AWS Security Specialty cheat sheet

GuardDuty ingests VPC Flow Logs, CloudTrail management and S3 data events, DNS query logs, and EKS audit logs; no agents or extra infrastructure are required.

GuardDuty finding severities are Low, Medium, High, and Critical; findings are retained for 90 days, after which they are archived and no longer updated.

Automate GuardDuty response with EventBridge rules targeting SSM Automation, Lambda, or Step Functions; Security Hub ingests the same findings in ASFF format.

Security Hub runs standards such as AWS Foundational Security Best Practices, CIS, and PCI DSS; each control yields a pass/fail finding that can be suppressed.

Amazon Detective builds behavior graphs from CloudTrail, VPC Flow Logs, GuardDuty, and EKS audit logs, retaining up to one year of data for investigation.

Contain a compromised EC2 instance by replacing its security groups with an isolation group that has no rules, or by detaching the ENI; snapshot EBS volumes before termination for forensics.

GuardDuty Malware Protection for EC2 scans attached EBS volumes and snapshots without an agent; runtime monitoring additionally requires the GuardDuty security agent.

CloudTrail log file integrity validation uses SHA-256 hashes per log file plus an RSA-signed digest file, so tampering after delivery is detectable.

Capture instance metadata and disk or memory evidence before shutdown, because stopping or terminating an instance can destroy volatile evidence.

CloudTrail logs management events when a trail exists; S3 object-level and Lambda Invoke data events must be enabled explicitly and incur additional charges.

CloudTrail delivers to an S3 bucket by default; to alarm on API activity, also send the trail to CloudWatch Logs and create a metric filter plus alarm.

VPC Flow Logs are captured at the ENI, subnet, or VPC level, delivered to CloudWatch Logs or S3, and record metadata only; fields include srcaddr, dstaddr, srcport, dstport, protocol, packets, bytes, action, and log-status.

The default flow log aggregation interval is 10 minutes; a 1-minute interval is available for near-real-time traffic analysis.

An organization trail created in the management account logs all member accounts and cannot be modified or deleted by member accounts.

AWS Config records resource configuration history and evaluates rules; use conformance packs for bundled compliance checks and SSM Automation documents for remediation.

CloudWatch Logs subscription filters stream matching log events to Lambda, Kinesis Data Streams, or Kinesis Firehose for real-time detection.

Common security log sources: CloudTrail for API activity, VPC Flow Logs for network metadata, Route 53 Resolver query logs for DNS, S3 server access logs, and ELB access logs.

Security groups are stateful and allow-only, evaluating all rules before deciding; network ACLs are stateless, evaluated in ascending rule-number order with first match winning.

AWS WAF operates at Layer 7 and attaches to CloudFront, ALB, API Gateway, AppSync, and App Runner; rule types include managed groups, rate-based, IP set, geo match, and regex.

Shield Standard is automatic and free for all accounts; Shield Advanced adds DDoS cost protection, SRT access, and near-real-time attack visibility.

AWS Network Firewall provides stateful inspection with Suricata-compatible rules and domain-based egress filtering inside a VPC.

Gateway VPC endpoints for S3 and DynamoDB use route table entries; interface endpoints use PrivateLink ENIs and support security groups and endpoint policies.

IMDSv2 requires a PUT request to obtain a session token; enforce it with metadata options http-tokens=required and http-put-response-hop-limit=1.

Session Manager needs no inbound ports, bastion hosts, or SSH keys; access is governed by IAM, and sessions can be logged to S3 or CloudWatch Logs.

Amazon Inspector scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and unintended network exposure.

VPC peering does not support transitive routing; Transit Gateway provides hub-and-spoke connectivity with route-table segmentation.

Policy evaluation order: explicit deny overrides everything, then SCP, resource-based policy, permissions boundary, identity-based policy, and session policy; every applicable layer must allow the action.

SCPs apply to member accounts but not the management account and never affect service-linked roles; they filter permissions rather than grant them.

A permissions boundary caps the maximum permissions of a user or role but grants nothing; effective permissions are the intersection with identity policies.

Cross-account access requires a trust policy in the target account naming the source principal and an identity policy in the source account allowing sts:AssumeRole.

IAM Access Analyzer flags resources shared outside the account or organization zone of trust and produces unused-permission and policy-validation findings.

ABAC conditions on aws:PrincipalTag and aws:ResourceTag so one policy covers many resources; Organizations tag policies standardize tag keys and values.

Federation options: SAML 2.0 for enterprise IdPs, OIDC/Web Identity for social and Kubernetes workloads, and IAM Identity Center for workforce SSO with permission sets.

Require MFA using the condition aws:MultiFactorAuthPresent; FIDO security keys and TOTP virtual devices are supported, while SMS is not recommended.

Every KMS key requires a key policy; IAM policies alone cannot grant key usage unless the key policy delegates to IAM or names the principal explicitly.

Envelope encryption: GenerateDataKey returns a plaintext data key and an encrypted copy; encrypt data locally, store the encrypted key, then discard the plaintext key.

S3 encryption options: SSE-S3 (AES-256, AWS-managed keys), SSE-KMS (auditable, supports bucket keys), SSE-C (customer-provided key, not stored), DSSE-KMS, and client-side encryption.

S3 Block Public Access has four settings at bucket and account level; account-level settings override bucket policies that would grant public access.

Macie discovers sensitive data in S3 using machine learning and pattern matching, publishing findings to EventBridge and Security Hub; it does not encrypt or block access.

RDS encryption must be enabled at creation; encrypt existing data by snapshotting, copying the snapshot with encryption, then restoring a new instance.

Default EBS encryption can be enabled per Region; snapshots of encrypted volumes stay encrypted, and sharing them requires KMS key permissions.

Secrets Manager supports scheduled rotation through a Lambda rotation function; SSM Parameter Store SecureString is KMS-encrypted but has no built-in rotation.

AWS Backup Vault Lock enforces WORM retention, and cross-Region plus cross-account copies support disaster recovery and ransomware resilience.

AWS Organizations provides consolidated billing, SCPs, tag policies, backup policies, and AI services opt-out policies across member accounts.

Control Tower implements preventive guardrails as SCPs and detective guardrails as AWS Config rules; controls are categorized as mandatory, strongly recommended, or elective.

AWS Config aggregators consolidate configuration and compliance data across accounts and Regions; organization aggregators require a delegated administrator account.

A Security Hub delegated administrator enables standards and aggregates findings organization-wide; central configuration manages standards and controls across accounts.

CloudTrail Lake stores immutable events for up to ten years and supports SQL-based queries without building an external analytics pipeline.

AWS Audit Manager automates evidence collection against frameworks such as PCI DSS, SOC 2, and ISO 27001, and supports custom frameworks.

Trusted Advisor covers cost optimization, performance, security, fault tolerance, and service quotas; full checks and API access require Business or Enterprise Support.

AWS Artifact provides on-demand compliance reports such as SOC and ISO and manages agreements including the Business Associate Addendum.

The Well-Architected Tool reviews workloads against six pillars, and its security pillar spans IAM, detection, infrastructure protection, data protection, and incident response.