Security, Identity, and Compliance
Grouped by job: identity, data protection, network/edge defense, threat detection, and compliance/audit. Most exam traps live in the “similar name, different job” gaps below.
Identity
| Service | Who it’s for | Key distinction |
|---|---|---|
| AWS Identity and Access Management (IAM) | People/workloads managing your account | Users, roles, policies; explicit deny wins |
| AWS IAM Identity Center | Employees across many accounts | Workforce SSO, temporary credentials |
| Amazon Cognito | Your application’s end customers | Sign-up/sign-in for apps |
| AWS Directory Service | AD-dependent workloads | Managed/proxied Microsoft AD |
Data protection
| Service | Job | Key distinction |
|---|---|---|
| AWS Key Management Service (KMS) | Encryption keys | Multi-tenant, integrated everywhere |
| AWS CloudHSM (Hardware Security Module) | Dedicated key hardware | Single-tenant; AWS can’t access keys |
| AWS Secrets Manager | Secrets with rotation | Auto-rotates DB credentials |
| AWS Certificate Manager (ACM) | TLS certificates | Free public certs, auto-renew (in transit) |
Network & edge defense
| Service | Layer | Key distinction |
|---|---|---|
| AWS WAF | L7 (HTTP) | Blocks SQLi/XSS on CloudFront/ALB/API GW |
| AWS Shield | L3/4 | DDoS; Standard is free for all |
| AWS Network Firewall | L3/4 (VPC-wide) | Stateful IPS for all VPC traffic |
| AWS Firewall Manager | Policy manager | Deploys the above across accounts |
Threat detection & investigation
| Service | Job | Key distinction |
|---|---|---|
| Amazon GuardDuty | Detect active threats | Reads logs for malicious behavior |
| Amazon Inspector | Find vulnerabilities | Scans workloads for CVEs/exposure |
| Amazon Detective | Investigate | Root-cause graph from a finding |
| Amazon Macie | Discover sensitive data | Finds PII in Amazon S3 |
| AWS Security Hub | Aggregate | Central dashboard of all findings |
Compliance & sharing
| Service | Job | Key distinction |
|---|---|---|
| AWS Artifact | AWS’s own audit reports | Security of the cloud (SOC/ISO/PCI) |
| AWS Audit Manager | Evidence for your audit | Maps your usage to frameworks |
| AWS Resource Access Manager (RAM) | Share resources across accounts | Shares the resource, not API permissions |
- GuardDuty (active threat) vs Inspector (potential weakness) vs Detective (investigate) vs Macie (sensitive data).
- KMS (managed, shared) vs CloudHSM (dedicated, exclusive custody).
- WAF (L7 content) vs Shield (L3/4 DDoS) vs Network Firewall (all VPC traffic).