AWS for DevOps — Security Best Practices

Chapter 13 — Security Best Practices

Security in AWS is not a one-time setup — it’s a continuous process. This chapter covers the security services that help you detect threats, audit configurations, manage encryption, and automate security responses.

What You Will Learn

Section	Topic	Key Concept
13.1	GuardDuty	Threat detection
13.2	Security Hub	Centralized security findings
13.3	IAM Access Analyzer	Find overly permissive access
13.4	KMS Encryption	Encryption key management
13.5	Security Automation	Auto-remediation of issues
13.6	Practice Exercises	Hands-on labs

The Security Layers

  ┌─────────────────────────────────────────────────┐
  │                  Detection                       │
  │  ┌───────────┐  ┌──────────────┐  ┌───────────┐│
  │  │ GuardDuty │  │ Security Hub │  │CloudTrail ││
  │  │ (threats) │  │ (findings)   │  │ (audit)   ││
  │  └─────┬─────┘  └──────┬───────┘  └─────┬─────┘│
  │        └───────────────┼─────────────────┘      │
  │                        ▼                         │
  │               ┌──────────────┐                   │
  │               │ EventBridge  │                   │
  │               └──────┬───────┘                   │
  │                      ▼                           │
  │  ┌─────────────────────────────────────────────┐│
  │  │            Automated Response                ││
  │  │  Lambda → Block IP / Revoke key / Notify    ││
  │  └─────────────────────────────────────────────┘│
  │                                                  │
  │  ┌─────────────────────────────────────────────┐│
  │  │              Prevention                      ││
  │  │  IAM Policies │ KMS │ WAF │ Security Groups ││
  │  └─────────────────────────────────────────────┘│
  └─────────────────────────────────────────────────┘

Security Service Comparison

Service	Purpose	Scope
GuardDuty	Threat detection (ML-based)	VPC flow logs, DNS, CloudTrail
Security Hub	Aggregate findings from all services	Account-wide dashboard
IAM Access Analyzer	Find public/cross-account access	IAM, S3, Lambda, KMS, SQS
AWS Config	Configuration compliance	Resource configurations
CloudTrail	API audit log	Every API call
KMS	Encryption key management	Data at rest and in transit

---

Next → GuardDuty