03 AWS Security Services

Security tools are most valuable when you understand what they detect, what evidence supports the finding, and what action should happen next.

Welcome to the AWS Security Services Lab.

In the previous lab, you focused on:

audit logging
monitoring
configuration tracking
network visibility
investigation

Now you will work with AWS-native security services that help you identify:

suspicious behavior
vulnerabilities
sensitive data exposure
configuration weaknesses
security posture problems

This lab is based on the same core services emphasized throughout the SCS-C02 study guide:

Amazon GuardDuty
AWS Security Hub
Amazon Inspector
Amazon Macie
AWS Config
EventBridge
Lambda / SSM response concepts

🎯 Mission Information

Item	Details
Lab	AWS Security Services
Difficulty	Intermediate
Estimated Time	2–3 hours
Primary Focus	AWS Native Security Tooling
Target Roles	Cloud Security Engineer, SOC Analyst, Incident Responder, Security Consultant
Certification Alignment	AWS Certified Security – Specialty
Career Skill	Security Findings Analysis & Prioritization
Environment	Personal AWS lab account
Cost Awareness	Some services may generate ongoing charges

⚠️ Cost Awareness

Services such as:

GuardDuty
Security Hub
Inspector
Macie
AWS Config

may generate usage charges.

For this lab:

enable only what you need
keep the scope small
review service pricing before long-term use
disable temporary test configurations when finished

🏢 Mission Scenario

Your organization already collects:

CloudTrail
CloudWatch logs
VPC Flow Logs
AWS Config data

However, the security team still spends too much time manually reviewing activity.

Management wants better visibility into:

suspicious behavior
vulnerable workloads
exposed sensitive data
security posture
compliance deviations

You have been asked to evaluate AWS-native security services and build a basic security-operations workflow.

🎯 Mission Objectives

By the end of this lab, you should be able to:

explain GuardDuty
review GuardDuty findings
explain Security Hub
understand centralized findings
explain Inspector
review vulnerability findings
explain Macie
understand sensitive-data findings
understand Config integration
compare AWS security services
prioritize findings
investigate findings using supporting telemetry
understand EventBridge-based response
document security findings
answer security-services interview questions

📚 Prerequisites

You should understand:

IAM
VPC
EC2
S3
CloudTrail
CloudWatch
AWS Config

Recommended previous labs:

AWS IAM Security
AWS Network Security
AWS Logging & Monitoring

🧠 Security Services Mental Model

Think about AWS security tooling using this model:

Assets
   ↓
Telemetry / Configuration
   ↓
Security Service
   ↓
Finding
   ↓
Prioritization
   ↓
Investigation
   ↓
Response

Do not stop at:

A finding exists.

Always ask:

What does the finding mean?

Which asset is affected?

What evidence supports it?

What is the risk?

Is it a true positive?

What should we do next?

🗺️ Core Security Services

Use this mental map:

GuardDuty
→ Threat Detection

Inspector
→ Vulnerability Detection

Macie
→ Sensitive Data Discovery

Security Hub
→ Centralized Security Findings

AWS Config
→ Configuration & Compliance

EventBridge
→ Event Routing / Automation

This distinction is directly reinforced throughout the SCS-C02 study guide.

🧪 Task 1 — Enable Amazon GuardDuty

Navigate:

Amazon GuardDuty

Enable GuardDuty for your lab account if it is not already enabled.

🧠 What GuardDuty Does

The study guide describes GuardDuty as an AWS-native threat-detection service that analyzes activity such as:

CloudTrail events
VPC-related telemetry
DNS activity
S3-related activity

and generates findings for suspicious behavior.

🔍 Threat Categories to Understand

Examples include:

unusual IAM activity
suspicious credential use
EC2 reconnaissance
malware/C2-related behavior
unusual S3 access

🧪 Task 2 — Review GuardDuty Findings

Open:

GuardDuty → Findings

If your environment has no findings, review available sample findings where supported.

For each finding, record:

finding type
severity
affected resource
account
Region
principal
source
time

📋 GuardDuty Finding Worksheet

Finding	Severity	Resource	Evidence	Action

🧠 Investigation Question

Do not ask only:

Is this high severity?

