Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
AWS security is a portfolio, not a single product. The 17 core services in this guide cover access control, workforce and customer identities, network defenses, encryption and secrets, data discovery, and threat detection. Additional AWS services—such as Security Hub CSPM, Config, CloudTrail, Detective, Security Lake, Artifact and Audit Manager—connect those controls into posture management, investigation and governance workflows. Choose services according to the risk you need to control, the AWS accounts and regions you operate, and how much monitoring your team can run.
What are the 17 core AWS security tools?
The list below is organized by security job rather than by product family. Certificate Manager and Private CA are treated as one certificate-management entry because they solve the same certificate lifecycle problem; the companion services described later are essential in mature environments but are outside this 17-service core list.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| # | Service | Primary job | Typical placement |
|---|---|---|---|
| 1 | AWS Identity and Access Management (IAM) | Policies, roles and permissions for AWS resources | Every account and workload |
| 2 | IAM Identity Center | Workforce sign-in and permission sets | Human access across accounts |
| 3 | AWS Organizations | Multi-account hierarchy and centralized policies | Account governance |
| 4 | AWS Control Tower | Landing-zone setup and governed account provisioning | Standardized multi-account environments |
| 5 | IAM Access Analyzer | Finds resources shared outside an account’s zone of trust | External-access review |
| 6 | Amazon Cognito | Sign-up, sign-in and federation for application users | Customer-facing applications |
| 7 | AWS WAF | Layer-7 web request filtering | Web applications and APIs |
| 8 | AWS Shield | DDoS protection for supported AWS endpoints | Internet-facing workloads |
| 9 | AWS Network Firewall | Stateful and stateless network inspection | VPC traffic paths |
| 10 | AWS Firewall Manager | Central policy deployment for firewalls and related controls | Organizations with many accounts |
| 11 | AWS Key Management Service (KMS) | Create and control encryption keys | Data stores and application encryption |
| 12 | AWS Secrets Manager | Store, retrieve and rotate application secrets | Credentials and API keys |
| 13 | Amazon Macie | Discover and help protect sensitive data in Amazon S3 | Data-security discovery |
| 14 | AWS CloudHSM | Customer-controlled hardware security modules | Specialized key custody requirements |
| 15 | AWS Certificate Manager and Private CA | Issue, deploy and renew public or private certificates | TLS and internal PKI |
| 16 | Amazon GuardDuty | Continuous threat detection | Accounts, workloads, runtime activity and data |
| 17 | Amazon Inspector | Workload vulnerability and unintended-exposure scanning | Compute and container vulnerability management |
How should I manage identities and access in AWS?
Start with least privilege: grant only the actions, resources and conditions a principal needs, then review permissions as the workload changes. Keep workforce access, application-user access and machine-to-machine access separate so that a control designed for one identity type is not mistaken for another.
IAM for workloads and account permissions
IAM supplies users, groups, roles, policies and policy conditions. Prefer short-lived role sessions for people and workloads instead of embedding long-lived access keys in code. Resource policies, identity policies, permission boundaries and service control policies can all affect an authorization decision, so troubleshoot an unexpected denial by checking each applicable policy layer.
Popular on Amazon
IAM Identity Center for employees and contractors
IAM Identity Center centralizes workforce sign-in and permission sets across AWS accounts. It is intended for human access, while IAM roles remain the mechanism applications and AWS services use to obtain permissions. Connect it to an approved identity source, require multifactor authentication there, and assign permission sets by job function rather than by individual ad-hoc grants.
Organizations and Control Tower for account boundaries
AWS Organizations provides the account hierarchy, organizational units, consolidated management and service control policies used to set guardrails. Control Tower builds on that foundation with a governed landing-zone approach, account factories and preventive or detective controls. Organizations is the underlying management service; Control Tower is an opinionated setup and governance workflow, not a replacement for IAM policy design.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAccess Analyzer for unintended sharing
IAM Access Analyzer identifies resources that are accessible outside the account’s zone of trust. Use its findings to investigate S3 buckets, IAM roles, KMS keys and other supported resource policies that accidentally allow an external account or public principal. Treat a finding as a review signal: some cross-account sharing is intentional, but it should be documented and narrowly scoped.
