7 Security Services, Data Protection, and Compliance · AWS Cloud Practitioner

In this chapter you will learn the AWS security services the exam expects you to recognize and, more importantly, how to tell them apart. We follow a request from the edge of the network to the data itself: AWS Shield, AWS WAF, AWS Firewall Manager, AWS Network Firewall, security groups, and network ACLs. Next come the services that watch and investigate (Amazon GuardDuty, Amazon Inspector, Amazon Macie, Amazon Detective, AWS Security Hub, Amazon Security Lake, AWS Config, and AWS CloudTrail), then the data protection services (AWS KMS, AWS CloudHSM, AWS Secrets Manager, Systems Manager Parameter Store, and AWS Certificate Manager). We finish with compliance: AWS Artifact, AWS Audit Manager, the major compliance programs, data residency and sovereign Regions, penetration testing rules, abuse reporting, and where to find security help. This chapter maps to Domain 2 (Security and Compliance), Task Statement 2.2: “Understand AWS Cloud security, governance, and compliance concepts” and Task Statement 2.4: “Identify components and resources for security.”

7.1 Defense in depth

No single control stops every attack. Security professionals use defense in depth: several independent layers, so that if one fails, the next still protects you. A castle has a moat, an outer wall, guarded gates, an inner keep, and a locked treasury. AWS gives you equivalent layers.

Defense in depth: layers a request passes through

Internet users

1. Edge: AWS Shield, AWS WAF, CloudFront

Absorb DDoS; block SQL injection, XSS, bad IPs

2. VPC and subnet: network ACL

Stateless allow/deny at subnet edge (+ Network Firewall)

3. Security group

Stateful allow rules on each instance

4. Instance and application

Patching (Inspector), hardened OS, IAM role

5. Data

fails.

Figure 7.1: Defense in depth on AWS. A request passes through edge protection, the VPC’s network ACLs, the instance’s security group, the

hardened instance, and finally encrypted data, while identity and monitoring span every layer.

As you read this chapter, place each service on one of these layers. That habit alone answers many exam questions: a question about blocking SQL injection is an edge question (AWS WAF); a question about who can read a database password is a data and identity question (Secrets Manager plus IAM); a question about suspicious API calls is a monitoring question (GuardDuty and CloudTrail).

Remember the shared responsibility model from Chapter 5. AWS operates these services and secures the infrastructure, but you decide whether to turn them on and how to configure them. A security group left open to the internet on port 22 is the customer’s responsibility, not AWS’s.

7.2 Protecting the edge

AWS Shield

A distributed denial of service (DDoS) attack floods an application with traffic from many sources so real users cannot reach it. AWS Shield is the managed DDoS protection service, and it comes in two tiers.

AWS Shield Standard

Automatic and free for every AWS customer. You do not turn it on.

Protects against the most common network and transport layer (Layer 3 and Layer 4) attacks, such as SYN floods and UDP reflection attacks.

Works best for resources behind Amazon CloudFront and Amazon Route 53, which sit on the AWS global edge network.

AWS Shield Advanced

A paid subscription (a monthly fee per organization with a one-year commitment, plus data transfer fees), aimed at business-critical applications.

Enhanced detection and mitigation for EC2 Elastic IP addresses, Elastic Load Balancing, CloudFront, AWS Global Accelerator, and Route 53.

Access to the Shield Response Team (SRT) around the clock during an attack (with Business or Enterprise-level support).

DDoS cost protection: service credits for scaling charges (for example, extra EC2 or CloudFront usage) caused by an attack.

Application layer (Layer 7) protection by working with AWS WAF, which is included at no extra charge for protected resources.

Real-time attack visibility and reports.

Exam tip

“Free, automatic DDoS protection” is Shield Standard. “24/7 access to DDoS experts” or “protection against cost spikes during a DDoS attack” is Shield Advanced.

Aws waf

AWS WAF is a web application firewall. It inspects HTTP and HTTPS requests (Layer 7) and decides whether to allow, block, count, or challenge them with a CAPTCHA. You group rules into a web ACL and attach it to a supported resource:

Amazon CloudFront distributions
Application Load Balancers
Amazon API Gateway REST APIs
AWS AppSync GraphQL APIs

Amazon Cognito user pools, AWS App Runner services, and AWS Verified Access instances Rules can match on:

Common attack patterns such as SQL injection and cross-site scripting (XSS)
IP addresses or ranges (allow lists and block lists)
Geographic location of the request (geo match)
Headers, query strings, URI paths, and body content

Rate-based rules that block an IP that sends too many requests in a short time, useful against simple Layer 7 floods and brute-force logins

You do not need to write every rule yourself. AWS Managed Rules and rule groups from AWS Marketplace sellers cover common threats such as the OWASP Top 10, known bad bots, and known malicious IP addresses.