Ask:

Is the activity expected for this workload?

Context determines whether a finding represents real risk.

🧪 Task 3 — Analyze a GuardDuty IAM Finding

Use a sample or hypothetical IAM-related finding.

Example:

Access key used from an unusual location.

Investigate conceptually:

GuardDuty Finding
      ↓
Affected IAM Identity
      ↓
CloudTrail
      ↓
Recent API Activity
      ↓
Resources Accessed
      ↓
Containment Decision

🔍 Questions to Ask

Which access key?
Which user/role?
Source IP?
Region?
Which APIs?
Was MFA involved?
Were permissions changed?
Was persistence created?

🧪 Task 4 — Analyze a GuardDuty EC2 Finding

Use a sample finding involving suspicious EC2 activity.

The study guide includes examples such as port scanning, malware, or command-and-control-like behavior.

Investigate:

instance ID
Security Group
associated IAM role
network destination
Flow Logs
CloudTrail
recent configuration changes

🚨 Response Thinking

Do not immediately terminate the workload.

Consider:

Validate
   ↓
Contain
   ↓
Preserve Evidence
   ↓
Investigate
   ↓
Remediate

🧪 Task 5 — Enable AWS Security Hub

Navigate:

AWS Security Hub

Enable it for the lab account if appropriate.

🧠 Why Security Hub Exists

Security teams may receive findings from multiple services.

Security Hub helps centralize security posture and findings from services such as:

GuardDuty
Inspector
Macie
Firewall Manager

The study guide explicitly emphasizes this aggregation role.

🗺️ Conceptual Flow

GuardDuty ─────┐
Inspector ─────┤
Macie ─────────┤
Config / Other ├──→ Security Hub
Partner Tools ─┘

🧪 Task 6 — Review Security Hub Findings

Open the findings view.

Review:

severity
resource
product/source
workflow status
compliance/security-control context

🧠 Prioritization Question

A security team cannot treat every finding equally.

Ask:

Which finding creates the greatest actual business risk?

Consider:

severity
asset criticality
internet exposure
exploitability
sensitive data
identity privileges

🧪 Task 7 — Build a Finding Prioritization Matrix

Create:

Finding	AWS Severity	Asset Criticality	Exposure	Priority

💡 Professional Tip

A medium-severity finding on a critical internet-facing system may matter more than a high-severity finding on an isolated lab resource.

Risk requires context.

🧪 Task 8 — Review Security Standards

Security Hub can evaluate controls against supported security standards and best-practice frameworks.

The study guide mentions examples such as:

CIS
AWS Foundational Security Best Practices

Review available standards in your environment.

🧠 Important Distinction

A failed control does not automatically mean:

breach.

It means:

expected security posture is not being met.

That may represent:

misconfiguration
governance gap
compliance issue
security risk

🧪 Task 9 — Enable Amazon Inspector

Navigate:

Amazon Inspector

Enable it in your lab scope if appropriate.

🧠 What Inspector Does

The study guide associates Inspector with vulnerability detection across supported resources such as:

EC2
Lambda
ECR container images

🔍 Key Distinction

Remember:

GuardDuty
→ Suspicious behavior

Inspector
→ Vulnerabilities

A vulnerable workload may not currently be compromised.

A compromised workload may not necessarily have an Inspector finding explaining the attack.

🧪 Task 10 — Review Inspector Findings

Review available findings or sample output.

Record:

affected resource
vulnerability
severity
package/component
remediation information

📋 Vulnerability Assessment Table

Resource	Vulnerability	Severity	Exposure	Recommendation

🧠 Vulnerability Risk Question

Ask:

Is the vulnerable resource actually reachable or exploitable in this architecture?

Combine:

Vulnerability
+
Exposure
+
Asset Value
=
Better Risk Context

🧪 Task 11 — Understand Inspector + Security Hub

Review how Inspector findings can appear in Security Hub.

This helps security teams avoid separate dashboards for every service.

Concept:

Inspector
    ↓
Finding
    ↓
Security Hub
    ↓
Central Prioritization

🧪 Task 12 — Enable or Explore Amazon Macie

Navigate:

Amazon Macie

If appropriate for the lab, enable or explore its capabilities.

