Services to prevent Attacks before they occur
AWS provides several security services that work together, but they focus on different problems. GuardDuty is about detecting active threats, Inspector is about finding vulnerabilities before they’re exploited, and Macie is about discovering and protecting sensitive data—especially in Amazon S3. Let’s delve a bit deeper into each service and it’s use cases!
Amazon GaurdDuty
Amazon GuardDuty is a managed threat-detection service that uses machine learning, anomaly detection, and threat intelligence to identify suspicious activity in your AWS environment. It can detect things like unauthorized access attempts, calls from known malicious IP addresses, and unusual network behavior. GuardDuty can also detect indicators of cryptocurrency mining.
GuardDuty analyzes data from sources such as VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. When it generates a finding, the finding can be routed through Amazon EventBridge to trigger automated responses (for example, invoking an AWS Lambda function), or it can be sent to Amazon SNS for notifications.
Amazon Inspector
Amazon Inspector can be used for EC2 instances to check for unauthorized network accessibility and analyze the running OS against known vulnerabilities. Amazon Inspector is for checking before there is malicious attack. It’s essentially a service that would “check if the doors are locked every time you leave your home” metaphorically speaking. Lambda function code and packages are also able to be inspected for vulnerabilities… It can even show the file path and the line that the vulnerability or error is showing. Afterwards it sends it’s findings to the AWS Security hub or it can send the findings to Event Bridge. Remember that Amazon Inspector is only for your running EC2 instances, container images and lambda functions it will scan for vulnerabilities only when needed. When there are updates inspector will automatically run an inspection. Amazon Inspector is a service that will find the weaknesses in your setup and help you to prevent vulnerabilities for your EC2 instances, lambda functions and more.
Amazon Macie
Amazon Macie uses machine learning and pattern matching to help protect your data in AWS. Macie will alert you about sensitive data vulnerabilities such as personally identifiable information (PII) that can be found in S3 buckets. Amazon Macie finds out what the sensitive data is in the bucket and then notifies you about it through Event Bridge and then you can integrations with SNS or Lambda functions. So when Amazon Macie comes to mind you should think: automation and discovering personal data on S3 buckets.
Thanks
I hope you found this article useful and I wish you the best of luck on your exam or whatever endeavor you are working towards.