Common trap

AWS WAF does not attach to a Network Load Balancer or directly to an EC2 instance. It protects web traffic at CloudFront, Application Load Balancers, API Gateway, and the other services listed above. If a question asks how to block SQL injection against an application behind an ALB, the answer is AWS WAF, not a security group (security groups do not inspect request content).

AWS Firewall Manager

In an organization with dozens of accounts, configuring WAF rules account by account is error-prone. AWS Firewall Manager lets a security team define firewall policies once and apply them automatically across all accounts and resources in AWS Organizations, including new accounts and resources as they appear. It centrally manages:

AWS WAF rules
AWS Shield Advanced protections
VPC security groups (common baselines and auditing for overly permissive rules)
AWS Network Firewall
Amazon Route 53 Resolver DNS Firewall

The keyword is central management across accounts. Firewall Manager does not inspect traffic itself; it deploys and enforces the services that do.

AWS Network Firewall

AWS Network Firewall is a managed, highly available firewall that you deploy inside a VPC to filter traffic entering and leaving it, including traffic to and from the internet, other VPCs, and on-premises networks. It supports stateful and stateless rules, domain name filtering (for example, allowing outbound traffic only to approved websites), and intrusion prevention signatures. Use it when you need deeper, VPC-wide network inspection beyond what security groups and network ACLs provide.

Service Layer and scope Typical use
Shield Layers 3/4 (Advanced adds 7), edge DDoS protection
WAF Layer 7, web requests SQL injection, XSS, bad IPs, rate limits
Network Firewall Layers 3 to 7, whole VPC Inspectand filter VPC traffic
Firewall Manager Management, many accounts Apply rules centrally

7.3 Security groups versus network ACLs

Inside a VPC there are two built-in, free traffic filters. They show up on almost every Cloud Practitioner exam. A security group is a virtual firewall attached to an elastic network interface, which in practice means an EC2 instance, an RDS database, a load balancer, a Lambda function in a VPC, and so on.

Stateful: if a request is allowed in, the response is automatically allowed out (and vice versa). Allow rules only: you cannot write a deny rule. Anything not allowed is denied.

All rules are evaluated together.

By default, a new security group allows no inbound traffic and all outbound traffic.

Rules can reference other security groups (for example, “allow port 3306 from the web tier’s security group”). A network access control list (network ACL) is a firewall attached to a subnet.

Stateless: return traffic must be explicitly allowed by a separate rule.

Allow and deny rules, so you can block a specific IP address range.

Rules are numbered and evaluated in order, lowest number first; the first match wins.

The default network ACL allows all inbound and outbound traffic. A custom network ACL denies everything until you add rules.

Network ACL (subnet) versus security group (instance)

Vpc

Figure 7.2: Security groups and network ACLs compared. The network ACL guards the subnet boundary statelessly with ordered allow and deny

rules; the security group guards each instance statefully with allow rules only.

Security group Network ACL
Applies to Instance (network interface) Subnet
State Stateful Stateless
Rules Allow only Allow and deny
Evaluation All rules together In number order, first match

Exam tip

If you need to block one specific malicious IP address at the network level, use a network ACL (security groups cannot deny). If the question stresses that return traffic is automatically allowed, it is describing a security group.

7.4 Detecting, assessing, and investigating

The next group of services does not block traffic. Instead, they watch your environment, look for problems, and help you respond. The exam loves to test whether you can tell them apart, so pay attention to what each one looks at. Detection services: what each one watches

WATCHES (data source) SERVICE ANSWERS
API calls (all accounts)
console, CLI, SDK

AWS CloudTrail Who did what, when?

Resource configuration

and its change history

AWS Config Is it set up correctly?

CloudTrail, VPC Flow Logs,

DNS logs

Amazon GuardDuty Is a threat active now?

EC2, ECR images,

Lambda functions

Amazon Inspector Which software is vulnerable?

Objects and bucket

settings in Amazon S3

Amazon Macie Where is sensitive data (PII)?

Policies on buckets, keys,

roles, queues

IAM Access Analyzer What is shared externally?

Logs plus GuardDuty

findings

Amazon Detective What is the root cause?

Figure 7.3: Which detection service watches what. Each service has a distinct data source and question it answers; Security Hub and Security Lake bring the results together.