🧠 What Macie Does

The study guide focuses Macie on sensitive-data discovery in S3, including data such as:

PII
financial data
credentials

🔍 Important Distinction

Macie
→ What sensitive data exists?

GuardDuty
→ Is suspicious behavior occurring?

Inspector
→ Are there vulnerabilities?

🧪 Task 13 — Review S3 Data Exposure

Choose a lab S3 bucket.

Review:

public access
encryption
bucket policy
cross-account access
sensitive-data considerations

🧠 Data Security Questions

Ask:

Does the bucket contain sensitive data?

Who can access it?

Is it public?

Is encryption enabled?

Is cross-account access intentional?

🧪 Task 14 — Simulate a Sensitive-Data Finding

Create a hypothetical scenario:

Bucket:
customer-data-lab

Finding:
Sensitive data discovered.

Exposure:
Cross-account access exists.

Risk:
Potential unauthorized disclosure.

Document:

Data Type

What kind of sensitive information?

Access

Who can access it?

Exposure

Public, private, or cross-account?

Protection

Encryption?

Remediation

What should change?

🧪 Task 15 — Review AWS Config Integration

Return to:

AWS Config

Review how configuration compliance can complement Security Hub.

Example:

AWS Config
→ Detect unencrypted S3 bucket

Security Hub
→ Present security posture / findings

🧠 Why This Matters

Security services often overlap intentionally.

One may detect:

a misconfiguration

another:

suspicious behavior

another:

vulnerability

The security engineer must connect them.

🧪 Task 16 — Create a Cross-Service Security Scenario

Use this scenario:

An internet-facing EC2 instance has a critical vulnerability and GuardDuty also reports suspicious outbound traffic.

Correlate:

Inspector

What vulnerability exists?

GuardDuty

What suspicious activity occurred?

Security Hub

How are findings centralized?

CloudTrail

What administrative/API actions occurred?

VPC Flow Logs

Where did the instance communicate?

🧠 Key Learning

This is much closer to real security operations than reviewing one service in isolation.

🧪 Task 17 — Build a Security Finding Workflow

Create:

Security Finding
      ↓
Validate
      ↓
Enrich
      ↓
Prioritize
      ↓
Assign
      ↓
Contain / Remediate
      ↓
Verify
      ↓
Close

🧪 Task 18 — Explore EventBridge Integration

Open:

Amazon EventBridge

Review how GuardDuty or Security Hub findings can trigger rules.

The SCS-C02 study guide specifically describes EventBridge-based automation.

🗺️ Example Workflow

GuardDuty
   ↓
EventBridge
   ↓
Lambda
   ↓
Action
   ↓
SNS Notification

🧪 Task 19 — Design an Automated Response

Do not necessarily deploy destructive automation.

Design one.

Scenario:

GuardDuty reports compromised IAM credentials.

Possible response:

GuardDuty Finding
      ↓
EventBridge
      ↓
Lambda
      ↓
Disable Access Key
      ↓
Notify Security Team

⚠️ Automation Safety

Before automating containment, ask:

Can false positives occur?
Could the action cause outage?
Is approval required?
Can the action be reversed?
Is evidence preserved?

🧪 Task 20 — Design an EC2 Isolation Workflow

Scenario:

GuardDuty detects suspicious EC2 activity.

Conceptual response:

GuardDuty
   ↓
EventBridge
   ↓
Lambda / SSM
   ↓
Apply Quarantine SG
   ↓
Notify SOC

This pattern closely follows the incident-response automation examples in the SCS-C02 guide.

🧠 Quarantine Principle

Isolation should:

restrict attacker communication
preserve investigative access
avoid unnecessary evidence destruction

🧪 Task 21 — Compare Core Security Services

Create this comparison in your notes:

Service	Primary Question
GuardDuty	Is suspicious activity happening?
Inspector	Are supported workloads vulnerable?
Macie	Where is sensitive data and is it exposed?
Security Hub	What security findings and posture issues exist centrally?
AWS Config	Is resource configuration compliant?
CloudTrail	Who did what?

This is one of the most important concepts for both the certification and interviews.

