Domain 2 of 4 · Chapter 4 of 4

Security Components & Resources

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing AWS Certified Cloud Practitioner premium course — no separate purchase.

Included in this chapter:

  • Network protection: AWS WAF, AWS Shield, Firewall Manager
  • Threat detection and security recommendations: GuardDuty and Trusted Advisor
  • Third-party products and where to find security information

Network and account protection services by job

Security needServiceWhat it does
Filter web requests (layer 7)AWS WAFAllow, block, or count HTTP requests; managed rules stop SQL injection, XSS, and bad bots
DDoS protection (layer 3/4)AWS Shield StandardAutomatic, free protection against network and transport-layer floods for all customers
Advanced DDoS + supportAWS Shield AdvancedPaid: layer-7 DDoS mitigation, cost protection, and 24/7 Shield Response Team access
Enforce rules across accountsAWS Firewall ManagerCentrally apply WAF, Shield Advanced, and security-group policies across an AWS Organization
Detect threats and alertAmazon GuardDutyAgentless, continuous threat detection from CloudTrail, VPC Flow Logs, and DNS logs
Recommend best-practice fixesAWS Trusted AdvisorChecks the account for security misconfigurations and reports recommendations

Decision tree

Which protection do you need? match the threat to the service Stop incoming attack traffic? Detect, or enforce across accounts? Block traffic now Detect / govern Web exploit, or volumetric DDoS? Layer-7 web exploit AWS WAF block SQL injection, XSS, bad bots DDoS flood (L3/4) AWS Shield Standard free; Advanced adds L7 + SRT Continuously detect threats Amazon GuardDuty agentless detection, alerts not blocks Enforce across an Organization AWS Firewall Manager one WAF/Shield policy, all accounts Need a tool AWS does not offer natively (firewall, antivirus, IDS)? Buy it on AWS Marketplace, billed through your AWS account.
Cheat sheet

Cheat sheet

  • AWS WAF filters layer-7 web requests by your rules
  • WAF attaches to public-facing entry points like CloudFront and ALB
  • WAF managed rule groups stop SQL injection and XSS
  • Shield Standard is automatic and free for every AWS customer
  • Shield Advanced adds L7 DDoS mitigation, cost protection, and the SRT
  • Shield Advanced costs $3,000/month per payer account
  • WAF handles web exploits; Shield handles DDoS floods
  • Firewall Manager enforces one security policy across an Organization
  • Firewall Manager requires AWS Organizations
  • GuardDuty is agentless threat detection you just switch on
  • GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs
  • GuardDuty detects and alerts but does not block traffic
  • Trusted Advisor security checks flag common risks but won't fix them
  • Full Trusted Advisor checks need Business or Enterprise Support
  • AWS Marketplace sells third-party security software billed on your AWS bill
  • Find AWS security guidance in the blog, security center, and Knowledge Center
  • Amazon Inspector scans workloads for vulnerabilities, it is not a firewall
  • Security groups are stateful, instance-level, allow-only firewalls
  • Network ACLs are stateless, subnet-level filters with deny rules

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html
  2. https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html
  3. https://docs.aws.amazon.com/waf/latest/developerguide/waf-managed-rule-groups.html
  4. https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html
  5. https://aws.amazon.com/shield/faqs/
  6. https://aws.amazon.com/shield/pricing/
  7. https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html
  8. https://docs.aws.amazon.com/waf/latest/developerguide/fms-prereq.html
  9. https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html
  10. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html
  11. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html
  12. https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html
  13. https://aws.amazon.com/premiumsupport/technology/trusted-advisor/
  14. https://aws.amazon.com/marketplace/
  15. https://aws.amazon.com/blogs/security/
  16. https://aws.amazon.com/security/
  17. https://aws.amazon.com/premiumsupport/knowledge-center/