Cognito for application customers
Amazon Cognito handles customer sign-up, sign-in, federation and tokens for applications. It is not a workforce directory and does not replace IAM Identity Center. Keep Cognito users and groups mapped to application authorization, while backend services assume IAM roles with tightly bounded permissions.
Which AWS controls protect networks and web applications?
These services operate at different layers. WAF filters HTTP requests, Shield addresses distributed denial-of-service attacks, Network Firewall inspects VPC traffic, and Firewall Manager applies policies across accounts. Combining them is often more effective than expecting one control to cover every path.
WAF for HTTP and API requests
AWS WAF evaluates web requests against rules such as IP sets, rate limits and managed rule groups. Attach it to supported application entry points, start with logging and count mode where possible, then move verified rules to blocking. Tune exclusions for legitimate application behavior; an overbroad rule can become an outage rather than a security improvement.
Shield for DDoS resilience
AWS Shield provides DDoS protection for supported AWS services and endpoints. Shield does not inspect application authorization or replace WAF rules. Pair DDoS protection with resilient architecture, monitoring and an incident runbook that identifies who can change routing or scaling settings during an attack.
Also popular on Amazon
Network Firewall for VPC traffic
AWS Network Firewall provides stateful and stateless inspection in VPC traffic paths. Use it for egress control, segmentation and traffic policies that must apply below the application layer. Route design, availability-zone placement and rule maintenance determine whether the firewall actually sees the traffic you intend to inspect.
Firewall Manager for central enforcement
Firewall Manager distributes and audits firewall policies across accounts in an AWS Organizations environment. It is useful when a central security team must enforce baseline WAF, Shield or Network Firewall settings while application teams own individual workloads. Define policy scope with organizational units and tags to avoid applying production rules to development accounts unintentionally.
How do AWS encryption, secrets and data-discovery services differ?
Encryption keys, application secrets, sensitive-data discovery, specialized hardware custody and certificates are separate problems. Using one service for another usually creates gaps or operational complexity.
KMS for managed encryption keys
AWS KMS creates and controls keys used by many AWS services and applications. Design key policies, grants, rotation settings and cross-account use deliberately; a key policy can allow or deny access even when an IAM policy appears permissive. Log key-use events and test recovery procedures for encrypted data before a production incident.
Secrets Manager for credentials and tokens
Secrets Manager stores and retrieves database credentials, API keys and other sensitive values, with rotation workflows for supported integrations. Applications should fetch secrets at runtime through an IAM role rather than placing them in source code, container images or user-data scripts. KMS commonly protects the stored secret, but KMS does not provide the retrieval and rotation workflow itself.
Macie for sensitive-data discovery
Amazon Macie discovers and helps protect sensitive data in Amazon S3 by analyzing bucket inventory and object content. Use findings to locate exposed or unexpectedly sensitive buckets, then correct access policies, retention and classification. Macie is a discovery and data-security service, not a substitute for a complete data-loss-prevention program.
CloudHSM for dedicated hardware control
AWS CloudHSM provides customer-controlled hardware security modules for workloads that need direct control of cryptographic operations and key custody. It requires more design and operational responsibility than a fully managed key service, including cluster availability, client configuration and backup planning. Select it for a documented requirement, not merely because hardware sounds more secure.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Also popular on Amazon
Certificate Manager and Private CA for TLS
AWS Certificate Manager provisions and renews certificates for integrated AWS services, while Private CA issues certificates for internal identities and private trust chains. Track where certificates are deployed, who can request them and how revocation is handled. Certificate management protects channel encryption; it does not authenticate application users by itself.
What is the difference between GuardDuty, Inspector and Security Hub?
GuardDuty detects suspicious activity, Inspector scans for vulnerabilities and unintended exposure, and Security Hub CSPM brings posture and findings into a central view. They are complementary rather than interchangeable.
