| name | aws-security-services |
| description | Guide complet des services de sécurité AWS — GuardDuty, Inspector, Macie, Detective, Firewall Manager, Network Firewall, Security Hub, Config, Artifact, et architecture défensive AWS |
| domain | ["cybersecurite","cloud","aws"] |
| tags | ["aws","guardduty","inspector","macie","detective","security-hub","network-firewall","firewall-manager","aws-config","artifact"] |
| priority | haute |
🛡️ AWS Security Services — Guide Défensif Complet
Guide exhaustif des services de sécurité natifs AWS, leur configuration, intégration et bonnes pratiques défensives.
1. AWS GuardDuty — Détection de Menaces
1.1 Architecture et Principes
GuardDuty est un service de détection de menaces alimenté par ML qui analyse :
- CloudTrail Events (management + data events S3)
- VPC Flow Logs (trafic réseau)
- DNS Logs (requêtes DNS)
- EKS Audit Logs (Kubernetes)
- RDS Login Events (tentatives de connexion)
- S3 Data Events (accès aux objets)
aws guardduty enable-organization-admin-account --admin-account-id <id>
aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES
aws guardduty create-ip-set --detector-id <id> --name my-whitelist \
--format TXT --location s3://bucket/whitelist.txt --activate
aws guardduty create-threat-intel-set --detector-id <id> \
--name tor-exit-nodes --format TXT \
--location s3://bucket/tor-nodes.txt --activate
1.2 Types de Findings Critiques par Catégorie
| Catégorie | Finding Critique | Sévérité |
|---|
| Backdoor | Backdoor:EC2/C&CActivity.B | High |
| Crypto | CryptoCurrency:EC2/BitcoinTool.B | High |
| IAM | UnauthorizedAccess:IAMUser/ConsoleLoginSuccess | Medium |
| IAM | Policy:IAMUser/RootCredentialUsage | High |
| EC2 | UnauthorizedAccess:EC2/SSHBruteForce | Medium |
| S3 | Discovery:S3/MaliciousIPCaller | Medium |
| Privesc | PrivilegeEscalation:IAMUser/AnomalousBehavior | High |
| Stealth | Stealth:IAMUser/CloudTrailLoggingDisabled | Medium |
| K8s | Policy:Kubernetes/AnonymousAccessGranted | High |
| RDS | UnauthorizedAccess:RDS/LoginEvent | Medium |
aws guardduty create-sampling-filter --detector-id <id> --filter-name auto-suppress \
--finding-criteria '{"Criterion": {"severity": {"Lt": 4}}}'
1.3 Intégration avec les Services AWS
cat > guardduty-event-rule.json << 'EOF'
{
"eventPattern": {
"source": ["aws.guardduty"],
"detail-type": ["GuardDuty Finding"],
"detail": {
"severity": [7, 8, 9],
"type": [{"prefix": "CryptoCurrency"}, {"prefix": "Backdoor"}]
}
},
"targets": [{"Arn": "arn:aws:lambda:...:function:auto-remediate", "Id": "remediate"}]
}
EOF
aws events put-rule --name guardduty-critical --event-pattern file://guardduty-event-rule.json
cat > remediate.py << 'PYEOF'
import boto3, os
def handler(event, context):
ec2 = boto3.client('ec2')
finding = event['detail']
resource_id = finding['resource']['instanceDetails']['instanceId']
ec2.modify-instance-attribute(
InstanceId=resource_id,
Groups=[os.environ['ISOLATION_SG_ID']]
)
if 'CryptoCurrency' in finding['type']:
ec2.stop_instances(InstanceIds=[resource_id])
return {'statusCode': 200, 'body': f'Isolated {resource_id}'}
PYEOF
1.4 Suppression des Findings (Muting)
aws guardduty update-filter --detector-id <id> --filter-name auto-mute \
--action ARCHIVE \
--finding-criteria '{"Criterion": {"severity": {"Lte": 3}}}'
2. AWS Inspector — Analyse de Vulnérabilités
2.1 Amazon Inspector Classic vs Inspector V2
| Fonctionnalité | Inspector Classic | Inspector V2 |
|---|
| Scan EC2 (Agent) | ✓ | ✓ (SSM Agent) |
| Scan conteneurs | ✗ | ✓ (ECR) |
| Scan Lambda | ✗ | ✓ |
| Network Reachability | ✓ | ✓ |
| Code scan (Lambda) | ✗ | ✓ |
| Pricing | Par instance/heure | Par scan |
aws inspector2 enable --resource-types EC2 ECR LAMBDA
aws inspector2 enable-delegated-admin-account --delegated-admin-account-id <id>
aws inspector2 create-filter --action SUPPRESS \
--filter-criteria '{"findingStatus": [{"comparison": "EQUALS", "value": "SUPPRESSED"}]}' \
--name suppress-false-positives
2.2 Gestion des Findings
aws inspector2 list-findings --filter-criteria '{
"severity": [{"comparison": "EQUALS", "value": "CRITICAL"}],
"findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}]
}'
aws inspector2 create-sbom-export --report-format CYCLONEDX_1_5 \
--s3-destination bucketName=reports,keyPrefix=sbom/
2.3 Remediation Automatique
cat > patch-critical.yaml << 'EOF'
schemaVersion: '0.3'
description: Auto-patch critical CVEs
mainSteps:
- name: PatchWithPatchManager
action: 'aws:runCommand'
inputs:
DocumentName: AWS-RunPatchBaseline
InstanceIds: ['{{InstanceId}}']
Parameters:
Operation: Install
RebootOption: RebootIfNeeded
EOF
3. Amazon Macie — Protection des Données Sensibles
3.1 Architecture Macie
Macie utilise le ML pour découvrir, classifier et protéger les données sensibles dans S3.
