AWS Security Hub and GuardDuty

Purpose of This Lesson

AWS Security Hub and Amazon GuardDuty address complementary security needs:

• Security Hub evaluates the security posture of AWS accounts against supported standards, aggregates findings, and supports remediation and external integrations.
• GuardDuty continuously analyzes security-related activity to detect possible compromise, reconnaissance, and malicious behavior.

For SOA-C03 preparation, recognize whether a scenario calls for configuration and compliance assessment or for ongoing threat detection based on account activity.

Key Concepts

AWS Security Hub

Security Hub is a cloud security posture management service. It runs security best-practice checks against enabled standards, including:

• AWS Foundational Security Best Practices
• Center for Internet Security (CIS) AWS Foundations Benchmark
• Payment Card Industry Data Security Standard (PCI DSS)

The enabled standards produce security findings and scores. Security Hub can show an overall score, provide scores for individual standards, and organize findings by severity such as critical, high, medium, low, and informational.

Security Hub can also aggregate findings and connect them to operational workflows, including:

• Amazon EventBridge for routing findings and triggering targets such as Lambda functions or other processes
• AWS Systems Manager for automated remediation using runbooks
• AWS Organizations for consolidated findings across accounts
• Ticketing, chat, incident-management, investigation, GRC, SOAR, and SIEM tools

Amazon GuardDuty

GuardDuty is an intelligent threat detection service that continuously monitors activity for signs of:

• Account compromise
• Instance compromise
• Malicious reconnaissance
• S3 bucket compromise

The lecture identifies these GuardDuty data sources and activity types:

• CloudTrail management events
• CloudTrail S3 data events
• VPC Flow Logs
• DNS logs

GuardDuty findings can include contextual details such as the affected identity, access key ID, API actions, source IP address, and geographic information associated with the activity.

Security Posture and Threat Detection Workflow

1. Enable the services

Security Hub and GuardDuty must be enabled in the account before they can produce findings. Results may not appear immediately; allow time for the services to begin collecting data and evaluating the environment.

2. Configure the applicable Security Hub standards

Enable the standards relevant to the environment. AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark are examples of enabled standards. PCI DSS may be appropriate when the environment has a PCI DSS compliance requirement.

The service presents an overall security score and separate scores for individual standards. A strong score for one standard does not necessarily mean the account performs equally well against another.

3. Review and triage findings

Security Hub findings can be filtered or sorted by severity and status. Findings may be new or archived. Review the underlying recommendation before taking action, and determine whether the finding represents an actual issue, an accepted exception, or a resolved condition.

Examples from the lecture include:

• Virtual MFA should be enabled for the root user.
• Root-user hardware MFA should be enabled as an additional security best-practice finding.
• Security groups should not expose high-risk ports to unrestricted sources.
• CloudTrail should be enabled and configured with at least one regional trail that includes read and write management events.
• SSH port 22 should not be open to every source unless there is a justified operational requirement.

A finding can be marked as resolved when the condition has been corrected or when the organization has made an appropriate decision about the finding. Do not treat every recommendation as an automatic instruction to close a required access path; evaluate the workload’s actual requirements.

4. Investigate GuardDuty findings

GuardDuty findings focus on potentially malicious or suspicious activity rather than compliance configuration. For example, a finding may indicate that root credentials were used and show the access key, associated user, API actions, source IP, and location.

Use these details to determine whether the activity is expected, investigate possible credential compromise, and route the finding into the organization’s incident workflow.

5. Consider usage and cost

GuardDuty includes a usage view that breaks down activity by data source, including CloudTrail, VPC Flow Logs, DNS logs, and S3 data events. It also displays an estimated total daily cost. The lecture environment was using a free trial, so the displayed activity did not result in charges there. GuardDuty can also perform malware scans, although those scans were not enabled in the demonstrated account.

Exam- or Assessment-Relevant Takeaways

• Choose Security Hub when the primary requirement is security posture management, best-practice checks, compliance-oriented standards, finding aggregation, or remediation workflows.
• Choose GuardDuty when the primary requirement is continuous intelligent threat detection for suspicious activity or possible compromise.
• Security Hub standards must be enabled individually according to the environment’s needs; enabling one standard does not automatically cover all standards.
• A Security Hub score is a posture indicator, not proof that the account is secure or compliant with every possible requirement.
• Security Hub findings can be integrated with EventBridge, Systems Manager, AWS Organizations, and external operational tools.
• GuardDuty analyzes multiple telemetry sources, including CloudTrail events, VPC Flow Logs, DNS logs, and S3 data events.
• Both services require enablement and may need time before useful findings appear.
• Be able to distinguish a configuration recommendation, such as restricting SSH access, from a GuardDuty behavioral finding, such as root credential usage.