GuardDuty for threat detection
AWS describes GuardDuty as continuously monitoring “your AWS accounts, workloads, runtime activity, and data for malicious activity.” Enable it in every relevant account and region, preferably through delegated administration, then route findings to the people or automation that can contain a threat. A GuardDuty finding is an indication of malicious or suspicious behavior; it is not a complete incident investigation.
Inspector for vulnerability management
AWS describes Inspector as scanning “your AWS workloads for software vulnerabilities and unintended network exposure.” Use its findings to prioritize patching and image or dependency updates. Inspector answers whether a workload appears vulnerable or unnecessarily reachable; it does not tell you that an attacker is currently operating in the account.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsSecurity Hub CSPM for centralized posture and findings
AWS says, “AWS Security Hub CSPM provides a comprehensive view of your security state in AWS.” It aggregates findings from AWS services and supported third-party tools and evaluates security standards. Security Hub is the coordination and presentation layer, not a synonym for every underlying detection engine.
Which companion services support investigation, audit and response?
AWS Config
Config records resource configurations and evaluates them against rules. Use it to answer what changed, whether a resource violates a baseline and which accounts need remediation. Configuration assessment is different from runtime threat detection.
AWS CloudTrail
CloudTrail records actions taken by users, roles and AWS services. Its event history and trails provide an audit input for investigations; protect log storage, define retention and restrict who can alter or delete it.
Also popular on Amazon
Amazon Detective
Detective helps investigators explore relationships and activity around suspicious behavior and security findings. It is for deeper analysis and root-cause work after a signal exists, not a replacement for GuardDuty or CloudTrail data collection.
Amazon Security Lake
Security Lake centralizes security data from AWS, SaaS, on-premises, cloud and third-party sources. It is useful when analysts need a common data lake for detection engineering and investigations across environments, but it adds schema, storage and data-pipeline decisions.
AWS Security Incident Response
AWS Security Incident Response supports preparation, response and recovery activities. Establish contacts, permissions, evidence handling and escalation paths before an incident; a service cannot compensate for an untested runbook.
How do AWS governance and compliance services fit together?
Organizations and Control Tower establish account-level governance. AWS Artifact provides on-demand access to AWS security and compliance documents, while Audit Manager helps collect evidence about AWS usage for audit workflows. These services support governance; they do not guarantee that a customer satisfies a law, regulation or audit requirement.
AWS’s SOC service-scope listing shows which AWS services are included in AWS’s own SOC program scope. That scope is not a certification of your workload. Customers remain responsible for configuration, identity controls, logging, data handling and the obligations that apply to their organization and geography.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should I use AWS-native tools or third-party security software?
Native services usually offer the shortest path to AWS telemetry and account integration. Third-party products can add multi-cloud or on-premises coverage, specialized analytics, managed operations or a different workflow. Marketplace category presence is a discovery and procurement path, not an endorsement of every listed product.
| Decision axis | Questions to ask |
|---|---|
| Primary capability | Is the product for identity, CSPM, threat detection, vulnerability management, SIEM, WAF/edge security or managed response? |
| AWS integration | Which AWS services, accounts and regions are supported, and are findings mapped into Security Hub or another workflow? |
| Environment coverage | Do you also need other clouds, data centers, SaaS applications or endpoint telemetry? |
| Operational burden | Who deploys collectors, tunes rules, handles upgrades and responds to alerts? |
| Overlap | Will the tool duplicate GuardDuty, Inspector, Config or native WAF controls, and how will duplicate findings be deduplicated? |
| Cost and availability | Check current per-account, per-resource, data-volume and regional pricing and confirm that required features are available where you operate. |
No source establishes a universally best vendor, current prices or an independent performance benchmark. Validate product documentation, supported regions, contract terms and a representative proof of concept before standardizing.
Also popular on Amazon
How can I roll out an AWS security baseline?
- Map accounts and identities. Build the Organizations hierarchy, designate security administrators, connect workforce identity through IAM Identity Center and remove unnecessary long-lived keys.