Amazon GuardDuty: threat detection

Amazon GuardDuty is an intelligent threat detection service. Once enabled (a single click per account, or for a whole organization), it continuously analyzes:

AWS CloudTrail management events (API activity)
VPC Flow Logs (network traffic metadata)
DNS query logs

using machine learning, anomaly detection, and threat intelligence feeds. It produces findings such as “an EC2 instance is communicating with a known cryptocurrency mining server,” “API calls from a known malicious IP address,” or “unusual console sign-in from a new location.” Optional protection plans extend coverage to S3 data events, EKS and container runtime activity, RDS sign-in activity, Lambda network activity, and malware scanning of EBS volumes and S3 objects.

You do not need to deploy agents or manage log collection for the foundational analysis; GuardDuty reads the data sources directly.

Amazon Inspector: vulnerability management

Amazon Inspector automatically scans your workloads for software vulnerabilities (known CVEs) and unintended network exposure. It covers:

Amazon EC2 instances (using the Systems Manager agent or agentless scanning)
Container images in Amazon ECR
AWS Lambda functions and their code packages

Inspector rescans automatically when a new vulnerability is published or the software changes, and it ranks findings with a risk score.

Amazon Macie: sensitive data discovery

Amazon Macie uses machine learning and pattern matching to discover sensitive data, such as personally identifiable information (PII), credit card numbers, and credentials, in Amazon S3. It also evaluates bucket security, flagging buckets that are public, unencrypted, or shared outside the account. Think “Macie = S3 + sensitive data.” Amazon Detective: investigation

When GuardDuty raises a finding, a security analyst needs to understand what happened: which role made the calls, what other IP addresses it talked to, and whether this is normal for that resource. Amazon Detective automatically collects log data (CloudTrail, VPC Flow Logs, GuardDuty findings, EKS audit logs) and builds a behavior graph with visualizations, so you can investigate the root cause of security issues quickly. GuardDuty finds; Detective investigates.

AWS Security Hub: the single pane of glass

AWS Security Hub gives you a consolidated view of your security posture across accounts and Regions. It aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, AWS Config, and many partner products into one standardized format.

It runs automated security checks against standards such as the AWS Foundational Security Best Practices, the CIS AWS Foundations Benchmark, PCI DSS, and NIST frameworks, and gives you a security score.

It can trigger automated responses through Amazon EventBridge.

AWS expanded Security Hub in 2025 to correlate signals into prioritized risks, and the original posture checking capability is now labeled Security Hub CSPM (cloud security posture management). For the exam, remember the core idea: Security Hub is where findings come together and where best-practice checks are scored.

Amazon Security Lake: centralized security data

Amazon Security Lake automatically collects security logs and events from AWS sources, on-premises systems, and third-party tools, normalizes them into the open Open Cybersecurity Schema Framework (OCSF) format, and stores them in a data lake in your own S3 buckets. Analysts and security tools (your SIEM, Amazon Athena, and so on) can then query one consistent data set. Security Hub focuses on findings and posture; Security Lake focuses on long-term storage and analysis of raw security data.

AWS Config: configuration history and compliance

AWS Config records the configuration of your AWS resources and how it changes over time. It answers questions like: “What did this security group look like last Tuesday, and who changed it?”

“Which EBS volumes are not encrypted?”

“Are all S3 buckets blocking public access?”

Config rules (AWS managed or custom) continuously evaluate resources against desired settings and mark them compliant or noncompliant. Conformance packs bundle many rules into a framework-aligned package, and remediation actions can fix noncompliant resources automatically through Systems Manager Automation.

AWS CloudTrail: who did what

AWS CloudTrail records API calls and account activity: who made a request, from which IP address, at what time, to which service, and with what result. Every console click and CLI command becomes a CloudTrail event. Event history shows the last 90 days of management events in each Region at no cost, with no setup. A trail delivers events continuously to an S3 bucket (and optionally CloudWatch Logs) for long-term retention, and can cover all Regions and all accounts in an organization.

Data events (such as S3 object reads or Lambda invocations) can be logged at additional cost.

CloudTrail Lake stores events in a managed data store you can query with SQL.

Log file integrity validation proves that log files were not modified after delivery.

Common trap

CloudTrail versus Config versus CloudWatch is a classic confusion. CloudTrail = who did what (API activity, auditing). Config = what does the resource look like and is it compliant (configuration state over time). CloudWatch = how is it performing (metrics, logs, alarms). A question about “which user deleted the bucket” is CloudTrail.

Quick comparison

Service Looks at Answers

GuardDuty CloudTrail, VPC Flow Logs, DNS Is something malicious happening?

Inspector EC2, ECR images, Lambda Which software is vulnerable?

Macie S3 objectsand buckets Where is sensitive data?

Detective Logsand findings What is the root cause?

Security Hub Findings from many services What is my overall posture?

