What's changed: Service coverage: added a catalog section (s4) for developer tools and operations management (CI/CD, Grafana/Prometheus, Proton, Amplify/Device Farm)
3.3Improving Reliability and Security Posture
Understand hardening existing systems—Well-Architected, fault isolation, GuardDuty/Security Hub/Config, WAF/Shield, and automated remediation. Continuously raise threat detection and compliance.
Hardening is continuous: detect threats, assess configuration compliance, and auto-remediate drift.
3.3.1Continuous security and reliability
- GuardDuty: ML analysis of logs to detect threats and anomalous activity.
- Config: evaluate resource configuration against rules, detecting and recording compliance drift.
- Security Hub: aggregate and score findings across services to visualize posture.
- WAF/Shield: WAF blocks malicious L7 HTTP, Shield provides DDoS protection.
- Auto-remediation: detect → EventBridge → Lambda/SSM Automation to fix drift automatically.
Common on SAP-C02: threat detection = GuardDuty, config compliance/drift = AWS Config, central finding aggregation = Security Hub, L7 attack blocking = WAF, DDoS = Shield, design review framework = Well-Architected. Auto-remediating Config rule violations via EventBridge + Lambda is a classic pattern.
Roles differ: GuardDuty = detection, WAF/Shield = protection, Config = compliance evaluation. Don’t conflate them. Detection alone doesn’t protect—pair it with remediation and protective services.
SAP-C02 security questions hinge on identifying which layer—detect, evaluate, aggregate, protect, remediate—is in play. GuardDuty ingests VPC flow logs, DNS logs, and CloudTrail, using ML and threat intel to detect compromise signs (C2 traffic, anomalous API use). AWS Config continuously records resources as configuration items, evaluates compliance via managed rules or Lambda custom rules, and can attach remediation actions (SSM Automation documents) on drift. Security Hub aggregates findings from GuardDuty, Inspector, Macie, Config, etc. in ASFF format and scores against CIS and the AWS Foundational Security Best Practices. Across an org, the standard pattern aggregates GuardDuty/Security Hub/Config in a delegated administrator account to manage member accounts centrally. The protective layer is WAF (managed rules / rate limiting / geo blocking) and Shield Advanced (advanced DDoS mitigation and DDoS cost protection), flowing detections into EventBridge → Lambda/SSM Automation for automated remediation. Finally, review against Well-Architected (six pillars) to keep the improvement loop running.
| Role | Service | Typical use |
|---|---|---|
| Threat detection | GuardDuty | ML detection of compromise signs |
| Config compliance | AWS Config | Rule evaluation + auto-remediation |
| Finding aggregation | Security Hub | Cross-service aggregation, compliance score |
| App protection | WAF / Shield | L7 blocking, DDoS mitigation |
Scenario: In a multi-account org, forbid "unencrypted/public S3 buckets" everywhere and auto-fix violations. → Deploy AWS Config managed rules (e.g., s3-bucket-server-side-encryption-enabled) org-wide, and on violation run an SSM Automation remediation action to enable encryption. Aggregate findings in Security Hub and monitor across accounts from the delegated administrator.
FAQ: GuardDuty vs Inspector vs Macie? GuardDuty does threat detection (suspicious behavior), Inspector does vulnerability scanning of EC2/containers/Lambda, and Macie does sensitive-data discovery (PII, etc.) in S3. All can feed findings into Security Hub.
Exam trap: Choosing WAF *alone* for "DDoS protection" can be insufficient. Large volumetric L3/L4 DDoS calls for Shield (Advanced), while WAF handles L7 request rules. They are complementary—identify the attack layer in the question.
3.3.2Section summary
- Detect = GuardDuty / evaluate = Config / aggregate = Security Hub
- Protect = WAF (L7)/Shield (DDoS) / remediate = EventBridge → Lambda/SSM
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want continuous ML-based detection of suspicious API usage or compromise signs from logs. What?
Q2. You want to continuously evaluate whether resource configs comply with rules (e.g., S3 must be encrypted) and detect drift. What?
Q3. You want to block SQL injection and malicious L7 HTTP requests to a web app. What?