Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

3.4. Service Reference: Additional Security, Identity, and Compliance Services

💡 First Principle: AWS security services divide cleanly by the question they answer: what is happening (detection), what is stored (data protection), who is allowed in (identity), and can we prove it (governance).

Section 3.2 covers the core security controls. This reference covers the remaining security, identity, and compliance services named in the official CLF-C02 exam guide. Grouping them by the question each answers is the fastest way to tell the easily confused ones apart - GuardDuty detects threats, Inspector finds vulnerabilities, Macie classifies sensitive data, and Detective investigates what already happened.

Threat Detection and Monitoring

ServiceWhat it does and when you would choose it
Amazon GuardDutyContinuously analyze account and network activity to detect threats such as compromised credentials or crypto mining.
Amazon InspectorAutomatically scan workloads for software vulnerabilities and unintended network exposure.
Amazon DetectiveInvestigate the root cause of a security finding by analyzing the events that led up to it.
AWS Security HubAggregate findings from GuardDuty, Inspector, Macie, and others into one prioritized view.

Data Protection

ServiceWhat it does and when you would choose it
Amazon MacieDiscover and classify sensitive data, such as personally identifiable information, stored in Amazon S3.
AWS Secrets ManagerStore database credentials and API keys centrally and rotate them automatically, instead of hard-coding them.
AWS CloudHSMA dedicated single-tenant hardware security module for key storage when a regulation demands you control the hardware.

Identity and Access

ServiceWhat it does and when you would choose it
AWS IAM Identity CenterCentrally manage workforce sign-in across multiple AWS accounts, federating from an existing corporate directory.
Amazon CognitoAdd sign-up, sign-in, and access control for the users of your own web and mobile applications.
AWS Directory ServiceRun managed Microsoft Active Directory in AWS or connect to an existing on-premises directory.
AWS Resource Access Manager (AWS RAM)Share specific resources across AWS accounts without duplicating them.

Governance and Network Protection

ServiceWhat it does and when you would choose it
AWS Audit ManagerContinuously collect evidence to simplify audits against standards such as PCI DSS and GDPR.
AWS Firewall ManagerCentrally configure and enforce AWS WAF and related firewall rules across many accounts.
See how it connects
Start with 40 free practice questions
Alvin Varughese
Written byAlvin Varughese
Founder•18 professional certifications