CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Amazon GuardDuty, Inspector & Detective — Security services for threat detection and compliance
These services provide essential threat detection, vulnerability management, and investigation capabilities within AWS environments.
What it is
- Amazon GuardDuty: A threat detection service that continuously monitors for malicious activity and unauthorized behavior.
- Amazon Inspector: An automated security assessment service to improve the security and compliance of applications deployed on AWS.
- Amazon Detective: A service that helps analyze, investigate, and quickly identify the root cause of security findings.
When I reach for it
- GuardDuty: When you need continuous threat detection and want to monitor AWS accounts and workloads.
- Inspector: When you need to assess application security and compliance against best practices and standards.
- Detective: When you require in-depth investigation capabilities to understand security incidents.
Key architectural decisions
- Integrate GuardDuty with CloudTrail and VPC flow logs for comprehensive monitoring.
- Schedule regular assessments with Inspector to ensure ongoing compliance and vulnerability management.
- Use Detective to correlate findings from GuardDuty and Inspector for a holistic view of security incidents.
Gotchas & exam traps
- Remember that GuardDuty is region-specific; findings are not shared across regions.
- Inspector requires an assessment template; ensure it’s configured correctly to get actionable results.
- Detective only works with GuardDuty findings; ensure you understand the data flow between them.
The architect view
- Leverage these services together for a robust security posture; GuardDuty for detection, Inspector for assessment, and Detective for investigation. Automate responses where possible to enhance security efficiency.