AWS Cloud & DevOps Tutorial 0/70 lessons ~6 min read Lesson 43“IAM, VPC, EC2, Lambda, ECS, EKS, Terraform, CI/CD, and AWS operations”

GuardDuty, Security Hub and Inspector

Edge WAF blocks bad HTTP. It does not notice an access key that leaked into a public GitHub gist, an EC2 instance mining cryptocurrency after a vulnerable library was exploited, or

Course progress0%

Focus

15 guided sections

Practice signal

Examples included

Career prep

Interview Q&A included

GuardDuty, Security Hub and Inspector

AWS Cloud & DevOps Engineering · Lesson 43 · Observability, Security and Reliability

Lesson Overview

Edge WAF blocks bad HTTP. It does not notice an access key that leaked into a public GitHub gist, an EC2 instance mining cryptocurrency after a vulnerable library was exploited, or a golden AMI that shipped with a critical CVE. Amazon GuardDuty is a threat detection service that analyzes AWS telemetry (such as CloudTrail management events, VPC Flow Logs, and DNS logs—confirm current data sources and optional features in documentation) to produce findings. AWS Security Hub aggregates security findings from AWS services and supported partner products, maps them to security standards, and gives TechLearningPro a single posture board instead of twelve inboxes. Amazon Inspector continuously scans AWS workloads such as EC2, container images in ECR, and Lambda (verify current supported resource types) for software vulnerabilities and network reachability issues, producing CVSS-oriented findings you can prioritize.

The operational enemy is alert spam: every LOW finding emailed to everyone until humans mute the channel and miss the CRITICAL. This lesson teaches enablement, routing, triage matrices, suppression discipline, and pipeline gates—so detection informs action. Cross-links: AWS CloudTrail and Audit Logging, AWS WAF, Shield and Edge Security, Incident Management and SRE Fundamentals. Tag Project=tlp-lesson43. Budget before enabling detectors, Hub standards, and Inspector scanning at scale; clean up lab event rules and understand that some security services bill while enabled.

Learning Objectives

Explain GuardDuty’s role as managed threat detection over AWS telemetry sources.
Interpret finding severity and types without memorizing every finding ID.
Position Security Hub as aggregation, standards scoring, and cross-product correlation—not a replacement for GuardDuty or Inspector.
Use Inspector findings to prioritize patching of EC2, container images, and functions as supported.
Build a triage matrix that routes by severity, environment tags, and asset criticality.
Design EventBridge-based alerting for HIGH/CRITICAL only (verify event schemas in docs).
Apply suppressions/archival with expiry and owners—never silent global mute.
Plan multi-account delegated administrator patterns for GuardDuty and Security Hub.
Connect findings to CloudTrail investigation and incident severities from lessons 37 and 40.
Distinguish vulnerability management (Inspector) from threat detection (GuardDuty) from posture compliance (Hub standards / Config in lesson 44).
Estimate cost drivers and verify live pricing pages; avoid “enable all features in all Regions” accidents.
Gate deployments on critical image CVEs without inventing undocumented CI plugins.
Write a suspicious-activity runbook for TechLearningPro on-call.
Troubleshoot missing findings (service disabled, wrong account, filtered views).
Clean up lab routing and document what remains intentionally enabled.
Prepare interview answers on prioritization and false positives.
Map detections to Well-Architected Security pillar practices.
Preview Config conformance as complementary detective compliance automation.

Prerequisites

CloudTrail mental model (lesson 37); CloudWatch alarms (lesson 36); incident process (lesson 40).
IAM Identity Center / Organizations awareness for multi-account.
Budget alert; sandbox account preferred for experiments.
Read current GuardDuty, Security Hub, and Inspector documentation for feature toggles and pricing.

Detailed Core Concepts

GuardDuty

GuardDuty produces findings when its analysis detects suspicious or unexpected activity patterns. Exact finding types evolve—learn to read the finding’s title, severity, resource, and remediation guidance rather than rote-listing IDs. Optional protection plans/features (for example, S3 protection, EKS protection, malware protection, RDS login activity—confirm current feature names and costs) extend detection; enable deliberately per OU. GuardDuty is not an IPS that blocks traffic by itself; integrate with response automation carefully and prefer human approval for destructive containment in early maturity.