🧪 Task 22 — Create a Security Findings Register

Build:

ID	Service	Finding	Severity	Asset	Risk	Status
SEC-001
SEC-002

📊 Severity Model

Use:

Critical

Immediate risk of major compromise or significant data exposure.

High

Serious issue requiring urgent remediation.

Medium

Meaningful security weakness requiring planned remediation.

Low

Hardening or improvement opportunity.

🧪 Task 23 — Create a GuardDuty Finding Report

Example:

Finding ID:
SEC-001

Source:
Amazon GuardDuty

Title:
Suspicious Credential Usage

Severity:
High

Affected Resource:
IAM User / Access Key

Evidence:
Unusual source and API activity.

Potential Impact:
Unauthorized AWS resource access.

Immediate Action:
Validate and contain affected credentials.

Investigation:
Review CloudTrail and related activity.

Recommendation:
Rotate credentials, review permissions, improve monitoring, and move toward temporary credentials where possible.

🧪 Task 24 — Create an Inspector Finding Report

Example:

Finding ID:
SEC-002

Source:
Amazon Inspector

Title:
Critical Vulnerability on Internet-Facing EC2

Severity:
Critical

Affected Resource:
EC2 Instance

Exposure:
Internet-facing

Risk:
Potential remote exploitation.

Recommendation:
Patch or replace affected component, validate exposure, and verify remediation.

🧪 Task 25 — Create a Macie Finding Report

Example:

Finding ID:
SEC-003

Source:
Amazon Macie

Title:
Sensitive Data in Broadly Accessible S3 Bucket

Severity:
High

Risk:
Unauthorized disclosure of sensitive data.

Recommendation:
Restrict access, review bucket policy, validate business need, and ensure appropriate encryption.

🧪 Task 26 — Prioritize the Three Findings

You now have:

suspicious credential usage
critical vulnerability
sensitive-data exposure

Ask:

Which should be handled first?

There is no universal answer without context.

Consider:

active compromise
data sensitivity
asset exposure
exploitation evidence
business criticality

This is security judgment.

🧪 Task 27 — Build a Security Dashboard Concept

Design a simple operational dashboard.

Security Hub
│
├── Critical Findings
├── High Findings
├── GuardDuty Threats
├── Inspector Vulnerabilities
├── Macie Data Findings
└── Compliance Failures

Then add:

owner
age
status
remediation SLA

🧠 Engineering vs Operations

Security Engineers may configure the controls.

SOC teams may investigate findings.

Security Architects may define the design.

Governance teams may track compliance.

The services are shared across roles.

🧪 Task 28 — Perform a Security Services Assessment

Create:

Control	Status	Risk	Recommendation
GuardDuty enabled
Security Hub enabled
Inspector coverage
Sensitive-data visibility
Config monitoring
Centralized findings
Alert routing
Automated response
Multi-account design
Finding ownership

🚨 Incident Scenario — Compromised IAM Credential

GuardDuty reports suspicious credential activity.

Use:

Finding
   ↓
Validate
   ↓
Contain Credential
   ↓
Review CloudTrail
   ↓
Identify Scope
   ↓
Check Persistence
   ↓
Remediate
   ↓
Improve

🔎 Investigate

Look for:

CreateUser
CreateAccessKey
CreateRole
AttachRolePolicy
AssumeRole
S3 access
EC2 creation
unusual Region use

🚨 Incident Scenario — Vulnerable EC2 + Suspicious Network Activity

Inspector identifies a critical vulnerability.

Later GuardDuty reports suspicious traffic.

Correlate:

Inspector
→ Potential Entry Point

GuardDuty
→ Suspicious Behavior

Flow Logs
→ Network Evidence

CloudTrail
→ AWS API Activity

Now determine:

Was the vulnerability actually exploited?

That is deeper security analysis.

🎤 AWS Security Services Interview Questions

Practise without notes.

