Security, identity, and compliance services: choosing the right one
What each of the nineteen SAA-C03 security, identity, and compliance services does, grouped into identity and access, data protection, network and application protection, and detection and compliance, with a reverse mindmap and the most commonly confused pairs.
4 min read · Last reviewed · SAA-C03
Loading your progress
Sign in to bookmark tutorials and track what you have read.
On this page
The services at a glance
The Security, Identity, and Compliance category covers nineteen services in four groups. Each service name links to its own tutorial. Two topic tutorials cover themes across services: IAM roles and temporary credentials and encryption keys, certificates, and data retention.
Identity and access
| Service | What it does |
|---|---|
| AWS IAM | Users, groups, roles, and policies that control who can do what |
| AWS IAM Identity Center | SSO (Single sign-on)Signing in once to reach many applications or accounts without signing in to each again. AWS IAM Identity Center provides single sign-on to AWS accounts and applications.Glossary entry for employees to AWS accounts and applications |
| Amazon Cognito | Sign-up, sign-in, and AWS credentials for app customers |
| AWS Directory Service | Managed Microsoft Active Directory, or a connector to your own AD |
| AWS Resource Access Manager (RAM) | Share resources such as SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry and transit gateways across accounts |
Data protection
| Service | What it does |
|---|---|
| AWS Key Management Service (KMS) | Create and control encryption keys, integrated with most AWS services |
| AWS CloudHSM | Dedicated, single-tenant HSM (Hardware security module)A tamper-resistant hardware device that creates and stores cryptographic keys and uses them without ever exposing them. AWS KMS uses HSMs internally; AWS CloudHSM gives you dedicated HSMs that you control.Glossary entry that you control |
| AWS Certificate Manager (ACM) | Provision and renew TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry certificates for AWS services |
| AWS Secrets Manager | Store, rotate, and retrieve secrets such as database passwords |
| Amazon Macie | Discover sensitive data, such as personal data, in S3 |
Network and application protection
| Service | What it does |
|---|---|
| AWS WAF | Filter web requests to CloudFront, ALB, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway, and more |
| AWS Shield | DDoS (Distributed denial of service)An attack that floods an application or network with traffic from many sources at once, to make it unavailable to real users. AWS Shield Standard protects every AWS customer from common network-layer DDoS attacks at no extra cost.Glossary entry protection (Standard for everyone, Advanced for more) |
| AWS Network Firewall | Managed StatefulKeeping track of earlier requests or connections. A stateful firewall, such as a security group, remembers allowed connections and lets their return traffic back in automatically.Glossary entry firewall and intrusion prevention for VPCs |
| AWS Firewall Manager | Central management of WAF, Shield, Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry, and Network Firewall rules across accounts |
Detection and compliance
| Service | What it does |
|---|---|
| Amazon GuardDuty | Threat detection from CloudTrail, VPC Flow Logs, DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry logs, and more |
| Amazon Inspector | Vulnerability scanning for EC2, container images, and Lambda |
| Amazon Detective | Investigate the root cause of security findings |
| AWS Security Hub | Central security posture (Security Hub CSPM (Cloud security posture management)Continuously checking cloud resources against security best practices and standards, and reporting misconfigurations, such as a public S3 bucket. AWS Security Hub CSPM runs these checks across AWS accounts.Glossary entry) and correlated findings across accounts |
| AWS Artifact | Download AWS compliance reports and accept agreements |
Reverse mindmap: from the question to the service
- Who can access
- Permissions for users, roles, services leads to IAM
- Employees sign in once to many accounts leads to IAM Identity Center
- App customers sign up and sign in leads to Cognito
- Active Directory in AWS leads to Directory Service
- Share subnets with other accounts leads to RAM
- Protect data
- Encryption keys for AWS services leads to KMS
- Single-tenant HSM under our control leads to CloudHSM
- Free public TLS certificates that renew leads to ACM
- Rotate database passwords leads to Secrets Manager
- Find personal data in S3 leads to Macie
- Protect networks and apps
- SQL injection, bad bots, rate limits leads to WAF
- DDoS protection and response team leads to Shield Advanced
- Inspect VPC traffic with stateful rules leads to Network Firewall
- Same rules in every account leads to Firewall Manager
- Detect and comply
- Threats from logs, no agents leads to GuardDuty
- Vulnerabilities in instances and images leads to Inspector
- Root cause of a finding leads to Detective
- One view of security across accounts leads to Security Hub
- SOC or PCI report from AWS leads to Artifact
Commonly confused pairs
| If the choice is between | Choose the first when | Choose the second when |
|---|---|---|
| IAM Identity Center or Cognito | Employees need AWS account access | Customers need app sign-in |
| KMS or CloudHSM | Managed keys integrated with AWS services | You must control the HSM yourself, single tenant |
| Secrets Manager or Parameter Store | Secrets need automatic rotation | Configuration values and simple secrets |
| WAF or Shield | Filter web requests by content | Protect against DDoS attacks |
| GuardDuty or Inspector | Detect active threats from logs | Find software vulnerabilities |
| GuardDuty or Macie | Threats across the account | Sensitive data in S3 |
| Security Hub or Detective | Aggregate findings and check posture | Investigate a finding in depth |
Key takeaways
- Identity: IAM for permissions, Identity Center for employees, Cognito for customers, Directory Service for AD, RAM for sharing.
- Data: KMS for keys, CloudHSM for dedicated HSMs, ACM for certificates, Secrets Manager for rotating secrets, Macie for sensitive data in S3.
- Network and apps: WAF for web filtering, Shield for DDoS, Network Firewall for VPC traffic, Firewall Manager to apply them everywhere.
- Detection: GuardDuty (threats), Inspector (vulnerabilities), Detective (investigation), Security Hub (posture), Artifact (compliance reports).
Sources
- AWS Certification: SAA-C03 in-scope AWS services
- IAM User Guide: What is IAM?
- IAM Identity Center User Guide: What is IAM Identity Center?
- Amazon Cognito Developer Guide: What is Amazon Cognito?
- AWS Directory Service Administration Guide: What is AWS Directory Service?
- AWS KMS Developer Guide: AWS Key Management Service
- AWS WAF Developer Guide: What are AWS WAF, AWS Shield, and AWS Firewall Manager?
- Amazon GuardDuty User Guide: What is Amazon GuardDuty?
- AWS Security Hub User Guide: Introduction to AWS Security Hub CSPM