GuardDuty, Security Hub, Macie and Inspector
Detection services answer different questions. The exam rewards picking the one service that matches the verb in the scenario: detect threats, find vulnerabilities, find sensitive data, or aggregate findings.
What each service does
| Service | Finds | Looks at |
|---|---|---|
| Amazon GuardDuty | Threats and suspicious behavior | CloudTrail events, VPC Flow Logs, DNS logs, plus optional protection plans |
| Amazon Inspector | Software vulnerabilities and network exposure | EC2, ECR images, Lambda functions |
| Amazon Macie | Sensitive data such as PII | S3 objects |
| AWS Security Hub | Aggregated findings and standards compliance | Findings from other services |
| Amazon Detective | Root cause and investigation graphs | CloudTrail, Flow Logs, GuardDuty findings |
GuardDuty
GuardDuty is regional and needs no agents for its core sources. Optional protection plans extend it: S3 protection (data events), EKS audit log and runtime monitoring, Lambda network activity, RDS login activity, and Malware Protection for EC2 (scans EBS volumes) and for S3 uploads.
Finding names reveal the cause, such as UnauthorizedAccess:EC2/SSHBruteForce or UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The second one means credentials from an instance role were used from outside the instance.
GuardDuty supports trusted IP lists and threat lists. Suppression rules hide known-benign findings but do not stop detection.
Multi-account setup
Use AWS Organizations. The management account designates a delegated administrator account (a member account, often the security account) for GuardDuty, Security Hub, Macie and Inspector. Turn on auto-enable for new member accounts. The administrator sees all findings and manages settings. Each service is regional, so repeat the setup in every Region you use, or use Security Hub cross-Region aggregation to see findings in one Region.
Security Hub
Security Hub collects findings in the AWS Security Finding Format (ASFF). It runs automated checks for standards such as AWS Foundational Security Best Practices, CIS and PCI DSS, using AWS Config in the background, so Config recording must be on. Use custom actions plus Amazon EventBridge rules to send chosen findings to Lambda, SNS or Systems Manager Automation for remediation.
Detective
Detective builds a behavior graph and helps answer “what else did this principal do?” after GuardDuty raises a finding. It does not generate findings itself.
Macie
Macie offers automated sensitive data discovery, which samples buckets continuously with little effort, and targeted discovery jobs that you run on chosen buckets. Findings are policy findings (for example a bucket made public) or sensitive data findings.
Exam traps
- Inspector scans for vulnerabilities; GuardDuty detects active threats. Do not swap them.
- Macie covers S3 only, not RDS or EBS.
- Detective investigates; it is not a detection service and does not replace GuardDuty.
- The delegated administrator is set per service and per Region, and it is not the management account.
- Security Hub needs AWS Config recording to evaluate its standard controls.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A company must build a single inventory of sensitive data in S3 buckets across all accounts in its organization, viewable in one place. What should it do?
Show answer
Answer: B.Amazon Macie discovers sensitive data in S3, and a delegated administrator account shows findings for all member accounts in one place.
2. A security engineer must find software vulnerabilities (CVEs) on running EC2 instances and container images. Which service fits?
Show answer
Answer: C.Amazon Inspector scans EC2, ECR images and Lambda functions for software vulnerabilities and network exposure. GuardDuty detects threats, not CVEs.
3. A team wants one place that aggregates findings from GuardDuty, Inspector and Macie and checks accounts against the AWS Foundational Security Best Practices standard. Which service is it?
Show answer
Answer: B.AWS Security Hub aggregates findings in the ASFF format and runs security standard checks.
4. Which data sources does GuardDuty analyze without you enabling or configuring any log collection?
Show answer
Answer: B.GuardDuty reads CloudTrail, VPC Flow Logs and DNS logs as independent streams. You do not need to turn those logs on yourself.