Security Hub

Security Hub ingests findings, deduplicates/normalizes where applicable, and evaluates accounts against enabled security standards (AWS and industry frameworks as offered—verify current list). Controls show PASSED/FAILED/WARNING/NOT_AVAILABLE style statuses. Insights help slice failed controls. Hub without owners is a dashboard nobody watches; Hub with weekly triage and tickets is a program.

Inspector

Inspector scans for vulnerabilities (CVEs) and, where applicable, network exposure paths. For containers, scanning ECR images catches issues before ECS/EKS deploy if you gate the pipeline. For EC2, agent-based or agentless modes may exist depending on current product capabilities—verify before designing AMIs. Prioritize CRITICAL/HIGH on internet-facing and data-sensitive workloads first; do not pretend every LOW in sandbox equals production risk.

Triage, not spam

Severity alone is insufficient. A CRITICAL CVE on a private, non-running lab AMI differs from CRITICAL on the production learner API task definition. Multiply severity by exposure by data class by exploit maturity. Page humans for active threat findings on prod; ticket vulnerabilities into sprint SLAs; auto-archive noisy informational findings with review.

Relationship to Config and WAF

WAF: request-time edge filtering. GuardDuty: anomalous behavior/threats. Inspector: known vulnerabilities. Config (next lesson): configuration compliance. Security Hub: often the aggregation lens. TechLearningPro needs all layers; none replaces another.

Architecture and Design Diagrams

mermaid
flowchart TB
  CT[CloudTrail VPC Flow DNS and other sources]
  GD[GuardDuty detector]
  IN[Inspector scans]
  Other[IAM Access Analyzer partner findings]
  Hub[Security Hub]
  EB[EventBridge rules]
  Ticket[Ticketing and ChatOps]
  IR[Incident response lesson 40]

  CT --> GD --> Hub
  IN --> Hub
  Other --> Hub
  Hub --> EB --> Ticket
  GD -->|HIGH threat| IR
  Ticket --> IR

mermaid
flowchart LR
  Finding[New finding]
  Sev{Severity}
  Env{Environment tag}
  Act[Action]
  Finding --> Sev --> Env --> Act
  Act -->|prod CRITICAL threat| Page
  Act -->|prod CRITICAL CVE| PatchSLA
  Act -->|sandbox LOW| WeeklyBatch

Technical Explanation

Enabling and Regions

GuardDuty and Inspector are Regional; Security Hub is Regional with optional cross-Region aggregation features—confirm current aggregation setup. Enabling in unused Regions multiplies cost. TechLearningPro should define approved Regions and enable security services there first.

Findings lifecycle

Findings can be active, archived, or suppressed depending on product semantics—use current console/API terms. Suppressions must include reason, owner, and expiry in your external tracker even if the service field set is limited. Revisit suppressions monthly.

Automation caution

Auto-isolating instances on every finding can deny-of-service yourself when a false positive hits. Start with notification-only; add Step Functions response playbooks with dual approval for containment. Never auto-delete production resources from a finding webhook.

Pipeline integration

Export or API-poll Inspector/ECR scan results in CI. Fail prod deploys on CRITICAL with allowed exception registry (lesson 35 style). Sandbox pipelines may warn. Pin scanner versions/config; document the gate in the deployment ADR.

Performance and scale

Thousands of findings across member accounts require insights, filters, and automation—not spreadsheet exports. Use Security Hub insights and filtered views. Age reports: critical findings older than SLA are a management metric.

Security of security tooling

Who can disable GuardDuty or archive findings is highly privileged. SCPs can deny guardduty:DeleteDetector in prod OUs (intent-level; exact SCP in landing-zone work). CloudTrail must record these API calls.

Cost drivers

GuardDuty prices by analyzed volume dimensions and optional features; Security Hub by checks/findings ingest; Inspector by accounts/resources scanned—verify current pricing. Classroom illustrative rates are forbidden as quotes; screenshot the pricing page date in labs.

