GuardDuty、Inspector 与 Macie

威胁检测层

# Detective controls overview:
# GuardDuty:  Who is behaving suspiciously? (threat detection)
# Inspector:  What vulnerabilities exist in my compute? (CVE scanning)
# Macie:      Where is my sensitive data? (PII/PCI discovery)

# All three:
# - Fully managed (no agents for most features)
# - Machine learning-based analysis
# - Send findings to Security Hub
# - Integrate with EventBridge for automated response

Amazon GuardDuty：智能威胁检测

# Enable GuardDuty
aws guardduty create-detector \
  --enable \
  --finding-publishing-frequency FIFTEEN_MINUTES

# List GuardDuty findings
aws guardduty list-findings \
  --detector-id <detector-id> \
  --finding-criteria '{
    "Criterion": {
      "severity": {"Gte": 7}
    }
  }'

# High severity (7-10) examples:
# UnauthorizedAccess:EC2/MaliciousIPCaller.Custom
# CryptoCurrency:EC2/BitcoinTool.B
# Backdoor:EC2/C&CActivity.B

GuardDuty 发现结果类型

# Get GuardDuty finding details
aws guardduty get-findings \
  --detector-id <detector-id> \
  --finding-ids finding-id-1 finding-id-2

# Finding structure:
# {
#   'type': 'CryptoCurrency:EC2/BitcoinTool.B!DNS',
#   'severity': 8.0,
#   'title': 'EC2 instance querying domain for cryptocurrency mining',
#   'resource': {'instanceDetails': {'instanceId': 'i-12345'}},
#   'service': {'action': {'networkConnectionAction': {'remoteIpDetails': {...}}}}
# }

GuardDuty 自动响应

# EventBridge rule for high-severity GuardDuty findings
aws events put-rule \
  --name guardduty-high-severity \
  --event-pattern '{
    "source": ["aws.guardduty"],
    "detail-type": ["GuardDuty Finding"],
    "detail": {
      "severity": [{"numeric": [">", 6.9]}]
    }
  }'

# Lambda response function actions:
# 1. Stop instance from ASG
# 2. Replace security group with deny-all SG
# 3. Create EBS snapshot for forensics
# 4. Send SNS alert to security team
# 5. Create Jira ticket via API

Amazon Inspector：漏洞评估

# Enable Amazon Inspector
aws inspector2 enable \
  --resource-types EC2 ECR LAMBDA

# List Inspector findings for critical vulnerabilities
aws inspector2 list-findings \
  --filter-criteria '{
    "severity": [{"comparison":"EQUALS","value":"CRITICAL"}]
  }' \
  --query 'findings[].{Resource:resources[0].id,CVE:packageVulnerabilityDetails.vulnerabilityId,CVSS:packageVulnerabilityDetails.cvss[0].baseScore}'

# Inspector integrates with ECR lifecycle policies
# to prevent deploying critically vulnerable images

Inspector 网络可达性

# Inspector network findings example:
# Finding type: NETWORK_REACHABILITY
# Title: Port 22 is reachable from 0.0.0.0/0
# Resource: ec2-instance i-12345 (prod-web-01)
# Details: Security group sg-abc allows 0.0.0.0/0:22
# Recommendation: Restrict SSH to corporate IP range
#   or use Systems Manager Session Manager instead

# Fix: update security group
aws ec2 revoke-security-group-ingress \
  --group-id sg-abc \
  --protocol tcp --port 22 --cidr 0.0.0.0/0

Amazon Macie：敏感数据发现

# Enable Macie
aws macie2 enable-macie

# Create a classification job to scan S3 buckets
aws macie2 create-classification-job \
  --name 'Scan-All-S3-Buckets' \
  --job-type ONE_TIME \
  --s3-job-definition '{
    "bucketDefinitions": [{
      "accountId": "123456789012",
      "buckets": ["customer-uploads","financial-reports"]
    }]
  }' \
  --managed-data-identifier-selector ALL

# Macie scans objects and reports:
# - SSN found in financial-reports/2026-q1.csv
# - Bucket customer-uploads is publicly readable

Macie 发现结果与合规性

# Get Macie findings
aws macie2 list-findings \
  --finding-criteria '{
    "criterion": {
      "category": {"eqExactMatch": ["CLASSIFICATION"]}
    }
  }'

# Findings example output:
# sensitiveDataCategories: [FINANCIAL_INFORMATION, PERSONAL_HEALTH_INFORMATION]
# resourcesAffected:
#   s3Object:
#     bucketName: healthcare-records
#     key: patients/2026/march.csv
#     publicAccess: false  (good)
#     serverSideEncryption: null (BAD - not encrypted!)

AWS Security Hub：集中管理发现结果

# Enable Security Hub and all integrations
aws securityhub enable-security-hub \
  --enable-default-standards

# GuardDuty, Inspector, Macie automatically
# send findings to Security Hub when all are enabled

# Query aggregated findings
aws securityhub get-findings \
  --filters '{
    "SeverityLabel": [{"Value":"CRITICAL","Comparison":"EQUALS"}],
    "WorkflowStatus": [{"Value":"NEW","Comparison":"EQUALS"}]
  }' \
  --sort-criteria '[{"Field":"LastObservedAt","SortOrder":"desc"}]'

GuardDuty、Inspector 和 Macie 对比

# Service selection guide:
# 'Detect if EC2 is mining cryptocurrency' -> GuardDuty
# 'Find unpatched Apache Log4j vulnerabilities' -> Inspector
# 'Discover PII stored in S3 buckets' -> Macie
# 'Alert if unusual API calls from foreign IP' -> GuardDuty
# 'Find publicly accessible EC2 ports' -> Inspector
# 'Detect unencrypted S3 buckets with credit card data' -> Macie
# 'Correlate findings from all three services' -> Security Hub

使用 AWS Organizations 扩展启用范围

# Enable GuardDuty for entire AWS Organization
# Run from management account
aws guardduty enable-organization-admin-account \
  --admin-account-id 111111111111

# From security/delegated admin account:
aws guardduty update-organization-configuration \
  --detector-id <detector-id> \
  --auto-enable-organization-members NEW

# NEW accounts automatically get GuardDuty enabled
# All findings aggregate in the admin account

快速检查

课程回顾