Security Lake Logs from many sources Where isall my security data?

Config Resource settings Is it configured correctly?

CloudTrail API calls Who did what, and when?

7.5 Protecting data: encryption

Data needs protection in two states:

Encryption in transit protects data moving across a network, using TLS (HTTPS). AWS service endpoints support TLS, and you can enforce it, for example with an S3 bucket policy that denies requests not using secure transport. VPN connections and MACsec on Direct Connect protect network links.

Encryption at rest protects stored data on disks, in databases, and in object storage. Most AWS storage and database services offer encryption at rest integrated with AWS KMS, and several encrypt by default: every new S3 object is encrypted automatically (SSE-S3 by default), and you can set EBS encryption by default per Region. You can also use client-side encryption, in which you encrypt data before sending it to AWS, so AWS only ever stores ciphertext. With server-side encryption, the AWS service encrypts the data after receiving it.

Under the shared responsibility model, AWS provides the encryption features; you decide to use them, choose the keys, and control who can use those keys.

AWS Key Management Service (AWS KMS)

AWS KMS is a managed service for creating and controlling encryption keys. It integrates with more than a hundred AWS services, so encrypting an EBS volume or an RDS database is often just a checkbox.

Key points:

Keys are protected by hardware security modules (HSMs) validated under FIPS 140 (Level 3), and key material never leaves KMS unencrypted.

AWS managed keys are created automatically by services on your behalf (named like aws/s3 ). They are free to store, and AWS rotates them.

Customer managed keys are keys you create and control: you set the key policy, enable or disable them, turn on automatic rotation, and schedule deletion. They have a small monthly fee.

AWS owned keys are used by some services internally and are not visible in your account.

Every use of a key is recorded in CloudTrail, which gives you an audit trail of who decrypted what. KMS supports both symmetric keys (the same key encrypts and decrypts, the most common) and asymmetric keys (public and private key pairs for signing or encryption).

Envelope encryption

KMS can encrypt only small amounts of data directly (up to 4 KB). For anything bigger, AWS services use envelope encryption:

1. The service asks KMS for a data key. KMS returns two copies: a plaintext data key and the same data key encrypted under your KMS key.
2. The service encrypts your data locally with the plaintext data key, then discards the plaintext key from memory.
3. It stores the encrypted data key alongside the encrypted data.
4. To decrypt, the service sends the encrypted data key to KMS. If IAM and the key policy allow it, KMS returns the plaintext data key, and the service decrypts the data.
3. Encrypt data locally with the

data key, then discard the

plaintext data key from memory

1. GenerateDataKey
2. Plaintext key

+ encrypted copy

4. Store together

Stored "envelope" (disk or bucket)
Encrypted data
(ciphertext)
Encrypted data key
(useless without KMS)

5. To read: send

encrypted key to

KMS Decrypt

6. If allowed, KMS returns the plaintext data key and the service decrypts the data.

Bulk data never travels to KMS; only small data keys do.

Figure 7.4: Envelope encryption with AWS KMS. A data key encrypts the data; the KMS key, which never leaves KMS, encrypts the data key.

Envelope encryption is fast (bulk encryption happens locally), scalable, and secure (the master key never leaves the HSMs). You will not need the steps on the exam, but understanding them makes KMS questions much easier.

AWS CloudHSM

AWS CloudHSM provides dedicated, single-tenant hardware security modules in your VPC. With CloudHSM, you manage the keys and the users of the HSM; AWS manages the hardware but has no access to your keys. Choose CloudHSM when a regulation or contract requires that keys be kept in a dedicated HSM under your sole control, or when an application needs standard HSM interfaces (PKCS #11, JCE, or Microsoft CNG). KMS can also use a CloudHSM cluster as a custom key store.

AWS KMS AWS CloudHSM
Tenancy Multi-tenant, managed Single-tenant, dedicated
Who manages keys AWS manages service; you control use You fully manage keys
Integration Built into many AWS services Standard HSM APIs
Typical choice Most encryption needs Strict regulatory control
AWS Secrets Manager and Parameter Store

Applications need secrets: database passwords, API keys, OAuth tokens. Hard-coding them in source code is a serious risk.

AWS Secrets Manager stores secrets encrypted with KMS, controls access with IAM, and, its signature feature, automatically rotates secrets on a schedule. Built-in rotation is available for Amazon RDS, Aurora, Redshift, and DocumentDB credentials, and you can write a Lambda function for others. Secrets Manager charges per secret per month and per API call.

