AWS Security Components and Resources
Domain 2: Security and Compliance — Task 2.4: Identify components and resources for security
This chapter focuses on the tools, services, and information sources AWS provides to help customers secure their environments and maintain compliance. The Cloud Practitioner exam often tests whether you can match a specific security requirement—such as threat detection, web protection, vulnerability scanning, or compliance reporting—to the correct AWS service.
Understanding AWS Security Capabilities
AWS offers a broad portfolio of security services designed to protect workloads, monitor activity, and enforce compliance. These services span multiple categories, including threat detection, network and application protection, vulnerability management, and governance.
For the exam, you should be able to recognize which AWS service is best suited for a particular security need and where to locate official guidance and documentation.
Core AWS Security Services
AWS provides several managed services that form the foundation of cloud security. AWS WAF protects web applications from common attacks such as SQL injection and cross-site scripting. AWS Shield defends against distributed denial-of-service (DDoS) attacks, with Standard protection enabled by default and Advanced offering enhanced monitoring and response. AWS Firewall Manager allows centralized management of firewall rules across multiple accounts.
Amazon GuardDuty uses machine learning to detect suspicious behavior across IAM, EC2, S3, DNS, and Kubernetes logs. Amazon Inspector continuously scans workloads for vulnerabilities. Amazon Macie identifies and classifies sensitive data stored in S3. AWS Security Hub aggregates security findings from these services into a single compliance and visibility dashboard.
Exam Tip: GuardDuty detects threats, Inspector finds vulnerabilities, Macie discovers sensitive data, WAF protects web applications, and Shield mitigates DDoS attacks.
Using Third-Party Security Solutions
When native AWS services are not sufficient, customers can extend their security posture through third-party tools available in the AWS Marketplace. These include intrusion detection and prevention systems, SIEM platforms, advanced firewalls, and endpoint protection solutions.
Exam Tip: If a scenario requires specialized or non-AWS security tools, the correct answer often involves the AWS Marketplace.
AWS Security Documentation and Guidance
AWS provides multiple official resources for security best practices and compliance guidance. The AWS Knowledge Center contains troubleshooting articles and FAQs. The AWS Security Center serves as a central hub for security-related information. The AWS Security Blog publishes updates, new features, and deep-dive articles. AWS also offers whitepapers and documentation covering encryption, compliance frameworks, and architectural best practices.
Exam Tip: For the latest security updates and best practices, the correct answer is the AWS Security Blog.
Identifying Security Issues in AWS
AWS includes tools to help customers discover misconfigurations and security risks. AWS Trusted Advisor checks accounts for common issues such as missing MFA on the root user, exposed access keys, or public S3 buckets. AWS Config tracks resource configurations and flags non-compliant changes. Amazon Detective investigates security findings to determine root causes. IAM Access Analyzer identifies unintended public or cross-account access.
Exam Tip: Trusted Advisor is frequently tested for identifying account-level security problems, especially root MFA and public access.
Example: Using Trusted Advisor
Trusted Advisor performs security checks such as detecting a root account without MFA, identifying unrotated access keys, finding publicly accessible S3 buckets, and flagging security groups that allow unrestricted inbound traffic.
On the exam, if a question asks how to detect unused access keys or open network ports, Trusted Advisor is the correct tool.
Key Exam Reminders
AWS WAF protects web applications, while AWS Shield protects against DDoS attacks. Firewall Manager centralizes security rules across multiple accounts. Security Hub aggregates findings from GuardDuty, Inspector, and Macie. Trusted Advisor identifies security best-practice gaps. AWS Artifact provides compliance reports, the Security Blog publishes updates, and the Security Center serves as the main information hub. When AWS services are not enough, the AWS Marketplace provides third-party security tools.
Final Thoughts
AWS security is built on multiple layers: native services for protection and monitoring, third-party tools for advanced requirements, and comprehensive documentation for governance and compliance. For the exam, focus on mapping each service to its purpose—GuardDuty for threats, Inspector for vulnerabilities, Macie for sensitive data, Trusted Advisor for account-level checks, and Security Hub for centralized visibility. Knowing where to find official AWS security guidance and when to use Marketplace solutions will help you confidently answer any security-related scenario.