Practical Implementation or Design Walkthrough

Problem

Design triage for suspicious activity (GuardDuty) and vulnerable workloads (Inspector), with Security Hub as the aggregation pane.

Steps

Budget alert; tag Project=tlp-lesson43.
Confirm or enable GuardDuty in one Region; note features.
Enable Security Hub; enable one foundational standard; wait for control results.
Enable Inspector for a small scope (one account/Region, limited resources).
Build triage matrix document and EventBridge→SNS for HIGH/CRITICAL only.
Practice archiving a noisy lab finding with written rationale.
ADR: paging policy, SLA, multi-account admin, cost boundaries.
Cleanup lab rules; decide intentional leave-on vs disable for pure sandbox.

Enterprise Real-World Scenarios

Crypto mining finding on forgotten ASG instance

GuardDuty flags unusual DNS/network. On-call isolates via SG, rotates instance profile credentials if needed, terminates instance, patches AMI, reviews how SSRF/vuln led here. Hub ticket links Inspector CVEs on that AMI.

Hub score obsession

Leadership wants 100% Security Hub score. Teams open overly broad suppressions. Fix: track accepted risk register; score is a conversation starter, not a bonus metric.

Inspector CRITICAL blocks release

Friday deploy fails on CVE in base image. Correct: patch base, rebuild, redeploy. Incorrect: force mute gate “until Monday” without exception expiry.

Partner finding flood

A partner integration sends low-value findings into Hub. Filter at ingestion or disable the product integration; protect on-call attention.

Disabled in sandbox, forgotten in prod twin

Someone copies scripts that disable GuardDuty to save cost; script runs in prod. SCP and CloudTrail alerts should catch—design that detection.

Best Practices

Enable GuardDuty in approved Regions with intentional feature set.
Aggregate in Security Hub with clear owners.
Page on active threats; SLA patch on vulns; batch lows.
Tag resources for routing.
Suppress with expiry and ticket links.
Dual-control destructive automation.
Gate prod images on CRITICAL CVEs.
Weekly aging review of open criticals.
Deny detector deletion via org policy intent in prod OUs.
Budget and review optional protection plans quarterly.
Train on-call on finding anatomy.
Correlate with CloudTrail and VPC Flow during investigations.
Keep sandbox noise out of prod paging channels.
Document multi-account delegated admins.
Measure MTTA/MTTR for security findings like SRE incidents.

Common Mistakes and Anti-Patterns

Email every finding to a huge DL.
Enable all features all Regions blindly.
Treat Hub score as the only KPI.
Infinite suppressions.
No link from findings to incident process.
Assuming WAF makes GuardDuty unnecessary.
Ignoring Inspector on container images.
Auto-remediation without staging.
No ownership tags—findings orphaned.
Turning off detection to silence noise.

Troubleshooting and Design Review

Symptom	Cause	Action
No findings ever	Detector off / wrong Region	Verify enablement
Hub empty	Standards not enabled / no ingest	Enable standards; check integrations
Alert fatigue	Too broad EventBridge pattern	Filter severity/product
Missing EC2 CVEs	Inspector not covering account/resource	Check coverage
Can’t tell prod vs lab	Missing tags	Enforce tagging; filter views

Interview Questions and Answers

Q1: GuardDuty purpose? A: Managed threat detection from AWS data sources producing actionable findings.
Q2: Security Hub purpose? A: Central security posture findings and standards compliance aggregation.
Q3: Inspector purpose? A: Vulnerability scanning for supported workloads/images/functions.
Q4: How prioritize? A: Severity × exposure × data sensitivity × environment.
Q5: Does GuardDuty block attacks? A: Detects; response is separate automation/human process.
Q6: Multi-account? A: Delegated admin / member accounts per current org guidance.
Q7: Relation to CloudTrail? A: Telemetry source and investigation deep dive.
Q8: Suppressions? A: Time-bounded, owned, reviewed.
Q9: CI gating? A: Fail prod on critical image vulns with exception registry.
Q10: Cost control? A: Limit Regions/features; right-size; verify pricing.
Q11: Alert spam fix? A: Severity filters, env routing, weekly batches for lows.
Q12: vs Config? A: Threats/vulns/posture findings vs configuration compliance rules.
Q13: False positive handling? A: Validate, archive with rationale, tune.
Q14: Who gets paged? A: On-call for active prod threats; service owners for vulns by SLA.
Q15: First five minutes on CRITICAL IAM finding? A: Validate, check CloudTrail, contain credentials, incident channel.