AWS Systems Manager Parameter Store stores configuration values and secrets as plain text or as encrypted SecureString parameters (encrypted with KMS). Standard parameters have no additional charge. Parameter Store is ideal for configuration data such as feature flags, AMI IDs, and endpoint URLs, but it does not provide built-in automatic rotation.

Exam tip

“Automatically rotate database credentials” points to AWS Secrets Manager. “Store configuration values cheaply, hierarchically, with optional encryption” points to Parameter Store.

AWS Certificate Manager (ACM)

AWS Certificate Manager provisions, manages, and automatically renews SSL/TLS certificates for encryption in transit. Public certificates issued by ACM for use with integrated services, such as Elastic Load Balancing, CloudFront, and API Gateway, are free. ACM removes the painful, error-prone chore of tracking expiry dates and installing renewed certificates. (ACM can also manage private certificates through AWS Private Certificate Authority, a paid service.)

7.6 Compliance on AWS

Compliance means meeting the requirements of laws, regulations, and industry standards. Under the shared responsibility model, AWS is audited for the parts it operates (data centers, hardware, the hypervisor, managed service operations), and you inherit those controls. You remain responsible for making your workloads compliant.

Major compliance programs

AWS participates in a long list of assurance programs. Know these by name and purpose:

Program What it covers

SOC 1, SOC 2, SOC 3 Independentaudits of controls; SOC 3 is public

ISO/IEC 27001 (and 27017, 27018) Information security management; cloud security; protection of personal datain the cloud

PCI DSS Handling payment card data
HIPAA US health information; AWS signsa Business Associate
Addendum (BAA)
FedRAMP US government cloud authorization
GDPR EU personal data protection law
Two subtleties the exam likes:

HIPAA and GDPR are not certifications AWS “holds.” For HIPAA, AWS offers HIPAA-eligible services and signs a BAA; you must still configure your workload correctly. For GDPR, AWS provides a Data Processing Addendum (included in the service terms) and tools, and you remain responsible as the data controller. Using a compliant service does not make your application compliant automatically. Compliance is shared. The AWS Services in Scope by Compliance Program web page lists which services are covered by each program.

AWS Artifact

AWS Artifact is the free, self-service portal in the console where you download AWS’s compliance reports and review and accept agreements.

Artifact Reports include SOC reports, ISO certificates, PCI DSS attestations of compliance, FedRAMP packages, and many more. Your auditors use them as evidence of AWS’s controls.

Artifact Agreements let you review, accept, and manage agreements such as the BAA for HIPAA, for a single account or for your whole organization.

Some reports require you to accept a nondisclosure agreement (NDA) or terms before downloading, because they are confidential.

Hands-on lab

Mini lab: download a compliance report from AWS Artifact

1. Sign in to the console with a user who has permission to use AWS Artifact, and search for Artifact.
2. In the left navigation, choose Reports.
3. Use the search box to find a report, for example “SOC 2.”
4. Select the report and choose Download report.
5. If prompted, read and accept the terms and conditions for that report.
6. Open the downloaded file and note the audit period and the services in scope.
7. To view agreements, choose Agreements in the navigation and review the available agreements (accept only those your organization actually needs, such as a BAA for health data).

Download AWS security and compliance documents.

SOC 2 Download report
Title Category Period
SOC 2 Type 2 Report (Security) SOC Semiannual
SOC 2 Privacy Report SOC Semiannual
SOC 3 Report (public) SOC Semiannual
Review terms before downloading
This report is confidential. Share it only with

auditors and regulators under the terms.

I have read and agree to the terms

Cancel Accept and download

Figure 7.5: Searching for and downloading a SOC report in AWS Artifact. (Illustration, not an actual AWS screenshot.) AWS Audit Manager

Artifact gives you evidence about AWS’s controls. AWS Audit Manager helps you collect evidence about your own use of AWS. It continuously and automatically gathers evidence (from AWS Config, CloudTrail, Security Hub, and other sources), maps it to controls in prebuilt frameworks (such as PCI DSS, HIPAA, GDPR, SOC 2, and CIS), and helps you produce audit-ready reports. It reduces the manual scramble of screenshots and spreadsheets before an audit.

Exam tip

“Download AWS’s SOC 2 or ISO report” or “accept a BAA” is AWS Artifact. “Continuously collect evidence about my own AWS resources for an upcoming audit” is AWS Audit Manager.

Data residency and sovereignty

Data residency means keeping data in a particular geographic location. On AWS, you choose the Region where your data is stored, and AWS does not move your content out of that Region unless you do so (for example, by configuring replication) or it is required by law. To enforce this across accounts, combine:

SCPs in AWS Organizations that deny actions outside approved Regions
AWS Control Tower Region deny controls
AWS Config rules and IAM conditions (such as aws:RequestedRegion )
For workloads needing extra isolation, AWS offers separate partitions:

AWS GovCloud (US) Regions are isolated Regions designed for US government agencies and contractors with sensitive workloads. They are operated by US citizens on US soil and support requirements such as FedRAMP High and ITAR. Access requires a separate sign-up (a root user task).

