# AWS Security Services

AWS provides a **wide range of security services** to help protect workloads, detect threats, manage identity, and ensure compliance. Understanding how these services work together is **critical for designing a secure AWS environment**.

✅ **Why Use AWS Security Services?**\
✔ **Protect sensitive data** from unauthorized access.\
✔ **Monitor and detect threats** across AWS resources.\
✔ **Ensure compliance** with security standards (PCI DSS, HIPAA, ISO 27001).\
✔ **Automate security controls** to reduce risks.

***

### **📌 AWS Security Services & Their Use Cases**

| **Category**                         | **Service**                            | **Purpose**                                                                        |
| ------------------------------------ | -------------------------------------- | ---------------------------------------------------------------------------------- |
| **Identity & Access Management**     | AWS IAM (Identity & Access Management) | Manages **users, groups, roles, and policies** for access control.                 |
|                                      | AWS IAM Identity Center (SSO)          | Provides **centralized user authentication & role-based access**.                  |
|                                      | AWS KMS (Key Management Service)       | Encrypts **data at rest and in transit** with cryptographic keys.                  |
|                                      | AWS Secrets Manager                    | Securely stores **API keys, credentials, and database passwords**.                 |
|                                      | AWS Certificate Manager (ACM)          | Manages **TLS/SSL certificates** for secure communications.                        |
| **Threat Detection & Monitoring**    | Amazon GuardDuty                       | Detects **anomalies and threats** using AI-based analysis.                         |
|                                      | AWS Security Hub                       | Provides a **centralized view** of security findings from multiple AWS services.   |
|                                      | Amazon Macie                           | Identifies **sensitive data exposure** in Amazon S3.                               |
|                                      | AWS Config                             | Tracks **configuration changes** and detects non-compliance.                       |
|                                      | AWS CloudTrail                         | Logs **all API activity and user actions** for auditing.                           |
| **Network & Application Security**   | AWS WAF (Web Application Firewall)     | Protects **web applications from common attacks** (SQL injection, XSS).            |
|                                      | AWS Shield                             | Defends against **DDoS attacks** on AWS resources.                                 |
|                                      | AWS Network Firewall                   | Provides **deep packet inspection and firewall policies**.                         |
|                                      | Amazon VPC Security (SGs & NACLs)      | Restricts **inbound/outbound network traffic**.                                    |
|                                      | AWS Firewall Manager                   | Centrally manages **WAF, Shield, and security policies** across multiple accounts. |
| **Compliance & Security Governance** | AWS Organizations                      | Manages **multi-account security policies** via Service Control Policies (SCPs).   |
|                                      | AWS Artifact                           | Provides **compliance reports and audit documentation**.                           |
|                                      | AWS Inspector                          | Scans EC2 instances and container workloads for **vulnerabilities**.               |
| **Data Protection & Encryption**     | AWS Backup                             | Automates **backup and restore** for AWS resources.                                |
|                                      | AWS S3 Security Features               | Includes **bucket policies, encryption, MFA delete, and VPC endpoints**.           |
|                                      | AWS Data Loss Prevention (DLP)         | Ensures **sensitive data is not exposed** in public AWS environments.              |

***

### **📌 Detailed Feature Breakdown by Category**

Each section explains how **SecureCart** applies these services to secure its e-commerce platform.

***

#### **1️⃣ Identity & Access Management**

🔹 **Use Case:**\
SecureCart implements **IAM Roles** instead of IAM users for its applications and enforces **multi-factor authentication (MFA)** for admin access.

✅ **Best Practices:**

* Follow **least privilege access** principles.
* Use **IAM Identity Center (SSO)** for multi-account management.
* Rotate credentials regularly using **Secrets Manager**.

***

#### **2️⃣ Threat Detection & Monitoring**

✔ **Amazon GuardDuty** detects **unauthorized API calls and unusual data access patterns**.\
✔ **AWS Security Hub** aggregates security alerts for real-time visibility.

🔹 **Use Case:**\
SecureCart detects **suspicious login attempts from unknown locations** and alerts security admins.

✅ **Best Practices:**

* Enable **GuardDuty and CloudTrail** to monitor AWS activity.
* Regularly review **Security Hub findings** and take remediation actions.

***

#### **3️⃣ Network & Application Security**

✔ **AWS WAF protects SecureCart’s APIs** from injection attacks.\
✔ **AWS Shield mitigates DDoS threats** on SecureCart’s ALB and CloudFront distribution.

🔹 **Use Case:**\
SecureCart blocks **malicious bot traffic** using AWS WAF rate limiting rules.

✅ **Best Practices:**

* Implement **AWS Shield Advanced** for critical applications.
* Apply **strict security group rules** to limit EC2 exposure.

***

#### **4️⃣ Compliance & Security Governance**

✔ **AWS Organizations and SCPs** restrict unauthorized IAM changes.\
✔ **AWS Config tracks security configuration drift**.

🔹 **Use Case:**\
SecureCart ensures **all S3 buckets have encryption enabled** using AWS Config rules.

✅ **Best Practices:**

* Enable **AWS Config to monitor compliance** continuously.
* Use **AWS Artifact to download compliance reports** for audits.

***

#### **5️⃣ Data Protection & Encryption**

✔ **AWS KMS encrypts SecureCart’s RDS database and S3 objects**.\
✔ **AWS Backup ensures daily snapshots of production data**.

🔹 **Use Case:**\
SecureCart **uses CMKs (Customer Managed Keys) for critical transactions** to enforce strict access control.

✅ **Best Practices:**

* **Encrypt all storage volumes (EBS, S3, RDS, DynamoDB)**.
* Use **MFA Delete** to prevent accidental data loss.

***

### **📌 Common Security Mistakes & How to Avoid Them**

⚠ **Overly permissive IAM policies** → Always apply **least privilege principles**.\
⚠ **Not enabling GuardDuty or CloudTrail** → Results in **poor visibility** into security events.\
⚠ **Leaving security groups open to `0.0.0.0/0`** → Can lead to **unauthorized access**.\
⚠ **Not encrypting sensitive data** → Use **KMS & Secrets Manager** for secure storage.\
⚠ **Not enforcing multi-factor authentication (MFA)** → Increases **risk of account compromise**.

***

### **🚀 Summary**

✔ **AWS Security Services provide multiple layers of protection for workloads**.\
✔ **SecureCart uses IAM, GuardDuty, WAF, Shield, KMS, and Config to ensure strong security**.\
✔ **Best practices include encryption, continuous monitoring, and least privilege access**.