Arrow keys / Click to navigate

Cloud Operations on AWS

Module 10: Data Security and System Auditing

Module Overview

Maintaining a strong identity and access foundation
Implementing detection mechanisms
Automating incident remediation

IAM Access Analyzer & Permissions Boundaries

Create an analyzer · review findings · take action
Identifies resources shared with external entities
Permissions boundary limits the max permissions a principal can be granted

Detection & Auditing Services

📜

AWS CloudTrail

API activity logging

⚙️

AWS Config

Configuration compliance

🐛

Amazon GuardDuty

Threat detection

🔍

Amazon Inspector

Vulnerability assessment

AWS CloudTrail

Logs and continuously monitors account activity
Records API call interactions for most AWS services
Automatically pushes logs to Amazon S3
Analyze logs at scale with Amazon Athena (SQL, serverless)

Amazon GuardDuty & Amazon Inspector

GuardDuty: intelligent threat detection using ML and threat intel feeds
GuardDuty added AI Protection for AWS AI workloads
Inspector: automated vulnerability assessments, agent-based & agentless
Note: Inspector Classic reaches end of support May 2026

Incident Response with AWS Lambda

Detect an event (GuardDuty finding, Config rule violation, etc.)

Trigger a Lambda function via EventBridge

Lambda assumes an IAM role via trust policy

Remediate automatically or notify the response team

AWS Config Rules for Remediation

Managed rules — defined and maintained by AWS
Custom rules — use Lambda functions, maintained by the customer
Automatic remediation actions can be attached to noncompliant resources

Troubleshooting Scenario

Issue: AWS Config rule remediation failed on an S3 bucket.

Cause: AccessDenied error when calling PutBucketEncryption.

Solution: Run aws configservice describe-remediation-execution-status for detailed error messages, then correct the remediation role's permissions.

Module Summary

Next: Module 11 — Operate Secure and Resilient Networks

Module 10 Mind Map

Click branch to expand

1 / 10