Hands-On Exercises

Exercise: Triage design for suspicious activity and vulnerable workloads

Deliverable: triage matrix, enablement evidence, Hub standards screenshot, Inspector sample or coverage proof, EventBridge pattern draft, runbook, ADR, cleanup notes.

Challenge ADR

Argue against “email all Security Hub findings to engineering@” and for filtered ChatOps + SLAs.

Lab evidence checklist

Budget; tags; detector/Hub/Inspector proof; matrix doc; filter rule; cleanup.

Narrative: leaked key

GuardDuty IAM anomaly; CloudTrail shows API from unexpected geo; key deactivated; WAF unrelated; Hub ticket closed with lessons for secret scanning in CI.

Continuity

Next: AWS Config and Compliance Automation for configuration rules and conformance packs that Security Hub often surfaces as failed controls.

Deep dive: finding fields that matter

Always read resource ARN/ID, account, Region, severity, count/first-seen/last-seen, and remediation text. Copy finding ID into tickets. Screenshots without IDs waste investigations.

Deep dive: standards vs threats

A failed Hub control “S3 bucket should block public access” may coexist with zero GuardDuty findings. Compliance failure is still risk. Config remediations (lesson 44) address many Hub control failures.

Deep dive: malware and snapshot considerations

If malware protection features are enabled, understand storage and snapshot cost implications from current docs before enterprise rollout. Pilot in non-prod.

Runbook: credential finding

Declare incident severity. 2. Disable access key / revoke session. 3. CloudTrail review. 4. Check resource creation. 5. Rotate dependent secrets. 6. Postmortem with secret scanning gaps.

Extended practice scenario 1 — 43 guardduty security hub and inspector

Enable GuardDuty in one lab Region (or confirm already enabled). Capture a findings list screenshot even if empty. Document detector ID and feature set toggles you left at defaults versus intentionally changed—verify feature names in current docs.

In a timed drill for findings triage without alert spam, implement or design the core lab with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, console or CLI output, and destroy/disable confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, CloudWatch alarms, WAF/edge controls where relevant, and CI promotion rules from Module 3. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 2 — 43 guardduty security hub and inspector

Design a triage matrix: severity × asset criticality × exploitability. Apply it to five invented finding summaries (crypto mining on EC2, unusual IAM API call, open security group reported via Hub, Inspector critical CVE on AMI, S3 public). Assign owner team and SLA.

Extended practice scenario 3 — 43 guardduty security hub and inspector

Connect Security Hub conceptually: which standards would TechLearningPro enable first (e.g., AWS Foundational Security Best Practices—confirm current standard names)? List ten controls you expect to fail in a messy sandbox and how you’d fix the top three.

Extended practice scenario 4 — 43 guardduty security hub and inspector

Inspector focus: choose EC2 scanning or ECR image scanning for a lab image. Record how findings appear and how you would gate a pipeline without inventing undocumented Jenkins plugins—describe the check at a high level and cite docs you would read.

Extended practice scenario 5 — 43 guardduty security hub and inspector

Suppressions/archival policy: write rules for auto-archiving informational findings older than 30 days versus never auto-closing critical GuardDuty findings without human sign-off.

Extended practice scenario 6 — 43 guardduty security hub and inspector

Noise reduction: identify three finding types likely to spam TechLearningPro sandboxes and propose filters, member account strategies, or separate sandbox detectors/accounts.

Extended practice scenario 7 — 43 guardduty security hub and inspector

EventBridge routing sketch: GuardDuty/Security Hub findings → EventBridge rule → SNS or incident tool for HIGH/CRITICAL only. Verify event patterns against current docs before implementing.

