Small services

Question 1

Security Hub

Answer 1

• Single place to view security alerts coming from GuardDuty, Inspector, Macie and Firewall Manager.
• Works across multiple accounts.

Question 2

Guard Duty

Answer 2

• Threat detection service using machine learning to detect malicious behavior.
• Also uses third-party databases of known malicious activity.
• Monitors CloudTrail, VPC flow and DNS logs
• Triggers EventBridge when a threat is dectected.
• Centralizes threat detection across multiple AWS accounts.

Question 3

Service Catalog

Answer 3

• Allows organizations to manage a curated list of IT services (AMIs, software, databases, …)
• End users can easily deploy pre-approved catalog items
• A template is a stack defined using IaC (Terraform or CloudFormation).

Question 4

Inspector

Answer 4

Uses best practices and scans for vulnerabilities in EC2 instances (via SSM agent), Container images, Lambda functions

Question 5

Control Tower

Answer 5

Extends AWS Organizations to prevent governance drift and leverages different guardrails (high-level rules).