aws macie2 enable-macie
aws macie2 create-classification-job --name prod-scan \
--job-type SCHEDULED --schedule-frequency WEEKLY \
--s3-job-definition '{
"bucketDefinitions": [{"accountId": "123456789012", "buckets": ["prod-data"]}],
"scoping": {"includes": {"and": [{"simpleScopeTerm": {"key": "OBJECT_EXTENSION", "values": [".csv", ".json", ".xlsx"]}}]}}
}' \
--managed-data-identifier-ids '[
"AWS_CREDENTIALS", "AWS_MANAGED_CREDENTIALS", "CREDIT_CARD_NUMBER",
"USA_SOCIAL_SECURITY_NUMBER", "CUSTOM_IDENTIFIER"
]'
aws macie2 create-custom-data-identifier --name api-key \
--regex 'sk-[a-zA-Z0-9]{20,}' \
--description "Detection des clés API OpenAI/ChatGPT"
3.2 Types de Données Détectées par Macie
| Identifiant | Type | Exemple |
|---|
| AWS Credentials | Credentials | AKIAIOSFODNN7EXAMPLE |
| Credit Card | PII | 4111-1111-1111-1111 |
| SSN | PII | 123-45-6789 |
| API Key | Secrets | sk-proj-xxxxxxxxxx |
| Private Key | Crypto | -----BEGIN RSA PRIVATE KEY----- |
| JSON Web Token | Auth | eyJhbGciOiJIUzI1NiIs... |
3.3 Alerts et Remediation
cat > macie-auto-block.json << 'EOF'
{
"eventPattern": {
"source": ["aws.macie"],
"detail-type": ["Macie Finding"],
"detail": {"severity": {"description": ["CRITICAL", "HIGH"]}}
}
}
EOF
4. AWS Detective — Investigation Forensique
4.1 Mise en Place
aws detective create-graph --graph-name prod-graph
aws detective create-members --graph-arn <arn> \
--accounts AccountId=123456789012,EmailAddress=admin@example.com
4.2 Utilisation pour l'Investigation
cat > detective_investigate.py << 'PYEOF'
import boto3
detective = boto3.client('detective')
graph_arn = 'arn:aws:detective:...'