Extended practice scenario 8 — 43 guardduty security hub and inspector

Multi-account: delegated administrator mental model for GuardDuty and Security Hub. Who enables, who triages, who pays?

Extended practice scenario 9 — 43 guardduty security hub and inspector

Map a GuardDuty IAM finding to CloudTrail investigation steps from lesson 37 without inventing event names—list the questions you would ask and where you’d look.

Extended practice scenario 10 — 43 guardduty security hub and inspector

Write a one-page runbook: ‘Suspicious EC2 communication finding.’ Include containment options (SG tighten, isolate instance, rotate credentials) with approval gates.

Extended practice scenario 11 — 43 guardduty security hub and inspector

Compare Inspector CVE findings versus container SCA in CI (lesson 19 themes). When does each catch issues the other misses?

Extended practice scenario 12 — 43 guardduty security hub and inspector

Security Hub insights: design two custom insights (e.g., failed controls on public S3; critical findings on prod tags). Confirm insight configuration in docs.

Extended practice scenario 13 — 43 guardduty security hub and inspector

Cost worksheet: GuardDuty pricing dimensions, Security Hub, Inspector—mark every number as ‘verify on pricing page’ with date checked.

Extended practice scenario 14 — 43 guardduty security hub and inspector

False positive drill: a finding on a deliberate port scan from your bastion. Document how you verify legitimacy and archive with rationale.

Extended practice scenario 15 — 43 guardduty security hub and inspector

Tag strategy: require Environment and Owner tags so findings can be routed; note resources without tags escalate to platform team.

Extended practice scenario 16 — 43 guardduty security hub and inspector

Integrate with lesson 40 incident severities: which finding classes page humans at 2 a.m. versus next business day?

Extended practice scenario 17 — 43 guardduty security hub and inspector

EKS/ECS note: where runtime threat detection overlaps GuardDuty features—read current feature lists; do not claim coverage you did not verify.

Extended practice scenario 18 — 43 guardduty security hub and inspector

Create an evidence pack template for auditors: enablement proof, standards subscribed, sample remediated finding, SLA metrics.

Extended practice scenario 19 — 43 guardduty security hub and inspector

Disabling/suspend caution: explain why turning off GuardDuty in prod to ‘save money’ fails audit and risk reviews; propose right-sizing features instead.

Extended practice scenario 20 — 43 guardduty security hub and inspector

Cross-link WAF: show a case where WAF blocked L7 abuse but GuardDuty still catches compromised keys used from inside.

Extended practice scenario 21 — 43 guardduty security hub and inspector

Build a weekly review agenda: 30 minutes, top findings, aging criticals, suppression audit, new Inspector CVEs on golden AMIs.

Extended practice scenario 22 — 43 guardduty security hub and inspector

Pipeline fail-on-critical: describe ECR enhanced scanning / Inspector results breaking a deploy to prod OU only; sandbox may warn.

Extended practice scenario 23 — 43 guardduty security hub and inspector

ChatOps message template for a HIGH finding with deep links to console (account, Region, finding ID).

Extended practice scenario 24 — 43 guardduty security hub and inspector

Cleanup lab: disable unused Inspector scans, remove test EventBridge rules, confirm budget alert remains, note Cost Explorer lag.

Extended practice scenario 25 — 43 guardduty security hub and inspector

Full dress rehearsal stopwatch: enable → sample finding or generate with AWS-documented ways if any → triage ticket → Hub view → cleanup plan.

Compliance evidence pack for auditors

Enablement timestamps, standards list, sample CRITICAL closed within SLA, suppression register export, delegated admin account ID, pricing review date.

Glossary drill

Detector; finding; severity; Security Hub standard; control status; insight; Inspector CVE; package vulnerability; network reachability; suppression; delegated administrator; member account; protection plan.

Budget and cleanup sworn statement

State what remains enabled intentionally versus disabled after lab; budget alert on; Cost Explorer review scheduled.

