Security Monitoring

Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail logs, VPC Flow Logs, DNS logs, and EKS audit logs.

GuardDuty requires no infrastructure to manage. Enable it in your account, and it immediately begins analyzing events. Findings are categorized by severity and type.

Finding Types:

• Reconnaissance: IAM User permissions-reconnaissance, unusual API calls, port scanning
• Behavior: Unusual data retrieval patterns, cryptocurrency mining, credential exfiltration
• Unauthorized Access: Unauthorized access from a known malicious IP, compromised EC2 instance
• Malware: Malicious file detected on an EC2 instance or S3 bucket

For example, GuardDuty detects an EC2 instance communicating with a known cryptocurrency mining command-and-control server. It generates a finding with severity score and affected resource details. Security Hub aggregates this finding with other services for unified visibility.

GuardDuty Integration with EventBridge enables automated responses. When a high-severity finding is detected, trigger a Lambda function to isolate the affected EC2 instance by modifying its security group, or rotate credentials for a compromised IAM user.

Cost Optimization: GuardDuty charges per event analyzed. Use CloudWatch Logs to monitor GuardDuty cost, and consider excluding accounts or regions with no sensitive workloads. For organizations, enable GuardDuty at the organization level to manage costs centrally.

AWS Security Hub provides a centralized view of security findings across AWS accounts and services. It aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, and third-party tools.

Security Standards define compliance frameworks with specific controls. Security Hub supports:

• AWS Foundational Security Best Practices: 50+ controls covering common security issues
• CIS AWS Foundations Benchmark: Industry-standard security configuration
• PCI DSS v3.2.1: Payment card industry compliance
• NIST SP 800-53: Federal information security standards

Each standard contains controls with pass/fail status. For example, the control S3.1 checks whether S3 buckets have public access disabled. Failed controls generate findings that appear in Security Hub.

Compliance Score provides an overall security posture percentage. Track this score over time to measure improvement. A score below 50% indicates critical security gaps.

Custom Insights group findings by attributes you define. Create an insight for all critical findings in the production account, or all findings related to a specific resource type.

Automated Response uses EventBridge rules triggered by Security Hub findings. For example, when a critical finding is detected, automatically create a ticket in your ticketing system, notify the security team via SNS, and remediate the issue using Systems Manager Automation runbooks.

Security Hub is the recommended central point for security monitoring in AWS.

AWS CloudTrail logs API calls made in your AWS account. It is the foundation of security monitoring and compliance auditing.

Trail Configuration determines what CloudTrail logs. Create a trail to log all management events (IAM, EC2, S3 API calls) across all regions. Store logs in S3 for long-term retention and analysis.

Management Events capture control-plane operations: creating instances, modifying security groups, changing IAM policies. These are the most important events for security auditing.

Data Events capture data-plane operations: S3 object-level operations, Lambda function invocations. Enable data events only for specific resources, as they generate high volume. For example, enable data events only for a sensitive S3 bucket, not all buckets.

Log File Validation uses digest files to verify CloudTrail log integrity. Enable log file validation to detect tampering. Digest files contain hashes of the log files; any modification to the logs invalidates the hash.

Organization Trails aggregate logs from all accounts in an AWS Organization to a central S3 bucket. This provides a single location for all account activity, simplifying compliance auditing and forensic analysis.

CloudWatch Logs Integration streams CloudTrail logs to CloudWatch for real-time monitoring. Create metric filters for specific events (e.g., root login attempts) and CloudWatch alarms that notify when thresholds are exceeded.

For example, create a filter for errorCode: AccessDenied events and alarm when the count exceeds 100 in 5 minutes, indicating potential unauthorized access attempts.

The real power of AWS security monitoring comes from integrating multiple services into a cohesive defense-in-depth strategy.

Event-Driven Architecture connects security services through EventBridge:

1. GuardDuty detects a threat -> EventBridge rule -> Lambda function isolates EC2 instance
2. Security Hub finds a failed control -> EventBridge rule -> SNS notification to security team
3. CloudTrail detects root login -> EventBridge rule -> Systems Manager automation to investigate

AWS Config tracks resource configuration changes and evaluates them against rules. When an S3 bucket becomes public, Config detects the change and triggers a Config rule that automatically blocks public access.

Macie discovers and protects sensitive data in S3 (PII, financial data). Integrate Macie findings with Security Hub to monitor sensitive data exposure alongside other security threats.

Incident Response Workflow:

1. Detect: GuardDuty identifies suspicious activity
2. Investigate: Security Hub aggregates findings; CloudTrail provides API history
3. Respond: EventBridge triggers automated remediation
4. Recover: Restore from snapshots or rotate compromised credentials
5. Improve: Update Config rules and security policies to prevent recurrence

For a compromised EC2 instance: GuardDuty detects crypto-mining, EventBridge triggers a Lambda that modifies the instance security group to isolate it, SNS notifies the security team, and CloudTrail logs the remediation actions for audit.