> For the complete documentation index, see [llms.txt](https://mamawhocode.gitbook.io/aws/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mamawhocode.gitbook.io/aws/services/security.md).

# security

## Encryption

### Encryption in flight (SSL)

<figure><img src="https://2259236002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fuh9xZDZ53qGqmMCM44PU%2Fuploads%2FWkTj1BV7v1PQ1VMfHekB%2Fimage.png?alt=media&amp;token=ac48e053-b559-477c-98cc-9b309e2155d4" alt=""><figcaption><p>SSL</p></figcaption></figure>

* Data is
  * encrypted before sending
  * decrypted after receiving
* SSL certificates help with encryption (HTTPS)

### Encryption at rest (sever-side)

<figure><img src="https://2259236002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fuh9xZDZ53qGqmMCM44PU%2Fuploads%2Ftbljj6J0h5ZU7rAmnkBj%2Fimage.png?alt=media&amp;token=e4ea839c-0666-43f8-a47d-ba97318e51e4" alt=""><figcaption><p>encryption at rest</p></figcaption></figure>

* Data is
  * encrypted after being received by the server
  * decrypted before being sent
  * stored in an encrypted form (using data key).&#x20;
* The key is managed somewhere else.

### Client-side encryption

<figure><img src="https://2259236002-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fuh9xZDZ53qGqmMCM44PU%2Fuploads%2FghlWP1hr5cSw55TACeYT%2Fimage.png?alt=media&amp;token=58898791-1caa-4edb-8a65-e11eff7bf8ff" alt=""><figcaption><p>client side encryption</p></figcaption></figure>

* Data is
  * encrypted by the client and never decrypted by the server
  * decrypted by a receiving client

## Secrets

| Type of secret                | Service                                                       |
| ----------------------------- | ------------------------------------------------------------- |
| DB user/pass                  | [AWS Secret Manager](/aws/services/security/secretmanager.md) |
| AWS credentials               | IAM                                                           |
| Encryption keys               | AWS KMS                                                       |
| Private keys and certificates | AWS Certificate Manager                                       |

## Inspector vs Guarduty

| Aspect                              | AWS Inspector                                       | AWS GuardDuty                                       |
| ----------------------------------- | --------------------------------------------------- | --------------------------------------------------- |
| Purpose                             | Security and compliance assessments                 | Real-time threat detection and security alerts      |
| Use Cases                           | Assessing security and compliance of EC2 instances  | Detecting potentially malicious activities          |
| Automated vs. Continuous Monitoring | On-demand or scheduled assessments                  | Continuous monitoring for threats                   |
| Resource Coverage                   | EC2 instances and application assessments           | A broader range of AWS resources                    |
| Alerts and Notifications            | Provides assessment reports and findings            | Generates security alerts and findings in real-time |
| Integration                         | Integrates with AWS Systems Manager for remediation | Integrates with various AWS services and SIEMs      |
| Pricing                             | Different pricing models based on volume            | Different pricing models based on volume            |

***

## Shield vs WAF

Shield - Amazon Elastic Compute Cloud (EC2), *<mark style="color:red;">Elastic Load Balancing</mark>* (ELB), Amazon ***CloudFront***, AWS Global Accelerator, and Route 53.

WAF - Amazon ***CloudFront***, the Application Load Balancer (*<mark style="color:red;">ALB</mark>*), Amazon API Gateway, and AWS AppSync

***

## Trivia

* AWS **Shield** for DDOS
* Amazon **Macie** for discover and protect <mark style="color:red;">sensitive</mark> data
* Amazon GuardDuty for intelligent thread discovery to protect AWS account&#x20;

  -> alert you when dectect a malicious activity
* Amazon Inspector for automated security assessment. like known Vulnerability\
  -> give you a report of findings after a Scan (scheduled or on-demand)