ip_data = detective.get_indicators(
GraphArn=graph_arn,
IndicatorValues=[{'IpAddress': {'IpAddress': '1.2.3.4'}}]
)
resources = detective.list_resources(
GraphArn=graph_arn,
Filters={'ResourceType': 'AwsResource'}
)
PYEOF
4.3 Integration avec Jupyter Notebooks
5. AWS Network Firewall
5.1 Architecture
Internet → IGW → Public Subnet (Firewall) → Protected Subnets
↓
AWS Network Firewall
- Stateful rules (Suricata)
- Stateless rules
- Domain filtering
5.2 Configuration
aws network-firewall create-firewall-policy \
--firewall-policy-name fw-policy \
--firewall-policy '{
"StatelessDefaultActions": ["aws:forward_to_snf"],
"StatelessFragmentDefaultActions": ["aws:forward_to_snf"]
}'
cat > suricata-rules.txt << 'EOF'
drop tls $HOME_NET any -> $EXTERNAL_NET 443
(tls.sni; content:"evil.com"; msg:"C2 Domain Blocked";
sid:1000001; rev:1;)
drop dns $HOME_NET any -> any 53
(dns.query; content:"mining"; msg:"Crypto Mining DNS query";
sid:1000002; rev:1;)
drop tcp $HOME_NET any -> $EXTERNAL_NET 22
(msg:"SSH Outbound Blocked"; sid:1000003; rev:1;)
alert http $EXTERNAL_NET any -> $HOME_NET any
(http.uri; content:"union+select"; nocase;
msg:"Possible SQL Injection"; sid:1000004; rev:1;)
EOF
aws network-firewall create-rule-group \
--rule-group-name suricata-block \
--type STATEFUL \
--capacity 10000 \
--rules-source file://suricata-rules.txt
aws network-firewall create-rule-group \
--rule-group-name domain-block \
--type STATEFUL \
--rule-group '{
"RulesSource": {
"RulesSourceList": {
"Targets": [".cryptominer.com", ".malware.com"],
"TargetTypes": ["TLS_SNI", "HTTP_HOST"],
"GeneratedRulesType": "DENYLIST"
}
}
}'
5.3 Monitorer le Firewall
aws cloudwatch list-metrics --namespace AWS/NetworkFirewall \
--metric-name DroppedPackets --dimensions Name=FirewallName,Value=fw-prod
aws network-firewall describe-firewall --firewall-name fw-prod \
--query 'FirewallStatus.SyncStates'
6. AWS Firewall Manager
6.1 Architecture Multi-Compte
aws organizations enable-aws-service-access \
--service-principal fms.amazonaws.com
aws organizations register-delegated-administrator \
--account-id <admin-account> --service-principal fms.amazonaws.com
aws fms put-policy --policy '{
"PolicyName": "waf-org-policy",
"SecurityServicePolicyData": {
"Type": "WAF",
"ManagedServiceData": "{\"type\":\"WAF\",\"defaultAction\":{\"type\":\"ALLOW\"},\"preProcessRuleGroups\":[{\"managedRuleGroupIdentifier\":{\"vendor\":\"AWS\",\"name\":\"AWSManagedRulesCommonRuleSet\"},\"overrideAction\":{\"type\":\"NONE\"}}]}"
},
"ResourceType": "ResourceTypeList",
"ResourceTags": [{"Key": "Environment", "Value": "Production"}],
"ExcludeResourceTags": false,
"RemediationEnabled": true
}'
6.2 Types de Policies FMS
| Type | Description |
|---|
| WAF | Web ACLs sur CloudFront/ALB/API Gateway |
| Security Group | Common SGs + audit |
| Network Firewall | Firewall rules |
| Shield Advanced | DDoS protection |
| Network ACL | NACL common rules |
| DNS Firewall | Route53 Resolver DNS filtering |
7. AWS Security Hub
7.1 Activation Multi-Région Multi-Compte
aws securityhub enable-organization-admin-account \
--admin-account-id <id>
aws securityhub enable-security-hub \
--enable-standards '[
"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0",
"arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0",
"arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"
]'
aws securityhub enable-import-findings-for-product \
--product-arn "arn:aws:securityhub:us-east-1::product/aws/securityhub"
7.2 Custom Actions et Automations
aws securityhub create-action-target \
--name "Remediate S3" \
--description "Bloquer S3 public" \
--id "remediate-s3"
aws securityhub batch-update-findings \
--finding-identifiers Id=arn:aws:securityhub:... \
--workflow Status=RESOLVED \
--note Text="Auto-remediated by SCP",UpdatedBy=automation
7.3 Custom Insights
aws securityhub create-insight \
--name "Unencrypted S3 Buckets" \
--filters '{
"ResourceType": [{"Comparison": "EQUALS", "Value": "AwsS3Bucket"}],
"ComplianceStatus": [{"Comparison": "EQUALS", "Value": "FAILED"}]
}' \
--group-by-attribute "ResourceId"
8. AWS Config — Gestion de la Conformité
8.1 Configuration Multi-Compte
aws configservice put-configuration-recorder \
--recording-group '{"allSupported": true, "includeGlobalResourceTypes": true}'
aws configservice put-delivery-channel \
