Protecting an Account: WAF, Shield, GuardDuty, Security Hub & Config

In one line

Defence in layers: WAF and Shield at the edge, GuardDuty detecting threats from logs, Inspector scanning for vulnerabilities, Config recording configuration compliance, and Security Hub aggregating everything into one prioritised view.

0/4 · 0%

Think of it like this

A well-run office building. Security guards at the entrance filter visitors (WAF), the building withstands crowds (Shield), CCTV analysts watch for suspicious behaviour (GuardDuty), inspectors check for faulty wiring (Inspector), a register records every change to the building (Config and CloudTrail), and the security manager's dashboard collects all reports (Security Hub).

Key ideas

01
AWS WAF inspects HTTP requests at CloudFront, ALB, API Gateway, or AppSync using rules: AWS MANAGED RULE GROUPS (common threats, known bad inputs, bot control), RATE-BASED rules (throttle abusive IPs), and geo or IP rules. Start rules in COUNT mode, review the logs, then switch to BLOCK. SHIELD Standard (free, automatic) absorbs common network floods; Shield Advanced adds application-layer protection, cost protection, and a response team.
02
GUARDDUTY analyses CloudTrail, VPC Flow Logs, DNS logs, and optional EKS audit, runtime, S3, and RDS data to detect threats: compromised credentials used from unusual places, instances talking to known malicious hosts, crypto-mining, and suspicious API calls. INSPECTOR continuously scans EC2, ECR images, and Lambda for vulnerabilities. MACIE finds sensitive data in S3.
03
AWS CONFIG records the configuration history of resources and evaluates RULES (e.g. 'S3 buckets must block public access', 'EBS volumes encrypted') with optional auto-remediation. CLOUDTRAIL records who did what (Phase 6). SECURITY HUB aggregates findings from all of these (and partners), scores you against standards (AWS Foundational Security Best Practices, CIS), and routes high-severity findings through EventBridge to people or automation.
04
At organisation scale, enable these centrally from a delegated security account for every account and region (DevOps guide, advanced AWS and landing zones).

Code & diagrams

turn on detection in one accountbash

aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES
aws securityhub enable-security-hub --enable-default-standards
aws inspector2 enable --resource-types EC2 ECR LAMBDA
aws configservice put-configuration-recorder --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/aws-config-role \
  --recording-group allSupported=true,includeGlobalResourceTypes=true
aws securityhub get-findings --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}' \
  --query 'Findings[].Title' --max-items 5

layers of protectiondiagram

Rendering diagram…

Explain it without notes

What's the difference between WAF and GuardDuty?

Practice

You enabled WAF managed rules in BLOCK mode and checkout requests started failing. What went wrong and how should it be rolled out?

Trade-offs

↔
More detection services mean better visibility but more findings to triage and more cost; route only actionable, high-severity findings to people and automate or ticket the rest.

Done when you can

I can explain what WAF, Shield, GuardDuty, Inspector, Config, and Security Hub each do
I roll out WAF rules in count mode before blocking