Introduction Understand Consider Choose Use Explore

Choosing AWS security, identity, and governance services

Taking the first step

Time to read	27 minutes
Purpose	Help you determine which AWS security, identity, and governance services are the best fit for your organization.
Last updated	June 25, 2024
Services covered	AWS Artifact AWS Audit Manager AWS Certificate Manager AWS CloudHSM AWS CloudTrail Amazon Cognito AWS Config AWS Control Tower Amazon Detective AWS Firewall Manager Amazon GuardDuty AWS IAM AWS IAM Identity Center	Amazon Inspector AWS KMS Amazon Macie AWS Network Firewall AWS Organizations AWS Private CA AWS RAM AWS Secrets Manager AWS Security Hub Amazon Security Lake AWS Shield AWS WAF

Introduction

Security, identity, and governance in the cloud are important components for you in achieving and maintaining integrity and safety for your data and services. This is especially relevant as more businesses migrate to cloud providers such as Amazon Web Services (AWS).

This guide helps you select the AWS security, identity, and governance services and tools that are the best fit for your needs and your organization.

First, let's explore what we mean by security, identity, and governance:

Cloud security refers to using measures and practices to protect digital assets from threats. This includes both the physical security of data centers and cybersecurity measures to guard against online threats. AWS prioritizes security through encrypted data storage, network security, and continuous monitoring of potential threats.
Identity services help you securely manage identities, resources, and permissions in a scalable way. AWS provides identity services designed for workforce and customer-facing applications, and for managing access to your workloads and applications.
Cloud governance is a set of rules, processes, and reports that guide your organization to follow best practices. You can establish cloud governance across your AWS resources, use built-in best practices and standards, and automate compliance and auditing processes. Compliance in the cloud refers to adhering to laws and regulations governing data protection and privacy. AWS Compliance Programs provides information about the certifications, regulations, and frameworks that AWS aligns with.

This six-minute excerpt is from a lightning talk at re:Inforce 2024 by Himanshu Verma, Security Specialist Leader at AWS, and Ross Warren, Security Lake Solutions Architect at AWS. They provide a quick overview of using Security Lake and artificial intelligence for threat analysis. Security Lake centralizes your security data into a data lake.

Understand

Security and compliance are shared responsibilities

Before choosing your AWS security, identity, and governance services, it's important for you to understand that security and compliance are shared responsibilities between you and AWS.

The nature of this shared responsibility helps relieve your operational burden, and it provides you with flexibility and control over your deployment. This differentiation of responsibility is commonly referred to as security "of" the cloud and security "in" the cloud.

With an understanding of this model, you can understand the range of options available to you, and how the applicable AWS services fit together.

You can combine AWS tools and services to help safeguard your workloads

The five domains across security, identity, and governance include identity and access management, network and app protection, data protection, detection and response, and governance and compliance.

As shown in the previous diagram, AWS offers tools and services across five domains to help you achieve and maintain robust security, identity management, and governance in the cloud. You can use AWS services across these five domains to help you do the following:

Form a multilayered approach to safeguarding your data and environments
Fortify your cloud infrastructure against evolving threats
Adhere to strict regulatory standards

To learn more about AWS security, including security documentation for AWS services, see AWS Security Documentation.

In the following sections, we examine each domain further.

Identity and access management

At the center of AWS security is the principle of least privilege: individuals and services have only the access that they need. AWS IAM Identity Center is the recommended AWS service for managing user access to AWS resources. You can use this service to manage access to your accounts and permissions within those accounts, including identities from external identity providers.

The following table summarizes the identity and access management offerings discussed in this guide:

AWS IAM Identity Center

Helps you create or connect users and centrally manage access across AWS accounts and applications.

Amazon Cognito

Provides an identity tool for web and mobile apps to authenticate and authorize users from the built-in user directory, your enterprise directory, and consumer identity providers.

AWS RAM

Helps you securely share your resources across AWS accounts, within your organization, and with IAM roles and users.

IAM

Helps you centrally manage permissions that control which AWS resources users can access.

Data protection

Data protection is vital in the cloud, and AWS provides services that help you protect your data, accounts, and workloads. For example, encrypting your data both in transit and at rest helps protect it from exposure. With AWS Key Management Service (AWS KMS) and AWS CloudHSM you can create and control the cryptographic keys that you use to protect your data.

The following table summarizes the data protection offerings discussed in this guide:

Amazon Macie

Discovers sensitive data by using machine learning and pattern matching, and enables automated protection against associated risks.