AWS European Sovereign Cloud is an independent cloud located entirely within the European Union, physically and logically separate from other AWS Regions, operated and supported by EU residents, with its own governance. Its first Region is in Germany (Brandenburg). It serves customers with strict European sovereignty requirements, such as public sector and regulated industries.

Penetration testing policy

Customers may run security assessments and penetration tests against their own resources on a list of approved services without prior approval from AWS. The list includes Amazon EC2, RDS, Aurora, CloudFront, API Gateway, Lambda, Lightsail, Elastic Beanstalk, and others (check the current policy page).

Prohibited activities include:

DoS and DDoS attacks or simulations (these require a separate simulated events process through approved partners)

Flooding of protocols or requests

DNS zone walking through Amazon Route 53 hosted zones

Testing must target your own resources, never other customers’ or AWS’s own infrastructure.

Reporting abuse: AWS Trust & Safety

If you see AWS resources being used for abusive or illegal purposes (spam, port scanning, DoS attacks originating from AWS IP addresses, phishing sites, malware hosting, or copyright infringement), report it to the AWS Trust & Safety team using the Report Amazon AWS abuse form or by emailing abuse@amazonaws.com. This is also the right path if you receive an abuse notice about your own account: respond promptly, because AWS may restrict resources that are causing harm.

Good to know

If you suspect your own account is compromised (unexpected resources, unknown IAM users, a surprise bill), rotate credentials, review CloudTrail, and contact AWS Support. Trust & Safety handles abuse from AWS resources; Support helps you with your account.

7.7 Where to find security help

AWS publishes a lot of free security guidance. Know which resource fits which need:

AWS Security Center (aws.amazon.com/security): the hub for AWS security news, the security blog, whitepapers, bulletins, and best practices.

AWS Knowledge Center: answers to the most frequent questions AWS Support receives, including many security how-tos.

AWS re:Post: the community question-and-answer site, where AWS experts and community members answer questions (the successor to the AWS Forums).

AWS Security Blog and security bulletins: announcements and vulnerability notices.

AWS Well-Architected Framework, Security Pillar: design principles and best practices.

AWS Trusted Advisor: automated checks, including security checks such as open security groups, MFA on the root user, and exposed access keys (the set of checks depends on your support plan).

AWS Marketplace: a catalog where you can buy and deploy third-party security products such as firewalls, endpoint protection, SIEM, and vulnerability scanners, often billed through your AWS account.

AWS Partner Network (APN): consulting partners and Managed Security Service Providers who can design or run security for you.

Real-world example

Real-world scenario: A hospital network is moving its patient portal to AWS. The compliance officer downloads AWS’s HIPAA-related reports and accepts the BAA in AWS Artifact. Engineers use only HIPAA-eligible services, encrypt data at rest with KMS customer managed keys, enforce TLS with certificates from ACM, and store database passwords in Secrets Manager with rotation. AWS WAF and Shield protect the portal, GuardDuty and Inspector watch for threats and vulnerabilities, Macie confirms no patient data lands in an unexpected bucket, and Audit Manager collects evidence for the annual audit. No single service makes the workload compliant, but together they cover each layer.

Chapter 7 summary

Use defense in depth: edge protection, network filtering, instance hardening, encrypted data, identity, and monitoring together.

Shield Standard is free, automatic Layer 3/4 DDoS protection; Shield Advanced adds 24/7 SRT access, cost protection, and advanced mitigation.

AWS WAF filters Layer 7 web requests (SQL injection, XSS, IP and geo rules, rate limits) on CloudFront, ALB, API Gateway, and more; Firewall Manager applies firewall rules across an organization; Network Firewall inspects traffic for whole VPCs.

Security groups are stateful, allow-only, and attached to instances; network ACLs are stateless, allow-and-deny, ordered, and attached to subnets.

GuardDuty detects threats, Inspector finds vulnerabilities, Macie finds sensitive data in S3, Detective investigates root causes, Security Hub aggregates findings and checks posture, and Security Lake centralizes security data. CloudTrail records who did what; Config records resource configuration and compliance over time. KMS manages encryption keys (with envelope encryption and CloudTrail auditing); CloudHSM gives dedicated HSMs under your control; Secrets Manager rotates secrets; Parameter Store stores configuration; ACM provides free, auto-renewing public certificates.

