AWS Security Auditing & Compliance Mastery

This guide covers the essential services used to audit, monitor, and maintain security posture within an AWS environment, specifically focusing on the DevOps Engineer Professional domain of security automation and response.

Learning Objectives

After studying this guide, you should be able to:

• Implement robust auditing using AWS CloudTrail and AWS Config.
• Analyze network traffic patterns with VPC Flow Logs to identify security gaps.
• Detect configuration drift in CloudFormation stacks and remediate manual changes.
• Differentiate between threat detection (GuardDuty), vulnerability scanning (Inspector), and configuration auditing (Config).
• Design automated remediation workflows using EventBridge and AWS Lambda.

Key Terms & Glossary

• Management Events: API operations performed on resources in your AWS account (e.g., AttachRolePolicy).
• Data Events: Resource-level operations (e.g., S3 GetObject, Lambda Invoke). High volume, disabled by default.
• Configuration Recorder: An AWS Config component that records changes to the configuration of supported resources.
• Aggregator: An AWS Config feature that collects compliance data from multiple accounts and regions into a single view.
• Drift: The difference between the expected configuration of a CloudFormation stack and its actual, live state.
• Finding: A security notification generated by GuardDuty or Inspector indicating a potential issue.

The "Big Idea"

[!IMPORTANT] Security auditing is the process of verifying that your environment's state matches your policy and that all actions are recorded.

Think of CloudTrail as the Video Camera (who did what?), AWS Config as the Inventory Ledger (how is it configured now vs. then?), and VPC Flow Logs as the Network Tap (who is talking to whom?). Together, they provide the visibility required for a "Defense in Depth" strategy.

Formula / Concept Box

Hierarchical Outline

1. API Auditing (AWS CloudTrail)
   • Trails: Regional vs. All-Region (Best Practice: All-Region).
   • Integrity: Log File Validation (RSA/SHA-256) to detect tampering.
   • Multi-account: Organizational Trails for centralized logging.
2. Resource Auditing (AWS Config)
   • Config Rules: Managed (AWS-defined) vs. Custom (Lambda-based).
   • Remediation: Automated via SSM Documents or Lambda.
   • Compliance: Timeline view of resource history.
3. Network Auditing (VPC Flow Logs)
   • Scope: VPC, Subnet, or ENI level.
   • Destinations: CloudWatch Logs (real-time) or S3 (long-term/Athena analysis).
4. Infrastructure-as-Code Auditing (CloudFormation Drift)
   • Status: IN_SYNC vs. DRIFTED.
   • Scope: Property-level differences (e.g., Security Group Port 80 changed to 22).

Visual Anchors

Auditing Workflow

Drift Detection Logic

Definition-Example Pairs

• CloudTrail Log File Validation: A feature that generates a digital signature for log files.
  • Example: An auditor uses the aws cloudtrail verify-logs command to prove that a specific log entry hasn't been deleted or modified after being written to S3.
• Config Remediation: An automated action triggered when a resource is found non-compliant.
  • Example: If a Config Rule detects an S3 bucket is public, it triggers an SSM Automation document to set the bucket to private immediately.
• VPC Flow Log Filtering: Capturing only specific types of traffic (Accept, Reject, or All).
  • Example: A security engineer enables "REJECT" logs only to identify attempts by external IPs to scan blocked ports in a private subnet.

Worked Examples

Example 1: Identifying a Security Breach

Scenario: A developer reports that an EC2 instance was modified, but they don't know who did it.

1. Search CloudTrail: Open CloudTrail Event History.
2. Filter: Filter by ResourceName (Instance ID) or EventName (ModifyInstanceAttribute).
3. Analysis: Locate the userIdentity field to find the IAM User and the sourceIpAddress to see where the request originated.

Example 2: Handling CloudFormation Drift

Scenario: A stack is DRIFTED because a Security Group rule was manually added to allow port 3389 (RDP).

1. Detect Drift: Run Drift Detection on the Stack via Console or CLI.
2. View Detail: Identify the specific property SecurityGroupIngress that differs.
3. Resolution: Either update the CloudFormation template to include the rule OR (recommended) delete the manual rule to return the environment to the template's source of truth.

Checkpoint Questions

1. Which service should you use to see the history of configuration changes for an IAM Role over the last 6 months? (Answer: AWS Config)
2. How can you ensure CloudTrail logs from all accounts in an organization are stored in a single, tamper-proof bucket? (Answer: Use an Organizational Trail and enable Log File Validation)
3. You suspect an instance is communicating with a known command-and-control server. Which two logs are most useful? (Answer: VPC Flow Logs and DNS Logs/GuardDuty Findings)
4. True or False: CloudFormation drift detection automatically rolls back resources to the template state. (Answer: False; it only detects the difference. You must remediate manually or via automation.)

Muddy Points & Cross-Refs

• CloudTrail vs. CloudWatch: CloudTrail is for "Who did what" (Auditing). CloudWatch is for "What is the performance/health" (Monitoring).
• AWS Config vs. AWS AppConfig: AWS Config audits resource state. AppConfig (part of Systems Manager) manages application-level configuration flags/parameters.
• Inspector vs. GuardDuty: Inspector is a "Static/Scheduled" scanner for vulnerabilities (CVEs). GuardDuty is "Continuous/Behavioral" analysis of logs to find active threats.

Comparison Tables

GuardDuty vs. Macie vs. Inspector

Config Rule vs. CloudFormation Drift