AWS KMS

Creates and controls the cryptographic keys that you use to protect your data.

AWS CloudHSM

Provides highly available, cloud-based hardware security modules (HSMs).

AWS Certificate Manager

Handles the complexity of creating, storing, and renewing public and private SSL/TLS X.509 certificates and keys.

AWS Private CA

Helps you create private certificate authority hierarchies, including root and subordinate certificate authorities (CAs).

AWS Secrets Manager

Helps you manage, retrieve, and rotate database credentials, application credentials, OAuth tokens, API keys, and other secrets.

Network and application protection

AWS offers several services to protect your networks and applications. AWS Shield provides you with protection against Distributed Denial of Service (DDoS) attacks, and AWS WAF helps you protect web applications from common web exploitation attacks.

The following table summarizes the network and application protection offerings discussed in this guide:

AWS Firewall Manager

Simplifies your administration and maintenance tasks across multiple accounts and resources for protection.

AWS Network Firewall

Provides a stateful, managed network firewall and intrusion detection and prevention service with your VPC.

AWS Shield

Provides protections against DDoS attacks for AWS resources at the network, transport, and application layers.

AWS WAF

Provides a web application firewall so you can monitor the HTTP(S) requests that are forwarded to your protected web application resources.

Detection and response

AWS provides tools to help you streamline security operations across your AWS environment, including multi-account environments. For example, you can use Amazon GuardDuty for intelligent threat detection, and you can use Amazon Detective to identify and analyze security findings by collecting log data. AWS Security Hub supports multiple security standards and provides an overview of security alerts and compliance status across AWS accounts. AWS CloudTrail tracks user activity and application programming interface (API) usage, which is crucial for understanding and responding to security events.

The following table summarizes the detection and response offerings discussed in this guide:

AWS Config

Provides a detailed view of the configuration of AWS resources in your AWS account.

AWS CloudTrail

Records actions taken by a user, role, or AWS service.

AWS Security Hub

Provides a comprehensive view of your security state in AWS.

Amazon GuardDuty

Continuously monitors your AWS accounts, workloads, runtime activity, and data for malicious activity.

Amazon Inspector

Scans your AWS workloads for software vulnerabilities and unintended network exposure.

Amazon Security Lake

Automatically centralizes security data from AWS environments, SaaS providers, on-premises environments, cloud sources, and third-party sources into a data lake.

Amazon Detective

Helps you analyze, investigate, and quickly identify the root cause of security findings or suspicious activities.

Governance and compliance

AWS provides tools that help you adhere to your security, operational, compliance, and cost standards. For example, you can use AWS Control Tower to set up and govern a multi-account environment with prescriptive controls. With AWS Organizations, you can set up policy-based management for multiple accounts within your organization.

AWS also gives you a comprehensive view of your compliance status and continuously monitors your environment by using automated compliance checks based on the AWS best practices and industry standards that your organization follows. For example, AWS Artifact provides on-demand access to compliance reports, and AWS Audit Manager automates evidence collection so that you can more easily assess whether your controls are operating effectively.

The following table summarizes the governance and compliance offerings discussed in this guide:

AWS Organizations

Helps you consolidate multiple AWS accounts into an organization that you create and centrally manage.

AWS Control Tower

Helps you set up and govern an AWS multi-account environment that's based on best practices.

AWS Artifact

Provides on-demand downloads of AWS security and compliance documents.

AWS Audit Manager

Helps you continuously audit your AWS usage to simplify how you assess risk and compliance.

Consider

Choosing the right security, identity, and governance services on AWS depends on your specific requirements and use cases. Deciding to adopt an AWS security service provides a decision tree to help you decide if adopting AWS services for security, identity, and governance is suitable for your organization. In addition, here are some criteria to consider when making your decision about which services to use.

Security requirements and threat landscape

Conduct a comprehensive assessment of your organization's specific vulnerabilities and threats. This involves identifying the types of data that you handle, such as personal customer information, financial records, or proprietary business data. Understand the potential risks associated with each.

Assess your application and infrastructure architecture. Determine whether your applications are public-facing and what kind of web traffic they handle. This factors into your need for services such as AWS WAF to protect against web exploitation. For internal applications, consider the importance of internal threat detection and continuous monitoring with Amazon GuardDuty, which can identify unusual access patterns or unauthorized deployments.