GuardDuty

1. What is Amazon GuardDuty?

2. What kinds of threats can it detect?

3. What data sources does GuardDuty analyze?

4. How would you respond to a GuardDuty finding?

Security Hub

5. What is AWS Security Hub?

6. Security Hub vs GuardDuty?

7. Why centralize security findings?

8. How would you prioritize Security Hub findings?

Inspector

9. What is Amazon Inspector?

10. GuardDuty vs Inspector?

11. How would you handle a critical Inspector finding?

Macie

12. What is Amazon Macie?

13. GuardDuty vs Macie?

14. How would you identify sensitive data exposed in S3?

Config

15. What role does AWS Config play in security?

16. Config vs Security Hub?

Automation

17. How does EventBridge support security automation?

18. When would you use Lambda in incident response?

19. What are the risks of automated remediation?

Architecture

20. How would you enable security services across multiple AWS accounts?

21. Why use a centralized security account?

22. How would you prevent individual teams from disabling security monitoring?

🚨 Scenario Interview Question

GuardDuty detects suspicious API usage from an IAM access key. What would you do?

A weak answer:

Disable the key.

A stronger answer:

I would validate the finding, identify the principal and affected access key, contain the credential if necessary, review CloudTrail for actions performed, determine which resources were accessed or modified, check for persistence mechanisms, remediate the root cause, and improve preventive controls.

🧠 Interview Answer Framework

Use:

Finding
   ↓
Context
   ↓
Evidence
   ↓
Impact
   ↓
Response
   ↓
Prevention

💬 Interview Tip

Do not answer with service names only.

Instead of:

“Use Security Hub and GuardDuty.”

say:

“I would use GuardDuty as a threat-detection source, centralize findings in Security Hub, correlate the finding with CloudTrail and network telemetry, then determine whether containment or automated response is appropriate.”

That sounds like someone who understands security operations.

📁 Portfolio Evidence

After completing this lab, create sanitized portfolio evidence.

Include:

Security Services Architecture

Show relationships between:

GuardDuty
Inspector
Macie
Security Hub
EventBridge

Findings Register

Include 3–5 sample findings.

Investigation

Document one finding end-to-end.

Remediation

Explain:

what happened
why it mattered
what you changed
how you validated the fix

📝 Resume Examples

Instead of:

Worked with AWS security services.

Use:

Evaluated AWS-native security services including GuardDuty, Security Hub, Inspector, Macie, and AWS Config in a lab environment and correlated findings with CloudTrail and network telemetry.

Or:

Designed a security-finding workflow using GuardDuty, Security Hub, EventBridge, and automated-response concepts for AWS incident detection and remediation.

⭐ Job-Readiness Check

After this lab, you should be able to:

explain GuardDuty
explain Inspector
explain Macie
explain Security Hub
distinguish threat vs vulnerability vs data findings
prioritize findings
correlate security-service findings with telemetry
explain automated-response workflows
document findings professionally
discuss multi-account security monitoring
answer scenario-based interview questions

If you can name the services but cannot explain how they work together, repeat the lab.

The goal is not:

I enabled five AWS security services.

The goal is:

I understand what each service contributes to the security lifecycle and how to respond to the findings it generates.

🧹 Lab Clean-Up

After completing your evidence collection:

disable temporary security-service configurations if you do not need them
remove test EventBridge rules
remove test Lambda functions
remove unnecessary SNS topics
review Inspector/GuardDuty/Macie coverage
review AWS Config usage
check the billing dashboard for ongoing charges

Do not disable controls you intentionally want to keep for your learning environment.

🏆 Mission Complete

You have now practised:

Threat Detection
      ↓
Vulnerability Detection
      ↓
Sensitive Data Discovery
      ↓
Centralized Findings
      ↓
Prioritization
      ↓
Investigation
      ↓
Automated Response

These are core capabilities for:

Cloud Security Engineers
Cloud SOC Analysts
Incident Responders
Security Consultants
AWS Security Architects

🚀 What’s Next?

You now understand AWS-native security tooling and how findings are generated.

The next step is to bring together:

IAM
networking
logging
GuardDuty
Security Hub
investigation
containment
remediation

into a complete incident-response workflow.

➡️ Next: AWS Incident Response Lab

In the next lab, you will investigate:

compromised IAM credentials
suspicious API activity
EC2 compromise
network indicators
evidence collection
containment
eradication
recovery
incident timelines
post-incident review
interview-ready incident scenarios