AWS Security Specialty key terms

A managed threat detection service that continuously analyzes CloudTrail, VPC Flow Log, and DNS logs, plus malware and EKS findings, using AWS threat intelligence and machine learning to raise prioritized security findings.

A member account designated through AWS Organizations to centrally enable, configure, and view GuardDuty findings for every account in the organization instead of configuring each account separately.

A service that aggregates findings from GuardDuty, Inspector, Macie, and other sources into a normalized format and scores accounts against security standards such as CIS and AWS Foundational Security Best Practices.

A managed investigation service that builds graphs of users, roles, IP addresses, and API activity from logs so analysts can quickly determine the scope and root cause of a suspected compromise.

A matching rule on an event bus that routes events, such as GuardDuty findings or Config changes, to targets like Lambda, SNS, or SSM Automation to trigger automated or human response.

A documented sequence of Systems Manager automation steps, such as snapshotting and isolating an EC2 instance, that can run manually or from an EventBridge rule to contain an incident consistently.

A written, repeatable procedure describing who does what during a specific security event, covering detection, containment, eradication, recovery, and post-incident review along with the AWS tools used.

A service that records API activity across AWS accounts, capturing who made each request, from where, when, and the result, with events delivered to S3 and optionally CloudWatch Logs.

A CloudTrail trail created in the management account that logs events for every member account in AWS Organizations into a central, tamper-resistant S3 bucket.

Records of accepted and rejected IP traffic through network interfaces, subnets, or VPCs, published to CloudWatch Logs or S3 for troubleshooting, anomaly detection, and forensic analysis.

A pattern applied to log events that increments a CloudWatch metric when matched, enabling alarms on events such as repeated console login failures or unauthorized API calls.

An interactive query service that runs standard SQL directly against data in S3, commonly used to search CloudTrail, VPC Flow Log, and load balancer logs without loading them into a database.

A stateful, allow-only virtual firewall attached to network interfaces that controls inbound and outbound traffic by protocol, port, and source or destination CIDR or security group.

A stateless, ordered set of allow and deny rules applied at the subnet boundary, evaluated separately for inbound and outbound traffic and operating independently of security groups.

A web application firewall that inspects HTTP and HTTPS requests against managed or custom rules, such as IP reputation lists, rate limits, and injection patterns, before traffic reaches CloudFront, an ALB, or API Gateway.

A paid AWS service providing enhanced DDoS protection, 24/7 access to the AWS response team, cost protection for scaling during attacks, and tighter integration with AWS WAF.

A managed stateful firewall for VPCs offering intrusion prevention, domain-based filtering, and Suricata-compatible rules, deployed through firewall endpoints in dedicated subnets.

A private connection from a VPC to a supported AWS or third-party service that keeps traffic off the public internet; gateway endpoints serve S3 and DynamoDB, while interface endpoints use elastic network interfaces.

A capability that provides shell access to EC2 instances and on-premises servers through the SSM agent without inbound ports, bastion hosts, or SSH keys, with sessions optionally logged to S3 or CloudWatch.

A JSON policy attached to an IAM user, group, or role that grants or denies permissions on AWS resources; it defines what the principal can do but not which principals may use it.

A policy attached directly to a resource, such as an S3 bucket policy, KMS key policy, or SQS queue policy, that specifies which principals may access it and under what conditions.

A resource-based policy attached to an IAM role that lists which principals, such as users, roles, or federated identities, are allowed to assume that role and under which conditions.

An advanced IAM feature that sets the maximum permissions an identity-based policy can grant to a user or role, limiting privilege escalation even when broader policies are attached.

An AWS Organizations policy that sets the maximum available permissions for accounts in an organizational unit or the whole organization; it filters what IAM can grant but grants nothing itself.

A tool that identifies resources such as buckets, roles, and KMS keys shared with external entities, validates policies against best practices, and generates least-privilege policies from recorded activity.

A Security Token Service API call that returns temporary credentials for an IAM role, widely used for cross-account access, federation, and replacing long-term access keys.

A service for centrally managing workforce identities and single sign-on to AWS accounts and applications, using a built-in directory or SAML and OIDC federation, and issuing short-lived credentials via permission sets.

The primary resource-based policy that determines who may use or administer a KMS key; unlike other policies, no IAM principal has access unless this key policy enables it.

A scheme in which a data key encrypts the data and a KMS key encrypts the data key; the encrypted data key is stored with the ciphertext so decryption needs only one KMS call.

Server-side encryption for services such as S3, EBS, and CloudWatch Logs where AWS encrypts data with keys held in KMS, giving separate key permissions and an audit trail of key usage.

A set of account-level and bucket-level settings that override bucket policies and ACLs to reject public access, blocking new public policies and any cross-account public sharing.

A managed data security service that uses pattern matching and machine learning to discover and classify sensitive data such as credentials and personal information in S3, and to flag publicly accessible buckets.

A service for storing, retrieving, and automatically rotating secrets such as database credentials and API keys, with fine-grained IAM access control and encryption through KMS.

The division of security duties between AWS, responsible for security of the cloud including physical and managed service infrastructure, and customers, responsible for security in the cloud such as data, identity, and configuration.

A self-service portal providing AWS compliance reports, certifications, and third-party audit documents, plus the ability to review and accept agreements such as the BAA or NDA for an organization.

A service for centrally managing many AWS accounts, grouping them into organizational units, applying service control policies, consolidating billing, and enabling centralized security services.

A service that sets up and governs a multi-account AWS environment using a landing zone, with guardrails implemented through Organizations, AWS Config, and IAM, plus a dashboard for detecting compliance drift.

A collection of AWS Config rules and remediation actions packaged as YAML templates and deployable across accounts to continuously evaluate resources against a chosen compliance framework.