Finally, consider the sophistication of your existing security posture and the expertise of your security team. If your team has limited resources, choosing services that offer more automation and integration can provide you with effective security enhancements, without overwhelming your team. Example services include AWS Shield for DDoS protection and AWS Security Hub for centralized security monitoring.

Compliance and regulatory requirements

Identify the relevant laws and standards for your industry or geographic region, such as General Data Protection Regulation (GDPR), the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA), or Payment Card Industry Data Security Standard (PCI DSS).

AWS offers services such as AWS Config and AWS Artifact to help you manage compliance with various standards. With AWS Config, you can assess, audit, and evaluate the configurations of your AWS resources, making it easier for you to ensure compliance with internal policies and regulatory requirements. AWS Artifact provides on-demand access to AWS compliance documentation, aiding you with audits and compliance reporting.

Choosing services that align with your specific compliance needs can help your organization meet legal requirements and build a secure and trustworthy environment for your data. Explore AWS Compliance Programs to learn more.

Scalability and flexibility

Consider how your organization will grow, and how fast. Choose AWS services that will help your security measures grow seamlessly with your infrastructure and adapt to evolving threats.

To help you scale quickly, AWS Control Tower orchestrates the capabilities of several other AWS services, including AWS Organizations and AWS IAM Identity Center, to build a landing zone in less than an hour. Control Tower sets up and manages resources on your behalf.

AWS also designs many services to automatically scale with an application's traffic and usage patterns, such as Amazon GuardDuty for threat detection and AWS WAF for protecting web applications. As your business scales up, these services scale with it, without requiring manual adjustments or causing bottlenecks.

In addition, it's critical that you can customize your security controls to match your business requirements and threat landscapes. Consider managing your accounts with AWS Organizations, so you can manage 40+ services' resources across multiple accounts. This gives individual application teams the flexibility and visibility to manage security needs that are specific to their workload, while also giving them governance and visibility to centralized security teams.

Considering scalability and flexibility helps you ensure that your security posture is robust, responsive, and capable of supporting dynamic business environments.

Integration with existing systems

Consider security measures that enhance, rather than disrupt, your current operations. For example, consider the following:

Streamline your workflows by aggregating security data and alerts from AWS services and analyzing them alongside existing security information and event management (SIEM) systems.
Create a unified view of security threats and vulnerabilities across both AWS and on-premises environments.
Integrate AWS CloudTrail with existing log management solutions for comprehensive monitoring of user activities and API usage across your AWS infrastructure and existing applications.
Examine ways that you can optimize resource utilization and consistently apply security policies across environments. This helps you reduce the risk of gaps in security coverage.

Cost and budget considerations

Review the pricing models for each service that you're considering. AWS often charges based on usage, such as the number of API calls, the volume of data processed, or the amount of data stored. For example, Amazon GuardDuty charges based on the amount of log data analyzed for threat detection, while AWS WAF bills are based on the number of rules deployed and the number of web requests received.

Estimate your expected usage to forecast costs accurately. Consider both current needs and potential growth or spikes in demand. For example, scalability is a key feature of AWS services, but it can also lead to increased costs if not managed carefully. Use the AWS Pricing Calculator to model different scenarios and assess their financial impact.

Evaluate the total cost of ownership (TCO), which includes both direct costs and indirect costs, such as the time and resources needed for management and maintenance. Opting for managed services can reduce operational overhead, but it might come at a higher price point.

Lastly, prioritize your security investments based on risk assessment. Not all security services will be equally critical to your infrastructure, so focus your budget on the areas that will have the most significant impact on reducing risk and ensuring compliance. Balancing cost-effectiveness with the level of security that you need is key to a successful AWS security strategy.

Organizational structure and access needs

Evaluate how your organization is structured and operates, and how your access needs might vary by team, project, or location. This factors in to how you manage and authenticate user identities, assign roles, and enforce access controls across your AWS environment. Implement best practices, such as the applying least-privilege permissions and requiring multi-factor authentication (MFA).

Most organizations need a multi-account environment. Review best practices for this type of environment, and consider using AWS Organizations and AWS Control Tower to help you implement it.

Another aspect that you should consider is the management of credentials and access keys. Consider using IAM Identity Center for centralizing access management across multiple AWS accounts and business applications, which enhances both security and user convenience. To help you smoothly manage access across your organization's accounts, IAM Identity Center integrates with AWS Organizations.

