GuardDuty, Inspector, and Macie

Defence-in-depth security requires not just preventing attacks but also detecting threats that slip through. AWS provides three managed security detection services that work together: Amazon GuardDuty detects threats by analysing AWS account behaviour and network traffic. Amazon Inspector finds software vulnerabilities in compute resources. Amazon Macie discovers sensitive data (PII, financial records) in S3 and alerts when it is exposed. All three are fully managed, use machine learning, and integrate with AWS Security Hub for centralised visibility.

Amazon GuardDuty is a continuous threat detection service that analyses VPC Flow Logs, DNS logs, CloudTrail management events, and S3 data events using machine learning, anomaly detection, and integrated threat intelligence feeds (IP reputation lists, known malicious domains). GuardDuty is agentless — you enable it in your account and it immediately starts analysing existing logs. No infrastructure to manage, no log storage costs (GuardDuty consumes the logs directly from AWS). It surfaces findings categorised by threat type: UnauthorizedAccess, CryptoCurrency, Backdoor, Trojan, and more.

GuardDuty classifies findings by threat purpose, resource type, and threat name. Common finding categories: UnauthorizedAccess — API calls from unusual locations or Tor exit nodes. Recon — port scanning or API enumeration. PrivilegeEscalation — IAM policy changes suggesting privilege escalation. Exfiltration — unusual large data retrieval from S3 or RDS. CryptoCurrency — EC2 instance communicating with known crypto mining pools. Stealth — CloudTrail logging disabled, S3 access logging disabled. Each finding includes an affected resource, actor IP/user, and recommended action.

GuardDuty findings integrate with Amazon EventBridge to trigger automated response workflows. A common pattern: GuardDuty detects a compromised EC2 instance → EventBridge rule fires → Lambda function is invoked → Lambda isolates the instance (removes it from ASG, applies restrictive security group that blocks all traffic), snapshots its EBS volumes for forensics, and notifies the security team via SNS. This automated response can happen within seconds of detection — far faster than a human-operated response.

Amazon Inspector automatically discovers and scans your workloads for software vulnerabilities and unintended network exposure. Inspector v2 (the modern version) covers EC2 instances (via Systems Manager Agent), Amazon ECR container images (scanned when pushed), and AWS Lambda functions (package dependencies). It correlates findings with CVE databases (Common Vulnerabilities and Exposures) and assigns risk scores. Inspector continuously rescans resources when new vulnerabilities are published — you do not need to manually trigger scans.

Beyond CVE scanning, Inspector analyses network reachability — which EC2 instances are internet-accessible due to security group configurations. It maps your VPC security groups, NACLs, route tables, and internet gateways to determine which ports on which instances are reachable from the internet. A finding like Port 22 (SSH) on i-12345 is reachable from the internet indicates a misconfigured security group allowing direct SSH access — a common security risk. This network analysis runs without agents, using VPC configuration data.

Amazon Macie uses machine learning and pattern matching to automatically discover and protect sensitive data in Amazon S3. Macie identifies Personally Identifiable Information (PII) (names, social security numbers, credit card numbers, passports), financial data, health information, and credentials (passwords, API keys). It also detects public S3 buckets and unencrypted buckets. Macie generates findings that integrate with Security Hub and EventBridge for automated remediation or alerting when sensitive data is discovered or exposed.

Macie is particularly valuable for compliance frameworks that require locating and protecting sensitive data: GDPR (EU personal data), HIPAA (health information), PCI DSS (payment card data). Macie findings show which S3 objects contain sensitive data, what type of data was found, and the access controls on the bucket. Use this to verify that all buckets containing sensitive data are encrypted, private, and governed by appropriate bucket policies. Macie does not modify data or bucket access — it only detects and reports. Remediation is done by the security team.

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, and third-party tools into a single console. It normalises findings into the AWS Security Finding Format (ASFF), enabling consistent processing and analysis across sources. Security Hub also evaluates your environment against security standards like CIS AWS Foundations, PCI DSS, and NIST. Use Security Hub as the single pane of glass for your security posture — correlate related findings from multiple services to understand the full scope of an incident.

The SAA-C03 exam tests whether you can select the right detective service for a given security requirement. Key distinctions: GuardDuty — detects runtime threats and suspicious behaviour (who is doing something bad NOW). Inspector — finds pre-existing vulnerabilities in software and network configuration (what is wrong with my resources). Macie — discovers sensitive data and its exposure risk in S3 (where is my sensitive data and is it protected). All three are complementary and are typically deployed together in production environments as part of a comprehensive security strategy.

Manually enabling GuardDuty, Inspector, and Macie in each AWS account is impractical at scale. AWS Organizations integration lets you designate a delegated administrator account (typically a Security account) that enables and manages these services across all member accounts from a single place. New accounts added to the Organisation automatically have GuardDuty, Inspector, and Macie enabled. Findings from all accounts aggregate into the delegated administrator account for centralised review. This is the recommended architecture for multi-account security governance.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: GuardDuty detects runtime threats through ML-based analysis of CloudTrail, VPC Flow Logs, and DNS logs, Inspector automatically scans EC2, ECR, and Lambda for CVE vulnerabilities and network reachability issues, and Macie discovers and protects sensitive data in S3 through managed data identifier scanning. Security Hub centralises findings from all three. Next up we explore Secrets Manager and Parameter Store.