AWS Service Comparisons
Side-by-side decision guides with security analysis, pricing breakdowns, and architectural recommendations. Updated for re:Invent 2025.
By Toc Consulting - AWS Security & Cloud Architecture
vs
vs
vs
GuardDuty vs Inspector vs Macie vs Security Hub
Which AWS security service do you actually need?
Four AWS security services that everyone confuses. GuardDuty detects threats, Inspector finds vulnerabilities, Macie discovers sensitive data, and Security Hub aggregates it all. Here is exactly when to use each - and why you probably need all four.
vs
vsSCPs vs IAM Policies vs Permission Boundaries
The three layers of AWS access control, decoded
AWS has three distinct mechanisms to control access: Service Control Policies at the organization level, IAM policies at the account level, and Permission Boundaries at the principal level. Understanding how they intersect - and the September 2025 SCP overhaul - is critical for any multi-account architecture.
vs
vs
vsWAF vs Network Firewall vs Security Groups vs NACLs
AWS defense in depth - four layers explained
AWS provides four distinct network security layers operating at different OSI levels. Security Groups and NACLs are free and instance/subnet-level. Network Firewall provides VPC-wide IDS/IPS with Suricata rules. WAF protects HTTP/HTTPS traffic at Layer 7. Understanding which does what - and how they stack - is defense in depth.
vs
vs
Secrets Manager vs Parameter Store vs Vault
Where should your secrets live?
Three approaches to secrets management on AWS: Secrets Manager with built-in rotation, Parameter Store with a generous free tier, and HashiCorp Vault for multi-cloud dynamic secrets. Most teams overpay - Parameter Store Standard is free for up to 10,000 parameters.
vsvs
KMS vs CloudHSM vs ACM
AWS encryption services - keys, HSMs, and certificates
Three AWS encryption services that solve different problems: KMS for managed key management, CloudHSM for dedicated hardware security modules, and ACM for TLS certificate management. KMS protects data at rest, ACM protects data in transit, and CloudHSM provides single-tenant HSMs with full key control.
vsvsTransit Gateway vs VPC Peering vs PrivateLink
How to connect VPCs without exposing your network
Three ways to connect VPCs on AWS - each with different tradeoffs for cost, complexity, and security. VPC Peering is simple and cheap, Transit Gateway scales to thousands of VPCs, and PrivateLink exposes specific services without network-level access.
vsvsCloudFormation vs Terraform vs CDK
Infrastructure as Code in 2025 - what changed
The IaC landscape shifted in 2025. Terraform moved to Business Source License (no longer open source), HashiCorp deprecated CDKTF in December 2025, and AWS CDK continues to mature. Here is the updated comparison with security implications for each approach.
vs
vs
vs
ECS vs EKS vs Lambda vs App Runner
AWS compute - from zero management to full control
Four ways to run code on AWS, from fully serverless (Lambda) to fully managed Kubernetes (EKS). The right choice depends on your team size, operational maturity, workload patterns, and security requirements. We include the security implications most comparison articles ignore.
vsGuardDuty vs Inspector: Key Differences and When You Need Both
Threat detection and vulnerability management are two different jobs
GuardDuty and Inspector get confused constantly because both surface "security findings" in your AWS console. They answer opposite questions. GuardDuty watches your logs and runtime activity to answer "is someone attacking me right now?" Inspector scans your EC2 instances, container images, Lambda functions, and code to answer "what could an attacker exploit?" One is a smoke detector, the other is a building inspector. Neither replaces the other, they bill on completely different dimensions, and in most real AWS accounts you want both running. Here is exactly what each one detects, how each is priced, and the order to enable them. If you also need Macie and Security Hub in the picture, see the full four-way comparison at guardduty-vs-inspector-vs-macie-vs-securityhub.
vsGuardDuty vs Security Hub: What Each One Actually Does
One detects threats, the other makes sense of everything
GuardDuty and Security Hub sit next to each other in the AWS console and both fill up with "findings", so teams regularly ask which one to enable. Wrong question. GuardDuty is a detector: it analyzes CloudTrail, VPC Flow Logs, DNS, and runtime activity to generate threat findings when something malicious happens. Security Hub is an aggregator and posture manager: it collects findings from GuardDuty, Inspector, Macie, and dozens of partner tools, runs its own compliance checks against standards like CIS and PCI DSS, and correlates everything into prioritized exposure findings with attack path visualization. Turning on Security Hub without any detectors gives you compliance scores and little else; running GuardDuty without Security Hub works fine but leaves findings siloed. This page breaks down what each actually does, how each is billed, and why the real answer is both. Comparing GuardDuty against Inspector instead? See guardduty-vs-inspector, or the full four-way comparison including Macie.
Missing a Comparison?
We are constantly adding new AWS service comparisons. Contact us to suggest topics or request custom architectural guidance.
Get in Touch