AWS Artifact provides AWS compliance reports and agreements; Audit Manager collects evidence about your own environment.

You choose the Region for data residency; GovCloud (US) and the European Sovereign Cloud offer isolated environments for special requirements.

Pen testing of approved services needs no prior approval, but DoS testing is prohibited; report abuse to AWS Trust & Safety.

Key terms
Term Definition
Defense in depth Multiple independent layers of security controls
DDoS Attack that floodsatarget with traffic from many sources
Web ACL A set of AWS WAF rulesattached to aresource
Stateful Return traffic isautomatically allowed
Stateless Inbound and outbound traffic are evaluated separately
Finding A security issue reported by aservice such as GuardDuty
Encryption at rest Protecting stored data
Encryption in transit Protecting data moving overa network, usually with TLS
KMS key A key in AWS KMS used to encrypt data or data keys

Envelope encryption Encrypting data with a data key, then encrypting that key with a KMS key

HSM Hardware security module: tamper-resistant device for keys
BAA Business Associate Addendum, required for HIPAA workloads
Dataresidency Keeping data within a chosen geographic location
Compliance report Third-party audit evidence downloaded from AWS Artifact
Practice questions

1. A company wants protection against common DDoS attacks for its website at no additional cost. Which service provides this automatically?

A. AWS Shield Advanced B. AWS Shield Standard
C. AWS WAF D. Amazon GuardDuty

2. An e-commerce company is concerned about large DDoS attacks during its holiday sale and wants 24/7 access to AWS DDoS experts and protection against scaling charges caused by attacks. Which service should it use?

A. AWS Shield Standard B. AWS Firewall Manager
C. AWS Shield Advanced D. Amazon Inspector

3. A web application behind an Application Load Balancer is receiving SQL injection attempts. Which service can block these requests?

A. Security groups B. Network ACLs
C. AWS WAF D. Amazon Macie

4. A security team must apply the same AWS WAF rules and security group baselines to all 60 accounts in its AWS Organizations organization, including new accounts. Which service should it use?

A. AWS Firewall Manager B. AWS Network Firewall
C. AWS Shield Standard D. Amazon Detective

5. A company needs to block traffic from one specific malicious IP address range to all instances in a subnet. Which feature should it use?

A. A security group deny rule B. A network ACL deny rule
C. An IAM policy D. AWS Certificate Manager

6. Which statements describe security groups? (Choose two.)

A. They are stateful B. They support explicit deny rules
C. They are attached at the subnet level only D. They support allow rules only
E. Rules are evaluated in numbered order

7. Which service uses machine learning to analyze CloudTrail events, VPC Flow Logs, and DNS logs to detect malicious activity, such as an instance communicating with a cryptocurrency mining server?

A. Amazon Inspector B. Amazon GuardDuty
C. AWS Config D. Amazon Macie

8. A company wants to automatically scan its EC2 instances and container images in Amazon ECR for known software vulnerabilities. Which service should it use?

A. Amazon Inspector B. AWS Shield
C. AWS Artifact D. Amazon Detective

9. A healthcare company needs to find out whether any of its S3 buckets contain unprotected personally identifiable information. Which service is designed for this?

A. Amazon GuardDuty B. Amazon Macie
C. AWS Security Hub D. AWS CloudHSM

10. A security analyst received a GuardDuty finding and needs to visualize related activity and determine the root cause. Which service helps most?

A. Amazon Detective B. AWS Audit Manager
C. AWS Trusted Advisor D. Amazon Cognito

11. An administrator needs to find out which IAM user deleted an S3 bucket yesterday. Which service provides this information?

A. Amazon CloudWatch B. AWS Config
C. AWS CloudTrail D. Amazon Inspector

12. A company wants to continuously check whether its EBS volumes are encrypted and see how a security group’s rules changed over the past month. Which service should it use?

A. AWS Config B. AWS Shield
C. Amazon Macie D. AWS Artifact

13. A company wants a single dashboard that aggregates findings from GuardDuty, Inspector, and Macie and scores its accounts against AWS Foundational Security Best Practices. Which service should it use?

A. Amazon Security Lake B. AWS Security Hub
C. AWS Control Tower D. AWS Systems Manager

14. A regulation requires a company to store encryption keys in dedicated, single-tenant hardware security modules that only the company can manage. Which service meets this requirement?

A. AWS KMS with AWS managed keys B. AWS CloudHSM
C. AWS Secrets Manager D. AWS Certificate Manager

15. An application stores a database password in its source code. The company wants to remove it and automatically rotate the password every 30 days. Which service should it use?

