboard, a consolidated view of service health and your application issues, with organization health, EventBridge automation, and RSS notifications.

Learn recovery for infrastructure and application in AWS, using cloud formation templates, OpsWorks for automation, data restore, glacier archive, and upcoming focus on well-architected tool, service catalog, and AWS Config.

Explore how automation boosts efficiency, productivity, consistency, quality, repeatability, and recoverability in cloud infrastructure and applications, by automating deployment, configuration, updates, and removal.

Explore infrastructure automation in AWS using cloud formation to convert templates into stacks, with templates authored in yaml or json, and manage drift, changes, and multi-stack deployments.

Learn infrastructure automation with AWS CloudFormation, templates, and stacks. Use the designer, sample templates, and change set workflows to provision resources and detect drift.

Learn to craft reusable CloudFormation templates to deploy secure AWS infrastructure, configuring EC2 instances, VPCs, subnets, AMIs, roles, security groups, and inputs, mappings, outputs, and deletion policies.

Explore how AWS OpsWorks delivers configuration management with Puppet and Chef. Learn how it transforms current state to desired state using CMDB, push and pull deployment, and stacks with layers.

Explore the shared responsibility model for security in the cloud, detailing what AWS secures and what customers must manage, including encryption, patches, access control, and data protection.

Explore the basics of AWS IAM, detailing authentication and authorization, identity components (users, groups, roles) and policies, plus how API calls flow through endpoints and are logged by CloudTrail.

Learn how to create AWS IAM users and groups, attach JSON policies for EC2 and S3 access, and enforce least privilege with MFA and region-based conditions.

Compare AWS policies: IAM policies (managed and customer managed), inline policies, and resource policies. Attachments vary by identity or resource, with versioning and scoped reuse.

Policy evaluation starts with a default deny and combines all applicable policies—user, group, and resource—into one document. An explicit deny or allow decides access; otherwise, implicit deny applies.

Explore how AWS roles use trust policies and Security Token Service issued temporary credentials to enable secure cross-account access through role assumption.

Discover how identity providers enable federated access to AWS by offloading authentication to external providers. Establish trust with IAM and issue temporary credentials for role-based access.

Master aws identity and access management by creating users, groups, roles, and json policies, attaching policies to entities, and enabling resources like ec2, s3, and dynamodb to assume roles.

Explore how the AWS Well-Architected Tool uses a question-and-answer review to assess your workload against the Well-Architected framework, identify high-risk items, track progress, and suggest remediation actions.

Learn how AWS service catalog creates portfolios and products, applies constraints and tags, and deploys infrastructure as code templates to multiple accounts with CloudFormation.

Explore AWS config's inventory and configuration management, governance and continuous compliance, and automated remediation using rules and conformance packs to maintain compliant resources.

Apply an AWS config rule to ensure EC2 instances are managed by AWS Systems Manager, and perform remediation via SSM automation documents when non-compliant.

Explore AWS config to track resource configuration history and timelines, with JSON configuration items, rules, and remediation. Learn about conformance packs, aggregators, and resource relationships to automate compliance across accounts.

Discover how aws network firewall secures vpc traffic by routing through a firewall endpoint and applying stateless and stateful rule groups, with logs for monitoring.

Deploy a network firewall in AWS using a cloud formation template, configure a firewall policy and rule groups, test traffic flow with endpoints, and explore Suricata integration and Firewall Manager.

Access AWS learning resources from analogies cloud.com, YouTube, and Udemy, plus service summary cards for certification. Use drag-and-drop exercises and reference architectures to reinforce serverless and cloud concepts.