AWS Managed Security Services Overview
Six managed services cover most of the detection and network-protection ground on AWS. They overlap enough to be confused, so the distinctions below are the ones worth holding on to.
AWS Security Hub CSPM
Section titled “AWS Security Hub CSPM”Security Hub CSPM is the centralised view. It receives findings from Amazon Inspector, Amazon GuardDuty, Amazon Macie, AWS Firewall Manager and other integrated services, normalises them into the AWS Security Finding Format, and runs its own configuration checks against standards such as the AWS Foundational Security Best Practices standard, CIS and PCI DSS. It supports multi-account aggregation and third-party integrations from the AWS Marketplace.
Most of its controls are implemented as service-linked AWS Config rules, so AWS Config must be enabled and recording for those checks to produce findings.
The service was renamed: what used to be called AWS Security Hub is now AWS Security Hub CSPM, and the unqualified name belongs to a broader tiered risk-analytics offering.
Network Firewall vs Web Application Firewall
Section titled “Network Firewall vs Web Application Firewall”These two are frequently treated as alternatives when they operate at different layers and in different places.
| AWS Network Firewall | AWS WAF | |
|---|---|---|
| Layer | Network and transport, with stateful protocol detection | HTTP(S), layer 7 |
| Placement | Firewall endpoints in dedicated subnets inside the VPC; traffic is steered to them by VPC route tables | Attached to a protected resource at the edge or in front of the application |
| Traffic it sees | Anything the route tables send it — internet gateway, NAT gateway, VPN, Direct Connect, Transit Gateway, VPC-to-VPC | Requests to a CloudFront distribution, Application Load Balancer, API Gateway REST API, AppSync GraphQL API, Cognito user pool, App Runner service, Verified Access instance or Amplify app |
| Rules | Stateless 5-tuple rules and stateful Suricata-compatible IPS rules, domain lists, deep packet inspection | Web ACL rules on IP sets, geography, headers, body, URI, size, rate, plus AWS Managed Rules |
| Typical use | VPC-centric applications needing egress control and intrusion prevention | Internet-facing web applications and APIs needing protection from web exploits and bots |
A firewall endpoint cannot filter traffic entering or leaving the subnet it sits in, which is why firewall subnets are reserved for that purpose and nothing else.
AWS Shield
Section titled “AWS Shield”Shield Standard is included for every AWS customer at no cost and defends against common network and transport layer (layer 3 and 4) DDoS attacks, always on, with automatic inline mitigation.
Shield Advanced is a paid subscription that adds protection for specified resources, detailed attack telemetry, automatic application-layer DDoS mitigation through an AWS WAF rule group, access to the AWS Shield Response Team (SRT), and cost protection against scaling charges incurred during an attack. A Shield Advanced subscription also covers the standard AWS WAF charges for the resources it protects.
AWS Firewall Manager
Section titled “AWS Firewall Manager”Firewall Manager is the organisation-wide control plane for the protections above. It requires AWS Organizations and a designated Firewall Manager administrator account, and it applies policies to accounts and resources automatically — including accounts and resources created later.
It manages policies for:
- AWS WAF web ACLs
- AWS Shield Advanced subscriptions and protections
- Amazon VPC security groups
- Amazon VPC network ACLs
- AWS Network Firewall
- Amazon Route 53 Resolver DNS Firewall
- Third-party rule groups purchased from the AWS Marketplace
Firewall Manager sends compliance information and findings to Security Hub CSPM. It is a managed service — there is nothing to install on an instance.
Amazon GuardDuty
Section titled “Amazon GuardDuty”GuardDuty analyses CloudTrail management events, VPC Flow Logs and Route 53 Resolver DNS query logs continuously, using threat intelligence feeds and machine learning models, and raises findings for behaviour that indicates compromise. Optional protection plans extend it to S3 data events, EKS audit logs, runtime events on EC2, EKS and ECS-Fargate, malware scanning, RDS login activity, Lambda network activity and AI service data events.
Findings go to the GuardDuty console, to EventBridge for automated response, and to Security Hub CSPM for aggregation.
Deployment guidance
Section titled “Deployment guidance”Detection. Enable GuardDuty across the whole organisation from a delegated administrator account, in every Region — including Regions with no workloads, because global service events are replicated into each enabled Region and unused Regions are where unauthorised resources appear. Route findings to EventBridge and Security Hub CSPM rather than relying on the console.
Firewalls. Choose by architecture, not by preference: Network Firewall for VPC-centric workloads and egress control, AWS WAF for internet-facing web applications and APIs. Most estates need both. Once more than a handful of accounts are involved, apply them through Firewall Manager so that a new account is protected the moment it joins.
DDoS. Shield Standard is automatic. Evaluate Shield Advanced on application criticality, whether the detailed attack visibility and SRT access are needed, and whether the cost protection is worth the subscription.
Posture. Enable AWS Config first, then Security Hub CSPM, so that standards checks produce findings from the outset. Set alert priorities before switching on every standard — an unfiltered feed of medium-severity findings is ignored within a week.