AWS Certified Security Specialty (SCS-C02)

The direct answer to "does a finding auto-execute, or does it need wiring?" No detective service fixes anything by default — this guide is the orchestration layer connecting every finding-generating service in this library to an actual remediation action. Built around a Preventive → Detective → Responsive → Remediation framework.

ML threat detection across CloudTrail/VPC Flow Logs/DNS/runtime. Extended Threat Detection attack sequences, protection plans, Critical severity.

Vulnerability management — hybrid agent/agentless EC2 scanning, ECR image scanning, Code Security (SAST/SCA/IaC), risk scoring beyond raw CVSS.

Sensitive data discovery in S3 — automated vs targeted discovery, bucket posture evaluation, managed/custom identifiers, S3-only scope.

Investigation/forensics layer — behavior graph, finding groups, GenAI summaries. Investigates findings; never generates new ones itself.

Security Hub CSPM (compliance standards) vs the new enhanced Security Hub (cross-service exposure findings correlating GuardDuty + Inspector + Macie + CSPM).

Management/data/network activity events, Insights' statistical anomaly detection vs GuardDuty's ML, CloudTrail Lake's new-customer cutoff.

Detective vs proactive evaluation mode, conformance packs, remediation actions. Proactive mode is the one path where Config genuinely blocks deployment.

9 services in one file. Layered network defense — basic filtering through deep packet inspection through zero-trust app access through cross-account sharing.

Match the population to the protocol — workforce vs customer-facing vs machine/CI-CD. Trusted Token Issuer now accepts any OIDC-compliant source.

SCPs cap identities; RCPs cap resources. Centralized Root Access Management, Control Tower's Controls Dedicated experience.

The boundary layer — confused deputy/ExternalId, SSRF-to-credential-theft chains, role chaining caps, source identity tracking.

Managed multi-tenant vs dedicated single-tenant hardware. Post-quantum cryptography (ML-KEM/ML-DSA) rolling out across KMS, ACM, Secrets Manager.

SnapStart's two hazards (stale secrets, repeated uniqueness). Pod Identity vs IRSA — the central EKS workload-identity distinction.

Does your backup survive the same incident that took down production? Cross-account isolation as the real ransomware-resilience answer.

WAF filters request content (L7); Shield absorbs volumetric floods (L3/4 + L7). Shield Advanced's auto-mitigation actually deploys WAF rules.

The generic substrate underneath every other detective service. CloudWatch Logs anomaly detection, Trusted Advisor's support-plan-gated checks.

Note: IAM Access Analyzer lives in the IAM & Governance Bundle, not here.

Mechanism-level detail beneath the service name: Object Lock modes, IAM DB auth precedence, Database Activity Streams, grant eventual consistency.