AWS Security Services

Amazon Web Services · Cloud and Network Security

Native security, identity and monitoring services for workloads running on AWS.

Draft summary. This page summarises what the vendor's product family is generally known for. Each claim is pending confirmation against vendor documentation.

Overview

AWS offers a set of security services that work inside its platform: identity and access management, threat detection, web application and DDoS protection, vulnerability scanning, data discovery and encryption key management. Findings can be collected in one place and sent to a security team's own tools.

They suit organisations that run important workloads on AWS and want controls that are managed by the platform. The right mix depends on the accounts, regulations and existing tools involved.

Primary capability: Cloud-native identity, threat detection and protection for AWS workloads
Deployment models: SaaSPending vendor confirmation
Management effort: ModeratePending vendor confirmation

Customer challenges and business value

Misconfiguration outpaces review
New resources appear daily, and one permissive rule or public storage bucket can expose data to the internet.
Too many accounts to watch
Large organisations run many AWS accounts, each with its own settings and logs.
Shared responsibility is unclear
The provider secures the platform, but customers are responsible for their own configuration, identities and data.

What this helps you achieve

Controls built into the platform where workloads run
One view of findings across many accounts
Evidence for audits and compliance reviews

Key capabilities

Identity and access management with least-privilege toolingPending vendor confirmation
Threat detection from logs, network and workload activityPending vendor confirmation
Web application firewall and DDoS protectionPending vendor confirmation
Vulnerability scanning of workloads and container imagesPending vendor confirmation
Sensitive data discovery and encryption key managementPending vendor confirmation
Central security findings and compliance checks across accountsPending vendor confirmation

Technical architecture and deployment

Where the product sits in a typical security architecture, and what it connects to.

Data sources

AWS accounts
Cloud workloads
Logs and network activity

This product

AWS security services

Outputs and actions

Security findings
SIEM / SOAR
Compliance reports

Generic placement for this category. Actual data sources and integrations depend on the product and your environment.

Integration ecosystem

Categories of systems this type of product commonly connects to. Specific connectors and versions are confirmed with the vendor.

AWS accounts and organisationsPending vendor confirmation
SIEM and SOAR platformsPending vendor confirmation
Third-party endpoint and network securityPending vendor confirmation
Infrastructure-as-code pipelinesPending vendor confirmation

Common use cases

Detecting suspicious activity in AWS accounts
Finding exposed storage and risky permissions
Protecting public web applications from attack
Preparing compliance evidence for cloud workloads

Frequently asked questions

Which AWS security services do we need?

That depends on the workloads and regulations involved. We map the services to your accounts and to the tools you already run.

Where does the information on this page come from?

This page is a draft summary of what the vendor's product family is generally known for. Capabilities, deployment models and integrations are marked as pending until they are checked against vendor documentation. Ask us for a confirmed scope for your environment.