- Set preventive guardrails. Use service control policies, permission boundaries and Control Tower controls where appropriate; document exceptions instead of silently bypassing them.
- Protect entry points and data. Attach WAF and Shield to internet-facing applications, place Network Firewall where routing guarantees inspection, and standardize KMS, Secrets Manager and certificate ownership.
- Enable detection and scanning. Follow AWS Prescriptive Guidance by enabling GuardDuty, IAM Access Analyzer, Inspector and Security Hub CSPM for a vulnerability-management program. Their roles differ: detection, external-sharing analysis, vulnerability scanning and centralized posture/findings.
- Collect evidence. Turn on CloudTrail and Config with protected, appropriately retained destinations; use Macie for S3-sensitive-data discovery and Security Lake when cross-environment analytics justify it.
- Practice response. Route findings, test containment permissions, investigate with Detective and rehearse the Security Incident Response process.
- Measure and tune. Review false positives, stale permissions, unpatched assets and control exceptions on a schedule. Regional availability and service integrations can change, so recheck current AWS documentation during each architecture review.
What common mistakes make AWS security weaker?
- Calling Security Hub a detection engine. It aggregates and contextualizes findings; GuardDuty, Inspector, Config and other sources perform distinct detection or assessment jobs.
- Using customer identity services for employees. Cognito is for application users; workforce access belongs in IAM Identity Center or an integrated corporate identity system.
- Assuming encryption solves every data risk. KMS protects keys and encryption workflows, while Macie helps discover sensitive data and Secrets Manager protects credentials.
- Deploying controls in one account only. Multi-account environments need delegated administration, organization-wide policy and a plan for new accounts and regions.
- Confusing AWS assurance with customer compliance. Artifact documents and SOC scope help with evidence, but your configuration and operating procedures determine your obligations.
- Ignoring cost and signal volume. Log retention, data-lake ingestion, scans and cross-account findings can create recurring charges and analyst workload; set budgets and triage rules before broad rollout.
Which AWS security certification study material is current?
AWS Certified Security Study Guide, 2nd Edition is a 544-page English Sybex book published in August 2025 and labeled for the SCS-C02 exam. AWS’s current official Security – Specialty exam guide in 2026 is SCS-C03, so the book should not be presented as current-exam aligned without checking for updates. Candidates should use the latest AWS exam guide and official preparation resources as the authority.
AWS’s 2026 SCS-C03 scored-content weights are: Identity and Access Management 20%, Data Protection 18%, Infrastructure Security 18%, Detection 16%, Incident Response 14%, and Security Foundations and Governance 14%. These are exam-content weights, not measurements of real-world risk or the relative value of a service.
What is the practical starting point?
For most AWS estates, establish Organizations and IAM Identity Center, enforce least privilege with IAM and Access Analyzer, then enable GuardDuty, Inspector, Security Hub CSPM, Config and CloudTrail. Add WAF, Shield, Network Firewall, KMS, Secrets Manager, Macie and the remaining services according to application exposure, data sensitivity and operating requirements. The right architecture is layered: each service closes a different class of failure, and the handoffs between them need owners, alerts and tested response procedures.
Frequently Asked Questions
Can GuardDuty replace a SIEM?
No. GuardDuty is an AWS threat-detection service that produces findings. A SIEM or security data lake may be needed to correlate AWS, SaaS, on-premises and endpoint events, retain them under your policy and support broader analyst workflows.
Which AWS service shows who changed a resource?
AWS CloudTrail records API and console actions by users, roles and AWS services. AWS Config can show the resulting resource-configuration history, so investigations often use both rather than treating either as a complete record alone.
Do I need CloudHSM if I already use KMS?
Not automatically. KMS is managed key control for most workloads; CloudHSM is a more operationally demanding option when a documented requirement calls for customer-controlled hardware security modules or specific cryptographic custody.
How often should AWS security policies be reviewed?
Review them whenever accounts, applications, regions or data classifications change, and establish a recurring access and findings review cadence. The exact interval should match your risk, staffing and regulatory obligations rather than a universal AWS schedule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