--delivery-channel '{
"s3BucketName": "config-bucket",
"configSnapshotDeliveryProperties": {"deliveryFrequency": "Twelve_Hours"}
}'
aws configservice put-configuration-aggregator \
--configuration-aggregator-name org-aggregator \
--organization-aggregation-source '{
"RoleArn": "arn:aws:iam::...:role/aws-config-aggregator",
"AwsRegions": ["us-east-1", "eu-west-1", "ap-southeast-1"],
"AllAwsRegions": true
}'
8.2 Conformance Packs
aws configservice put-conformance-pack \
--conformance-pack-name s3-security-pack \
--template-body file://s3-conformance-pack.yaml
s3-conformance-pack.yaml :
Resources:
S3BucketPublicReadProhibited:
Type: AWS::Config::ConfigRule
Properties:
Source:
Owner: AWS
SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
S3BucketPublicWriteProhibited:
Type: AWS::Config::ConfigRule
Properties:
Source:
Owner: AWS
SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
S3BucketSSEEnabled:
Type: AWS::Config::ConfigRule
Properties:
Source:
Owner: AWS
SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
S3BucketReplicationEnabled:
Type: AWS::Config::ConfigRule
Properties:
Source:
Owner: AWS
SourceIdentifier: S3_BUCKET_REPLICATION_ENABLED
8.3 Remediation Automatique
aws configservice put-remediation-configurations \
--remediation-configurations '[
{
"ConfigRuleName": "S3_BUCKET_PUBLIC_READ_PROHIBITED",
"TargetType": "SSM_DOCUMENT",
"TargetId": "AWS-DisableS3BucketPublicReadWrite",
"Parameters": {
"AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::...:role/config-remediation"]}},
"BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}}
},
"Automatic": true,
"MaximumAutomaticAttempts": 3,
"RetryAttemptSeconds": 60
}
]'
9. AWS Artifact — Gestion des Rapports de Conformité
aws artifact download-document --document-id <id>
aws artifact list-documents \
--filter '{"documentType": "SOC3"}'
10. Architecture Défensive Complète AWS
┌──────────────────────────┐
│ AWS Organizations │
│ SCP + GuardDuty Admin │
└──────────┬───────────────┘
│
┌────────────────┼────────────────┐
│ │ │
┌─────────▼──────┐ ┌─────▼──────┐ ┌──────▼──────────┐
│ Security Hub │ │ Config │ │ CloudTrail │
│ Cross-Region │ │ Conformance │ │ Organization │
│ Aggregator │ │ Packs │ │ Trail │
└─────────┬──────┘ └─────┬──────┘ └──────┬──────────┘
│ │ │
┌─────────▼───────────────▼─────────────────▼──────────┐
│ EventBridge Bus │
│ Centralisation des événements de sécurité │
└─────────┬───────────────┬─────────────────┬──────────┘
│ │ │
┌─────────▼──────┐ ┌─────▼──────┐ ┌──────▼──────────┐
│ Lambda │ │ SSM │ │ SIEM │
│ Remediation │ │ Automation │ │ (Splunk/ES) │
└────────────────┘ └────────────┘ └─────────────────┘
10.1 SCP de Sécurité Essentiels
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyRootAccessKeys",
"Effect": "Deny",
"Action": ["iam:CreateAccessKey", "iam:UpdateAccessKey"],
"Resource": ["arn:aws:iam::*:root"]
},
{
"Sid": "DenyLeavingOrg",
"Effect": "Deny",
"Action": ["organizations:LeaveOrganization"],
"Resource": "*"
},
{
"Sid": "DenyPublicS3",
11. Tableau des Services par Fonction
| Fonction | Service AWS | Alternative Open Source |
|---|
| Détection de menaces | GuardDuty | Wazuh, Security Onion |
| Scan vulnérabilités | Inspector V2 | OpenVAS, Trivy |
| Protection données sensibles | Macie | S3 inspection custom |
| Investigation forensique | Detective | TheHive, Velociraptor |
| Firewall réseau | Network Firewall | iptables, pfSense |
| WAF applicatif | WAF + Shield | ModSecurity, Coraza |
| Firewall management | Firewall Manager | Custom scripting |
| Security posture | Security Hub | Prowler, ScoutSuite |
| Conformité continue | Config | OPA, Checkov |
| Rapport compliance | Artifact | — |
| Protection DDoS | Shield | Cloudflare |
Pitfalls
- Ne PAS activer GuardDuty sans EventBridge → Lambda de remediation (findings sans action)
- Ne PAS configurer Security Hub sans intégrer Config (pas de contexte de ressource)
- Ne PAS permettre les SCP trop restrictives qui bloquent les pipelines CI/CD
- TOUJOURS activer les Data Events CloudTrail pour S3 (coût modéré, sécurité ++)
- TOUJOURS configurer un delegated admin multi-compte pour tous les services
- Les conformance packs Config peuvent coûter cher — n'activer que les règles pertinentes
- Firewall Manager nécessite Organizations — pas de workaround
Ressources