Tool / Feature Decision Guide

Requirement or scenario	Prefer	Why
Evaluate the account against AWS security best practices	Security Hub	It performs posture checks and reports standards-based findings and scores.
Assess an environment against the CIS AWS Foundations Benchmark	Security Hub	CIS is one of the supported standards demonstrated in the lecture.
Assess PCI DSS-related security posture	Security Hub	PCI DSS can be enabled when relevant to the application or environment.
Detect suspicious API activity or possible account compromise	GuardDuty	It continuously analyzes security-related telemetry for threat indicators.
Route a finding to an automated process	Security Hub with EventBridge	EventBridge can trigger Lambda or other targets.
Automate remediation with an operational runbook	Security Hub with Systems Manager	Systems Manager runbooks support the described automation workflow.
Consolidate findings across an AWS organization	Security Hub with AWS Organizations	Organizations integration supports consolidated findings across accounts.
Understand the sources contributing to GuardDuty usage	GuardDuty usage view	It breaks down activity by data source and shows estimated daily cost.

Common Traps / Misconceptions

• Confusing posture management with threat detection: Security Hub primarily evaluates configuration and standards; GuardDuty primarily detects suspicious activity.
• Expecting immediate findings after enablement: Both services may require a period of time before data and findings become visible.
• Assuming all standards are enabled automatically: Standards such as CIS, AWS Foundational Security Best Practices, and PCI DSS are selected according to the environment.
• Treating the overall Security Hub score as universal compliance: Scores are tied to enabled standards and their checks.
• Opening SSH to the entire internet by default: Security Hub may flag unrestricted access to port 22. Any exception should be justified by the workload’s needs.
• Automatically closing every finding: A finding may be archived or marked resolved, but the operational decision should follow investigation and remediation or documented acceptance.
• Assuming GuardDuty only uses CloudTrail: The lecture identifies CloudTrail management events, CloudTrail S3 data events, VPC Flow Logs, and DNS logs as relevant data sources.
• Assuming GuardDuty malware scans are always active: Malware scans are an available capability but were not enabled in the demonstrated account.

Real-World Engineer / Analyst Notes

• Start with the account or organization structure when planning Security Hub. Centralized findings are more useful when security teams can see multiple accounts consistently.
• Review the individual control behind a score instead of relying only on the percentage. A single critical identity or network finding may deserve attention even when the aggregate score appears high.
• Treat root credential usage as a high-priority investigation signal. The GuardDuty example shows why finding context—identity, access key, API action, source IP, and location—matters during triage.
• Use EventBridge and Systems Manager to connect detection with response, but keep automated remediation scoped carefully so legitimate workload access is not disrupted.
• Examine GuardDuty usage by data source when estimating operational cost or determining which telemetry is contributing to service activity.
• Security groups that allow unrestricted access may be intentionally configured in some architectures, but the exception should be understood and defensible rather than ignored.

Quick Reference Summary

• Security Hub: cloud security posture management, standards checks, scores, finding aggregation, and remediation integrations.
• GuardDuty: continuous threat detection for account, instance, reconnaissance, and S3-related compromise indicators.
• Security Hub examples: root-user MFA, CloudTrail configuration, and unrestricted security-group ingress findings.
• GuardDuty example: detected root credential usage with identity, API, IP, and location context.
• Important integrations: EventBridge, Systems Manager, AWS Organizations, ticketing, SOAR, SIEM, and incident-management tools.
• Important operational note: enable the services first and allow time for results to appear.
• Cost visibility: GuardDuty provides data-source usage details and an estimated daily cost; malware scans are an optional capability in the demonstrated account.

Flashcards

Q: An operations team needs standards-based checks and a security score for an AWS account. Which service should it use and why?

A: Use AWS Security Hub because it provides cloud security posture management, enabled-standard checks, findings, and security scores.

Q: A security team wants continuous detection of suspicious API activity that may indicate account compromise. Which service is the better fit?

A: Amazon GuardDuty is the better fit because it continuously analyzes security-related telemetry for threat activity and possible compromise.