A. AWS Systems Manager Parameter Store standard

parameters

B. AWS Secrets Manager
C. AWS Artifact D. Amazon S3 with versioning

16. Which service provides free public SSL/TLS certificates that renew automatically for use with Elastic Load Balancing and Amazon CloudFront?

A. AWS KMS B. AWS Certificate Manager
C. AWS CloudHSM D. IAM

17. An external auditor asks for AWS’s SOC 2 report and the company needs to accept a Business Associate Addendum. Where can the company do both?

A. AWS Audit Manager B. AWS Artifact
C. AWS Trusted Advisor D. AWS Security Hub

18. A company preparing for a PCI DSS audit wants to continuously collect evidence from its own AWS environment and map it to the framework’s controls. Which service should it use?

A. AWS Artifact B. AWS Audit Manager
C. Amazon Macie D. AWS Shield Advanced

19. A customer plans to run a penetration test against its own EC2 instances. Which statement is correct?

A. All penetration testing on AWS is prohibited B. The customer must always request approval first
C. Testing approved services such as EC2 is allowed without

prior approval, but DoS testing is prohibited

D. The customer may also test other customers’ instances in

the same Region

20. A company notices that an EC2 instance with an AWS IP address is sending spam to its mail servers. The instance does not belong to the company. What should it do?

A. Contact the AWS Trust & Safety team using the abuse

reporting form

B. Open a ticket in AWS Artifact
C. Run Amazon Inspector against the instance D. Use AWS WAF to delete the instance Answers and explanations

1. B. Shield Standard is automatic and free for all customers. Shield Advanced (A) is paid, WAF (C) filters web requests and is billed per rule and request, and GuardDuty (D) detects threats rather than mitigating DDoS.
2. C. Shield Advanced adds the Shield Response Team and DDoS cost protection. Shield Standard (A) has neither, and Firewall Manager (B) only manages policies.
3. C. AWS WAF inspects HTTP request content and blocks SQL injection. Security groups and network ACLs (A, B) filter by IP, port, and protocol, not request content.
4. A. Firewall Manager centrally applies WAF, security group, Shield Advanced, and Network Firewall policies across an organization. Network Firewall (B) filters traffic in a VPC but does not manage policies across accounts.
5. B. Network ACLs support deny rules at the subnet level. Security groups (A) cannot deny, and IAM policies (C) control API access, not network traffic.
6. A, D. Security groups are stateful and support allow rules only. Deny rules, subnet attachment, and numbered order (B, C, E) describe network ACLs.
7. B. GuardDuty analyzes those data sources for threats. Inspector (A) finds vulnerabilities, Config (C) tracks configuration, and Macie (D) finds sensitive data.
8. A. Amazon Inspector scans EC2, ECR images, and Lambda for vulnerabilities. Detective (D) investigates findings, and Shield (B) protects against DDoS.
9. B. Macie discovers sensitive data such as PII in S3. GuardDuty (A) detects threats, and Security Hub (C) aggregates findings rather than scanning objects itself.
10. A. Detective builds a behavior graph to investigate root causes. Audit Manager (B) collects compliance evidence, and Trusted Advisor (C) gives best-practice checks.
11. C. CloudTrail records API calls, including who deleted a bucket. CloudWatch (A) monitors performance, and Config (B) records configuration state rather than who made calls.
12. A. AWS Config tracks configuration history and evaluates compliance with rules. Macie (C) and Artifact (D) do not track resource configuration.
13. B. Security Hub aggregates findings and runs best-practice standards checks. Security Lake (A) centralizes raw security data in a data lake, and Control Tower (C) governs multi-account setup.
14. B. CloudHSM provides dedicated, single-tenant HSMs that the customer manages. KMS (A) is a multi-tenant managed service, and Secrets Manager (C) stores secrets rather than providing HSMs.
15. B. Secrets Manager stores secrets and rotates them automatically. Parameter Store (A) can store encrypted values but has no built-in rotation.
16. B. ACM provides free public certificates for integrated services and renews them automatically. KMS (A) manages encryption keys, not TLS certificates.
17. B. AWS Artifact provides AWS compliance reports and agreements such as the BAA. Audit Manager (A) collects evidence about the customer’s own environment.
18. B. Audit Manager continuously collects evidence and maps it to frameworks like PCI DSS. Artifact (A) provides AWS’s own reports, not evidence about your resources.
19. C. Approved services can be tested without prior approval, but DoS, flooding, and Route 53 zone walking are prohibited. Testing other customers’ resources (D) is never allowed.
20. A. Abuse originating from AWS resources is reported to AWS Trust & Safety. Artifact (B) is for compliance documents, and you cannot scan or delete another customer’s instance (C, D).