Finding threats and misconfiguration on AWS: GuardDuty, Macie, CloudTrail, Config / Inspector and Security Hub.
AWS CloudTrail records every API call made within an AWS account — from console clicks to SDK invocations to internal service-to-service calls. It is the…
AWS Config continuously records the configuration of your AWS resources, evaluates them against rules, and emits a timestamped change history per resource…
AWS Security Hub is the central security-posture service for AWS accounts. It aggregates findings from native services (GuardDuty, Inspector, Macie, Config…
Amazon GuardDuty is AWS's managed threat detection service. It continuously analyses VPC Flow Logs, DNS query logs, CloudTrail management events, EKS audit
Amazon Macie is a managed sensitive-data discovery service for Amazon S3. It uses ML and pattern matching to find PII, PHI, financial data, and credentials…
Detection on AWS answers three questions: what happened, is the current configuration safe, and is something malicious happening now. CloudTrail is the record of what happened: every API call, who made it, from where and with what result. AWS Config records what resources look like over time and evaluates them against rules, while Inspector scans EC2 instances, container images and Lambda functions for known vulnerabilities. GuardDuty analyses CloudTrail, VPC Flow Logs, DNS logs and other sources for threats such as credential misuse, crypto-mining or communication with known malicious hosts. Macie inspects S3 contents for sensitive data. Security Hub pulls all of these findings into one place and scores accounts against standards such as the CIS AWS Foundations Benchmark.
The sources in the top row produce raw evidence; the detectors in the middle turn it into findings; Security Hub and EventBridge make findings actionable. In a multi-account organisation, each service is enabled organisation-wide with a delegated administrator account, CloudTrail writes an organisation trail to a locked-down log-archive bucket, and findings flow to a central security account.
| Service | Answers | Page |
|---|---|---|
| CloudTrail | Who did what, when, from where? | AWS CloudTrail |
| Config and Inspector | Is this resource configured safely? Is it vulnerable? | AWS Config and Inspector |
| GuardDuty | Is there active threat behaviour? | Amazon GuardDuty |
| Macie | Where is sensitive data stored in S3? | Amazon Macie |
| Security Hub | What is my overall posture and what should I fix first? | AWS Security Hub |
A sensible order for a new account is CloudTrail first (nothing else can be investigated without it), then GuardDuty and Config, then Security Hub to aggregate, then Inspector and Macie where workloads and data justify the cost. See the wider AWS security section for identity and network controls.