Q: When would Security Hub be preferred over GuardDuty?

A: Prefer Security Hub when the question is whether the environment is configured according to security best practices or compliance standards. Prefer GuardDuty when the question is whether activity appears malicious or suspicious.

Q: Which Security Hub standards were enabled in the demonstrated account?

A: The CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices were enabled. PCI DSS was presented as an additional standard that could be enabled when relevant.

Q: What is the trap in interpreting a single Security Hub score as the account’s complete security status?

A: The score depends on the enabled standard and its checks. A strong score for one standard can coexist with a much lower score for another.

Q: An organization wants a finding to invoke a Lambda-based response. Which integration supports this workflow?

A: Amazon EventBridge can receive or route findings and trigger targets such as Lambda functions or other processes.

Q: Which integration is associated with automated remediation through runbooks?

A: AWS Systems Manager, using Systems Manager runbooks, supports the remediation workflow described in the lesson.

Q: Which GuardDuty data sources are identified in the lesson?

A: CloudTrail management events, CloudTrail S3 data events, VPC Flow Logs, and DNS logs.

Q: A GuardDuty finding reports root credential usage. What investigation details can help determine whether it is compromise?

A: Review the access key ID, associated user, API actions, source IP address, and the location associated with the activity.

Q: What should you expect immediately after enabling Security Hub or GuardDuty?

A: Findings may not appear immediately. The services need time to collect data and evaluate the account.

Q: A security group allows SSH port 22 from any source. Why might Security Hub flag it, and what should the engineer do?

A: Unrestricted SSH ingress is a security best-practice concern. The engineer should restrict the source where possible or document and evaluate the operational justification for the exception.

Q: How can an engineer inspect the factors contributing to GuardDuty usage and cost?

A: Use the GuardDuty usage view, which breaks activity down by data source and provides an estimated total daily cost.

Practice Questions

Question 1

A company wants to evaluate its AWS accounts against the AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark, then view findings by severity. Which service should the CloudOps engineer configure?

A. Amazon GuardDuty
B. AWS Security Hub
C. Amazon Inspector
D. AWS Systems Manager only

Correct answer: B. AWS Security Hub

Explanation: Security Hub performs the standards-based posture checks and presents scores and findings by severity. GuardDuty is focused on threat detection rather than these configuration benchmarks.

Question 2

After enabling GuardDuty, an analyst sees a finding showing root credential usage. The finding includes an access key ID, API actions, source IP address, and location. What is the most appropriate interpretation?

A. The account has passed the root-user MFA control
B. The event is a Security Hub compliance score
C. GuardDuty detected activity that should be investigated for possible credential compromise
D. The finding proves that the source IP is malicious

Correct answer: C. GuardDuty detected activity that should be investigated for possible credential compromise

Explanation: GuardDuty reports suspicious activity and provides contextual evidence for investigation. The finding does not by itself prove that the IP is malicious.

Question 3

A security team wants a Security Hub finding to start a Lambda workflow that notifies responders and begins remediation. Which design best matches the lecture?

A. Send the finding through EventBridge to a Lambda target
B. Use only the Security Hub percentage score
C. Enable a PCI DSS standard to invoke Lambda automatically
D. Use VPC Flow Logs as a Security Hub remediation runbook

Correct answer: A. Send the finding through EventBridge to a Lambda target

Explanation: EventBridge integrations can route alerts and trigger Lambda or other targets. Systems Manager runbooks are the separately described mechanism for runbook-based automation.

Question 4

An engineer enables both services in a new account but sees little or no data immediately afterward. What is the most likely explanation?

A. GuardDuty only produces findings after PCI DSS is enabled
B. Security Hub requires hardware MFA before it can display findings
C. The services may need time after enablement to collect data and generate results
D. Findings appear only after a security group exposes port 22

Correct answer: C. The services may need time after enablement to collect data and generate results

Explanation: The lecture explicitly notes that both services must be enabled and that results may take some time to appear.

WordPress Metadata

Suggested Slug:
aws-security-hub-guardduty-soa-c03

Meta Description:
Study AWS Security Hub and GuardDuty for SOA-C03, including posture checks, threat detection, findings, integrations, data sources, and operational tradeoffs.

Tags:
AWS Certified CloudOps Engineer, SOA-C03, AWS Security Hub, Amazon GuardDuty, cloud security posture management, AWS security findings, AWS Organizations, CloudTrail