AWS Security And Compliance Services – Quick Guide
1. AWS Certificate Manager (ACM)
Description: Provision, manage, and renew SSL/TLS certificates for AWS services and internal applications.
Use Cases:
- Enable HTTPS for domains on CloudFront, ELB, and API Gateway.
- Automate certificate renewals to avoid downtime.
- Issue private certificates for internal apps via ACM Private CA.
2. AWS Secrets Manager
Description: Securely stores, rotates, and manages secrets like database logins, API keys, and credentials.
Use Cases:
- Centralize secret management for applications.
- Automatically rotate RDS database credentials.
- Remove hardcoded passwords from code.
3. AWS Artifact
Description: On-demand access to AWS compliance reports and security documentation.
Use Cases:
- Download SOC, ISO, PCI DSS, or FedRAMP reports for audits.
- Accept compliance agreements (e.g., HIPAA BAA).
- Provide auditors evidence of AWS compliance.
4. Amazon GuardDuty
Description: Continuous threat detection using machine learning, anomaly detection, and AWS data sources.
Use Cases:
- Detect compromised IAM credentials or EC2 instances.
- Identify crypto‑mining in your AWS environment.
- Alert on unusual API calls or malicious IP traffic.
5. Amazon Inspector
Description: Automated vulnerability management service for workloads.
Use Cases:
- Scan EC2, ECR, and Lambda for software vulnerabilities (CVEs).
- Meet patching requirements for compliance frameworks.
- Prioritize risks by severity and exposure.
6. AWS Config
Description: Tracks AWS resource configuration changes and evaluates them against compliance rules.
Use Cases:
- Enforce encryption on all S3 buckets.
- Ensure IAM policies never allow
*on sensitive actions. - Generate compliance reports for auditors.
7. Amazon Macie
Description: Uses ML to discover, classify, and protect sensitive data in Amazon S3.
Use Cases:
- Identify and protect PII (Personally Identifiable Information).
- Detect public S3 buckets storing sensitive data.
- Comply with GDPR or HIPAA regulations.
8. AWS Security Hub
Description: Centralizes and prioritizes security alerts across AWS and partner services.
Use Cases:
- View compliance scores against CIS, PCI DSS, or AWS Foundational Best Practices.
- Aggregate GuardDuty, Config, Inspector, and Macie findings.
- Central security dashboard for multiple AWS accounts.
9. Amazon Detective
Description: Investigates and visualizes security issues using AWS log data.
Use Cases:
- Conduct root cause analysis of suspicious login activity.
- Analyze relationships among VPC Flow Logs, CloudTrail, and GuardDuty findings.
- Accelerate incident response investigations.
10. AWS Abuse
Description: AWS’s security team and reporting channel to handle abuse complaints (spam, malware, DDoS from AWS resources).
Use Cases:
- Report compromised resources running malicious workloads.
- Receive notifications when your resources are implicated in abuse incidents.
- Support compliance with acceptable use policies.
11. IAM Access Analyzer
Description: Identifies resources shared outside your account (S3, IAM roles, KMS keys, etc.).
Use Cases:
- Detect unintended public access to S3 buckets.
- Audit IAM roles trusted by external accounts.
- Continuously monitor for over‑permissive resource sharing.