Additionally, evaluate how these identity and access management services integrate with your existing directory services. If you have an existing identity provider, you can integrate it with IAM Identity Center by using SAML 2.0 or OpenID Connect (OIDC). IAM Identity Center also has support for System for Cross-domain Identity Management (SCIM) provisioning to help keep your directories synchronized. This helps you ensure a seamless and secure user experience while accessing AWS resources.

Choose

Now that you know the criteria for evaluating your security options, you're ready to choose which AWS security services might be a good fit for your organizational requirements.

The following table highlights which services are optimized for which circumstances. Use the table to help determine the service that is the best fit for your organization and use case.

Note

¹ Integrates with AWS Security Hub (full list)

² Integrates with Amazon GuardDuty (full list)

³ Integrates with Amazon Security Lake (full list)

Identity and access management

Grant appropriate individuals the appropriate level of access to systems, applications, and data.

When should you use it?	What is it optimized for?	Security, identity, and governance services
Use these services to help you securely manage and govern access for your customers, workforce, and workloads.	Optimized for creating, connecting, and centrally managing access across AWS accounts and applications.	AWS IAM Identity Center
	Optimized for authenticating and authorizing users for web and mobile applications.	Amazon Cognito
	Optimized for securely sharing resources within AWS.	AWS RAM
	Optimized for managing permissions to AWS resources.	IAM ¹

Data protection

Automate and simplify data protection and security tasks that range from key management and sensitive data discovery to credential management.

When should you use it?	What is it optimized for?	Data protection services
Use these services to help you achieve and maintain the confidentiality, integrity, and availability of sensitive data stored and processed within AWS environments.	Optimized for discovering sensitive data.	Amazon Macie ¹
	Optimized for cryptographic keys.	AWS KMS
	Optimized for HSMs.	AWS CloudHSM
	Optimized for private SSL/TLS X.509 certificates and keys.	AWS Certificate Manager
	Optimized for creating private certificate authority hierarchies.	AWS Private CA
	Optimized for database credentials, application credentials, OAuth tokens, API keys, and other secrets.	AWS Secrets Manager

Network and application protection

Centrally protect your internet resources against common DDoS and application attacks.

When should you use it?	What is it optimized for?	Network and application protection services
Use these services to help you enforce detailed security policies at every network control point.	Optimized for centrally configuring and managing firewall rules.	AWS Firewall Manager ¹
	Optimized for providing a stateful, managed network firewall and intrusion detection and prevention service.	AWS Network Firewall
	Optimized for protecting against DDoS attacks for AWS resources at the network, transport, and application layers.	AWS Shield
	Optimized for providing a web application firewall.	AWS WAF

Detection and response

Continuously identify and prioritize security risks, while integrating security best practices early.

When should you use it?	What is it optimized for?	Detection and response services
Use these services to help you detect and respond to security risks across your accounts, so you can protect your workloads at scale.	Optimized for automating security checks and centralizing security alerts with AWS and third-party integrations.	AWS Security Hub ^{2, 3}
	Optimized for assessing, auditing, and evaluating the configuration of your resources.	AWS Config ¹
	Optimized for logging events from other AWS services as an audit trail.	AWS CloudTrail
	Optimized for intelligent threat detection and detailed reporting.	Amazon GuardDuty ¹
	Optimized for vulnerability management.	Amazon Inspector ¹
	Optimized for centralizing security data.	Amazon Security Lake ¹
	Optimized for aggregating and summarizing potential security issues.	Amazon Detective ^{1, 2, 3}

Governance and compliance

Establish cloud governance across your resources, and automate your compliance and auditing processes.

When should you use it?	What is it optimized for?	Governance and compliance services
Use these services to help you implement best practices and meet industry standards when using AWS.	Optimized for centrally managing multiple accounts and consolidated billing.	AWS Organizations
	Optimized for providing on-demand downloads of AWS security and compliance documents.	AWS Artifact
	Optimized for auditing AWS usage.	AWS Audit Manager ¹
	Optimized for setting up and governing an AWS multi-account environment.	AWS Control Tower

Use

You should now have a clear understanding of what each AWS security, identity, and governance service (and the supporting AWS tools and services) does, and which ones might be right for you.

To explore how to use and learn more about each of the available AWS security, identity, and governance services, we have provided a pathway to explore how each of the services works. The following sections provide links to in-depth documentation, hands-on tutorials, and resources to get you started.

Identity and access management

The following tables show some useful identity and access management resources, organized by service, to help you get started.

AWS IAM Identity Center

Enabling AWS IAM Identity Center

Enable IAM Identity Center and begin using it with your AWS Organizations.