2.3 AWS Security Services

AWS Certified Cloud Practitioner CLF-C02

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips

2 Domain 1: Cloud Concepts (24%)

1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics

3 Domain 2: Security and Compliance (30%)

2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security

4 Domain 3: Cloud Technology and Services (34%)

3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services

5 Domain 4: Billing, Pricing, and Support (12%)

4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services

6 AWS Services Deep Dive

5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions

2.3 AWS Security Services

Key Takeaways Explain This Topic AI

AWS Shield provides DDoS protection: Standard is free and automatic for all customers; Advanced is paid and adds a 24/7 response team and cost protection.

AWS WAF protects web apps from exploits like SQL injection and XSS; Amazon GuardDuty uses ML to detect malicious activity from CloudTrail, VPC Flow, and DNS logs.

Amazon Inspector scans EC2, container images, and Lambda for vulnerabilities; Amazon Macie discovers and protects sensitive data (PII) in S3.

AWS CloudTrail logs API calls (who/what/when/where) for auditing; AWS Config tracks resource configuration and compliance — do not confuse them.

AWS Security Hub brings findings from GuardDuty, Inspector, Macie, and others into a single security view; its findings-aggregation and best-practice-check features are now called AWS Security Hub CSPM.

Last updated: October 2026

AWS provides a comprehensive suite of security services that protect workloads at every layer. For the CLF-C02, you need to know what each service does and when to use it — not how to configure it.

• Network and Application Protection
• AWS Shield — DDoS Protection

AWS Shield protects against Distributed Denial of Service (DDoS) attacks.

• Feature Shield Standard Shield Advanced
• Cost Free (automatic) $3,000/month + data transfer
• Protection Common network/transport-layer attacks Sophisticated, large-scale attacks
• Coverage All AWS customers, automatic Enabled per resource
• DDoS Response Team No Yes (24/7 AWS Shield Response Team)
• Cost Protection No Yes (credits for DDoS-related scaling)
• Integrations CloudFront, Route 53, ELB + EC2, Global Accelerator

On the Exam: DDoS protection → AWS Shield. If the question mentions cost protection during an attack or a 24/7 response team , it is Shield Advanced .

AWS WAF — Web Application Firewall

AWS WAF protects web applications from common exploits and bots using rules that control which traffic reaches your application.

Protects against: SQL injection, cross-site scripting (XSS), geo-based threats (geo-blocking), request floods (rate limiting), and unwanted bots.

Can be deployed on: Amazon CloudFront, Application Load Balancer (ALB), Amazon API Gateway, and AWS AppSync.

AWS Firewall Manager

AWS Firewall Manager centrally administers firewall rules across multiple accounts in an AWS Organization. It works with WAF, Shield Advanced, Security Groups, and AWS Network Firewall.

• Threat Detection and Monitoring
• Amazon GuardDuty — Intelligent Threat Detection

Amazon GuardDuty continuously monitors for malicious activity and unauthorized behavior. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs using machine learning, anomaly detection, and threat intelligence to detect threats like cryptomining, unauthorized access, and compromised instances. It produces findings with severity levels and requires no infrastructure to manage — enable it with one click.

Amazon Inspector — Vulnerability Assessment

Amazon Inspector automatically scans workloads for software vulnerabilities and unintended network exposure across EC2 instances , container images in Amazon ECR , and Lambda functions . It assigns a risk score to each finding using CVSS plus context like network reachability.

Amazon Detective — Security Investigation

Amazon Detective helps analyze and investigate the root cause of security findings. It automatically collects log data and uses machine learning to build a linked dataset for investigation. Use it when you have a GuardDuty finding and need to understand the full scope of a compromise.

• Logging and Auditing
• AWS CloudTrail — API Logging

AWS CloudTrail records API calls made in your account — a security camera for AWS activity.

• Detail Information Captured
• Who The IAM identity that made the call
• What The API action (e.g., RunInstances, DeleteBucket)
• When Date and time
• Where Source IP address
• Which The resources involved

Management events are recorded by default with 90 days of viewable history; create a trail to store events in S3 for long-term retention and integrate with CloudWatch Logs.

On the Exam: "Which service records API activity / who made a change?" → AWS CloudTrail . "Which service tracks resource configuration over time / compliance?" → AWS Config .

Amazon CloudWatch — Monitoring

While primarily a monitoring service, CloudWatch has security uses: alarms on unusual activity (e.g., a spike in failed logins), centralized log search via CloudWatch Logs, and automated responses via EventBridge.

• Data Protection
• AWS KMS

AWS Key Management Service (KMS) creates and manages encryption keys used across AWS services. It supports customer managed keys and AWS managed keys, integrates with S3, EBS, RDS, and more, supports automatic key rotation, and logs all key usage in CloudTrail.

AWS Certificate Manager (ACM)

ACM provisions, manages, and deploys free public SSL/TLS certificates for use with CloudFront, ELB, and API Gateway, with automatic renewal.

Amazon Macie

Amazon Macie uses machine learning to discover, classify, and protect sensitive data in S3 — such as PII, credit card numbers, and Social Security numbers.

AWS Secrets Manager

AWS Secrets Manager protects secrets (passwords, API keys, database credentials) and can automatically rotate them on a schedule.

Security Hub

AWS Security Hub provides a centralized view of your security posture, aggregating findings from GuardDuty, Inspector, Macie, Firewall Manager, and others into one dashboard, with automated checks against standards like CIS and PCI DSS and cross-account visibility through AWS Organizations. AWS has since split the service: these findings-aggregation and best-practice-check features are now called AWS Security Hub CSPM , and the newer AWS Security Hub correlates signals from GuardDuty, Inspector, Macie, and Security Hub CSPM. The online CLF-C02 in-scope list still names it AWS Security Hub.

Quick Reference: Which Service for Which Scenario?

• Scenario Service
• DDoS protection AWS Shield
• Block SQL injection / XSS AWS WAF
• Detect cryptomining on EC2 Amazon GuardDuty
• Find vulnerabilities in EC2 / containers Amazon Inspector
• Track who deleted an S3 bucket AWS CloudTrail
• Discover PII in S3 Amazon Macie
• Manage encryption keys AWS KMS
• Free SSL/TLS certificates AWS Certificate Manager
• Centralized view of all findings AWS Security Hub
• Investigate a security incident Amazon Detective
• Manage firewall rules across accounts AWS Firewall Manager
• Store and rotate database passwords AWS Secrets Manager