5.2.4. Threat Detection: GuardDuty, Inspector, Macie, and Security Hub
💡 First Principle: You cannot protect against threats you cannot see. A correctly configured IAM policy prevents unauthorized access — but what about legitimate credentials that are compromised? What about an EC2 instance making connections to known malware command-and-control servers? Threat detection services analyze behavior and configuration continuously to surface these threats before they escalate.
The four services each target a different threat vector — understanding which does what is the core exam skill for this subsection.
Service Roles — One-Line Summaries:
| Service | What It Detects | Primary Data Source |
|---|---|---|
| Amazon GuardDuty | Malicious activity and compromised resources | CloudTrail, VPC Flow Logs, DNS logs, S3 data events |
| Amazon Inspector | Software vulnerabilities and unintended network exposure | EC2 OS, container images in ECR, Lambda function code |
| Amazon Macie | Sensitive data (PII, credentials) in S3 | S3 object content scanning |
| AWS Security Hub | Aggregated security findings across accounts and services | GuardDuty, Inspector, Macie, Config, IAM Access Analyzer, partner services |
Amazon GuardDuty:
GuardDuty is a regional threat detection service that uses machine learning to identify unusual and potentially malicious behavior. It analyzes:
- CloudTrail management events (unusual API calls, API calls from Tor exit nodes)
- VPC Flow Logs (port scanning, data exfiltration patterns)
- DNS logs (queries to known malicious domains)
- S3 data events (unusual S3 access patterns) — through the optional S3 Protection plan
CloudTrail management events, VPC Flow Logs and DNS logs are the foundational data sources: GuardDuty reads them as independent streams as soon as it is enabled, without you creating flow logs or a trail. S3 data events, EKS audit logs, runtime activity, malware scans, RDS logins and Lambda network activity come from separately configured protection plans (enabling GuardDuty in a Region for the first time also turns on S3 Protection with its 30-day trial).
GuardDuty finding severity: Low, Medium, High. Findings include the threat type, affected resource, actor details, and evidence.
Common GuardDuty finding types:
UnauthorizedAccess:EC2/SSHBruteForce— brute force SSH attemptsCryptoCurrency:EC2/BitcoinTool.B!DNS— crypto mining malwareTrojan:EC2/PhishingDomainRequest— malware C2 communicationCredentialAccess:IAMUser/AnomalousBehavior— unusual API activity from IAM user
Responding to GuardDuty findings:
| Finding | First moves |
|---|---|
| Compromised EC2 instance (crypto mining, Tor, C2 traffic) | Isolate, don't terminate: detach it from its Auto Scaling group, replace its security groups with an isolation group that has no rules, snapshot the EBS volumes for forensics, then investigate |
| Compromised IAM credentials | Deactivate the access keys and console password (revoke active sessions for a role), then use CloudTrail to find and undo what the credentials did |
| Expected activity (an approved scanner, uptime checks) | Create a suppression rule with filter criteria such as source IP or instance ID; matching new findings are archived automatically, and the finding type stays active for everything else |
A trusted IP list stops VPC Flow Log and CloudTrail findings for the listed addresses. Use it only for IPs you own, never to silence a suspicious location.
Amazon Inspector:
Inspector identifies software vulnerabilities and unintended network exposure:
- EC2: Scans running instances for OS vulnerabilities using SSM Agent; identifies open network paths
- ECR container images: Scans images on push for known CVEs in OS and application packages
- Lambda functions: Scans function code and layers for vulnerabilities
Inspector findings include a risk score and remediation recommendations. The current Amazon Inspector (once called Inspector v2) discovers and scans resources continuously and automatically; its predecessor, Inspector Classic, ran scheduled assessment templates against EC2 instances only and reached end of support on May 20, 2026. Inspector integrates with Security Hub and can send findings to EventBridge for automated response.
Amazon Macie:
Macie uses ML to discover and protect sensitive data in S3:
- Discovers buckets with sensitive data (PII, financial data, credentials, health information)
- Identifies buckets with overly permissive access controls
- Generates findings for data access anomalies
AWS Security Hub:
Security Hub is the aggregation layer — it doesn't detect threats itself but collects findings from GuardDuty, Inspector, Macie, Config, IAM Access Analyzer, and third-party products into a single normalized view.
Security Hub also runs security standard checks (automated compliance rules):
- CIS AWS Foundations Benchmark
- AWS Foundational Security Best Practices
- PCI DSS
- NIST SP 800-53
For multi-account environments, designate an aggregator account. Security Hub in the aggregator collects findings from all member accounts, giving a single pane of glass for security posture.
⚠️ Exam Trap: GuardDuty, Inspector, Macie, and Security Hub must be explicitly enabled — they are not on by default. GuardDuty and Inspector also need to be enabled in every region you want covered (or use AWS Organizations delegated administrator to enable them organization-wide). A question asking "how did a threat go undetected for 6 months" often has the answer "GuardDuty was not enabled in the region where the EC2 instance was running."
Reporting and remediating findings at scale: AWS now calls the posture-check service described above Security Hub CSPM. The newer, unified AWS Security Hub correlates signals from Security Hub CSPM, GuardDuty, Inspector and Macie to prioritize active risks (including exposure findings), and can create Jira Cloud or ServiceNow ITSM tickets from findings. Two Security Hub CSPM features turn findings into action:
| Mechanism | What it does | Key rules |
|---|---|---|
| Automation rules | Change findings as they are ingested: raise Severity, set Workflow to SUPPRESSED, add Notes | Created only in the administrator account; apply to member accounts; apply only in the Region where created; evaluate findings created or updated after the rule exists; up to 100 per administrator |
| EventBridge: Findings - Imported | Sent automatically for every new or updated finding | Filter by severity or type, then target Lambda, SSM Automation, Step Functions or SNS |
| EventBridge: Findings - Custom Action | Sent only for findings an analyst selects (up to 20 at a time) | Use it for on-demand tickets or runbooks |
To stop a control from generating findings at all, disable the control. Automation rules only change fields on findings that are still generated. For cross-account automated response, AWS publishes the Automated Security Response on AWS solution, built on EventBridge, Lambda and Systems Manager.
Reflection Question: A security team wants a single dashboard showing: (1) EC2 instances running software with known CVEs, (2) S3 buckets containing credit card numbers, and (3) IAM credentials making API calls from unusual geographic locations. Which three AWS services provide each data point, and what service aggregates them all into one view?
