Certopolis

AWS Certified Cloud Practitioner

Amazon Inspector vs Macie vs Security Hub: what each one checks

Amazon Inspector scans EC2 instances, container images in Amazon ECR and Lambda functions for software vulnerabilities and unintended network exposure. Amazon Macie finds sensitive data such as personal information in Amazon S3. AWS Security Hub (now documented as Security Hub CSPM) checks your account against standards such as PCI DSS and collects findings from Inspector, Macie and GuardDuty in one place.

Amazon Inspector: software vulnerabilities

Amazon Inspector is a vulnerability management service. It finds Amazon EC2 instances, container images in Amazon ECR and AWS Lambda functions, then keeps scanning them for software vulnerabilities and unintended network exposure.

You do not schedule scans. Inspector rescans a resource automatically when something changes that could add a vulnerability, such as a new package being installed, a patch being applied, or a new CVE that affects the resource being published.

Inspector reports each problem as a finding with remediation advice. It does not patch anything itself. When you fix the issue, Inspector detects it and closes the finding.

Amazon Macie: sensitive data in S3

Amazon Macie is a data security service that discovers sensitive data using machine learning and pattern matching. It looks inside objects in Amazon S3 for data such as personally identifiable information, financial information and credentials.

Macie also keeps an inventory of your S3 general purpose buckets and checks them for security and access control. A bucket that becomes publicly accessible, for example, produces a finding.

AWS Security Hub: one view and standards checks

Security Hub CSPM runs automatic checks against security standards: AWS Foundational Security Best Practices, CIS, PCI DSS and NIST. Each standard is made of controls, and each failed check becomes a control finding.

It also receives findings from Amazon GuardDuty, Amazon Inspector, Amazon Macie and supported third-party products, puts them in one format and helps you rank the most important ones.

A quick way to separate them: Inspector looks at the software on your compute, Macie looks at the data in your S3 buckets, GuardDuty looks at activity in your logs, and Security Hub brings their findings together.

Where the exam catches people

  • Believing Amazon Inspector needs scheduled assessment runs: it scans continuously and rescans automatically, including when a new CVE affecting a resource is published.
  • Believing Amazon Inspector patches what it finds: it creates findings with remediation advice; fixing them is your job.
  • Believing Amazon Macie scans EC2 instances: Macie works on data in Amazon S3.
  • Believing Security Hub replaces GuardDuty, Inspector and Macie: it collects and prioritizes their findings; they still do the detecting.
  • Believing AWS Artifact checks your resources against PCI DSS: Artifact supplies AWS's own reports; Security Hub CSPM runs PCI DSS checks on your resources.

Written from Amazon Web Services's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. Which of the following does Amazon Inspector do when a new CVE affecting a scanned instance is published?

    Right. In the game that’s Renown for your Security and Compliance building.

    Not that one: D is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    It keeps assessing resources throughout their lifecycle and automatically rescans them in response to changes that could introduce a new vulnerability, including when a new CVE that impacts the resource is published.

    Written from docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html

  2. Which AWS service would run automated checks of a company's AWS resources against PCI DSS controls?

    Right. In the game that’s Renown for your Security and Compliance building.

    Not that one: A is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    It runs checks against each standard's security controls and generates control findings.

    Written from docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html

  3. Which AWS service would use machine learning and pattern matching to find sensitive data in Amazon S3?

    Right. In the game that’s Renown for your Security and Compliance building.

    Not that one: B is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

    Written from docs.aws.amazon.com/macie/latest/user/what-is-macie.html