Interview story to memorize

“We routed only HIGH/CRITICAL GuardDuty and Hub findings to on-call, batched lows weekly, gated prod images on Inspector CRITICAL, and refused suppressions without expiry—noise down, response up.”

Module continuity paragraph

Lesson 42 filtered the edge. Lesson 43 detects account-level threats and vulns. Lesson 44 encodes configuration desired state. Together they form detective and preventive security operations for TechLearningPro.

Final synthesis before summary

Detection without triage is theater. Triage without ownership is a dashboard. Ownership without SLAs is hope. Build the program: enable carefully, filter ruthlessly, patch deliberately, page rarely but meaningfully.

Lesson Summary

GuardDuty detects threats, Inspector surfaces vulnerabilities, and Security Hub aggregates posture—TechLearningPro wins when findings are triaged by severity and context instead of spammed. Budget features and Regions, automate notifications narrowly, suppress with expiry, and connect to incident response. Tag Project=tlp-lesson43 and clean up lab routing.

Next: AWS Config and Compliance Automation.

GuardDuty, Security Hub and Inspector

GuardDuty, Security Hub and Inspector

Lesson Overview

Learning Objectives

Prerequisites

Detailed Core Concepts

GuardDuty

Security Hub

Inspector

Triage, not spam

Relationship to Config and WAF

Architecture and Design Diagrams

Technical Explanation

Enabling and Regions

Findings lifecycle

Automation caution

Pipeline integration

Performance and scale

Security of security tooling

Cost drivers

Practical Implementation or Design Walkthrough

Problem

Steps

Enterprise Real-World Scenarios

Crypto mining finding on forgotten ASG instance

Hub score obsession

Inspector CRITICAL blocks release

Partner finding flood

Disabled in sandbox, forgotten in prod twin

Best Practices

Common Mistakes and Anti-Patterns

Troubleshooting and Design Review

Interview Questions and Answers

Hands-On Exercises

Exercise: Triage design for suspicious activity and vulnerable workloads

Challenge ADR

Lab evidence checklist

Narrative: leaked key

Continuity

Deep dive: finding fields that matter

Deep dive: standards vs threats

Deep dive: malware and snapshot considerations

Runbook: credential finding

Extended practice scenario 1 — 43 guardduty security hub and inspector

Extended practice scenario 2 — 43 guardduty security hub and inspector

Extended practice scenario 3 — 43 guardduty security hub and inspector

Extended practice scenario 4 — 43 guardduty security hub and inspector

Extended practice scenario 5 — 43 guardduty security hub and inspector

Extended practice scenario 6 — 43 guardduty security hub and inspector

Extended practice scenario 7 — 43 guardduty security hub and inspector

Extended practice scenario 8 — 43 guardduty security hub and inspector

Extended practice scenario 9 — 43 guardduty security hub and inspector

Extended practice scenario 10 — 43 guardduty security hub and inspector

Extended practice scenario 11 — 43 guardduty security hub and inspector

Extended practice scenario 12 — 43 guardduty security hub and inspector

Extended practice scenario 13 — 43 guardduty security hub and inspector

Extended practice scenario 14 — 43 guardduty security hub and inspector

Extended practice scenario 15 — 43 guardduty security hub and inspector

Extended practice scenario 16 — 43 guardduty security hub and inspector

Extended practice scenario 17 — 43 guardduty security hub and inspector

Extended practice scenario 18 — 43 guardduty security hub and inspector

Extended practice scenario 19 — 43 guardduty security hub and inspector

Extended practice scenario 20 — 43 guardduty security hub and inspector

Extended practice scenario 21 — 43 guardduty security hub and inspector

Extended practice scenario 22 — 43 guardduty security hub and inspector

Extended practice scenario 23 — 43 guardduty security hub and inspector

Extended practice scenario 24 — 43 guardduty security hub and inspector

Extended practice scenario 25 — 43 guardduty security hub and inspector

Compliance evidence pack for auditors

Glossary drill

Budget and cleanup sworn statement

Interview story to memorize

Module continuity paragraph

Final synthesis before summary

Lesson Summary

Further Reading