Compliance
31 items across 5 sections
GuardDuty vs Inspector vs Macie vs Security Hub
Which AWS security service do you actually need?
KMS vs CloudHSM vs ACM
AWS encryption services - keys, HSMs, and certificates
GuardDuty vs Security Hub: What Each One Actually Does
One detects threats, the other makes sense of everything
AWS Security Hub vs Third-Party CSPM
AWS's own tool, or a dedicated platform, do you need both?
From Findings to Fixed: Lambda Compliance Mapping and Remediation
Part 3 of 4 in the Lambda Security Series. Map every Lambda security finding to ten compliance frameworks (PCI DSS, HIPAA, SOC 2, ISO 27001, NIST, GDPR), then fix each of the 19 checks with a precise AWS CLI command.
Build a Free AWS Security Lab on Your Laptop with LocalEmu
Spin up a local AWS, plant deliberately insecure resources, and run real security scanners against it. No account, no token, no cost, no risk.
Fixing EC2 Security Issues: A Practical Remediation Guide
Part 3 of 3 in the EC2 Security Series. A hands-on remediation guide mapped to the scanner findings: AWS CLI commands, Terraform snippets, and console steps for every category.
Building an EC2 Security Scanner: 46 Checks, 137 Controls, Zero Excuses
Part 2 of 3 in the EC2 Security Series. One open-source command that scores every EC2 instance 0-100 across 46 checks and maps each finding to 137 controls in 10 compliance frameworks.
Run AI Locally for AWS Security Work: The Complete Ollama Guide
Stop sending your IAM policies, CloudTrail logs, and infrastructure code to third-party APIs. Run LLMs locally with Ollama on Apple Silicon: private, offline, fast. Complete setup guide with AWS security use cases.
AWS Security Audit Checklist: The Complete 2026 Guide
A comprehensive AWS security audit checklist covering IAM, S3, networking, logging, and compliance. Follow this step-by-step guide to secure your AWS infrastructure.
AWS Compliance Guide: HIPAA, GDPR, PCI DSS & SOC 2
Navigate AWS compliance requirements for HIPAA, GDPR, PCI DSS, and SOC 2. Learn which AWS services help you meet regulatory obligations.
Episode 3: Public RDS Detective - Finding Your Exposed Databases Before Attackers Do
Build automated scanners that identify publicly accessible RDS databases, analyze security groups, check encryption, and generate remediation commands across all AWS regions.
The Verdict, Four Months Later
Part 16 of 16 in the AWS Security Agent: From Zero to Hero series. Closing the series: the numbers this whole project is built on, the honest verdict distilled to its essentials, what AWS has shipped since my hands-on testing, and an evidence-based look at how AI pentesting stacks up against traditional consultancy today.
Week 3 - Jan 13-19, 2026
AWS European Sovereign Cloud goes live in Brandenburg, run by EU residents under German law, physically and logically isolated from other Regions. The Sovereign Reference Framework establishes how it is governed.
Week 10 - Mar 3-9, 2026
Bedrock AgentCore Policy hits GA, mixing LLM authorship with Cedar policy-as-code, the first AWS service to do that at scale. IAM gets a simplified role-creation flow with inline panels. AWS adds DESC 2026 certification for the UAE.
Week 21 - May 18-24, 2026
Security Hub learns to find identity risk that no one is using: unused IAM permissions, roles, and credentials, measured against 90 days of real activity. The Extended plan grows to 21 partners across 9 categories. Secrets Manager Agent picks up pre-fetching and cross-account role assumption, and Amazon Inspector Classic reaches end of support.
Week 25 - June 15-21, 2026
AWS unveils Continuum, a model-agnostic vulnerability lifecycle platform, and at AWS Summit New York pushes Security Agent into threat modeling and pull-request review. AWS WAF starts charging AI bots for content. On the patch side: Kiro IDE, the AgentCore Python SDK, and five containerd CVEs.
Week 28 - July 6-12, 2026
Sygnia documents a lone actor compromising a global enterprise's AWS estate in under 72 hours with AI-assisted workflows. Wiz finds the same symlink trust flaw in six AI coding assistants. On defense: Security Hub gains internet-facing network scanning and AWS Config adds 191 managed rules.
Week 29 - July 13-19, 2026
GuardDuty extends threat detection to Bedrock and SageMaker workloads, Security Hub goes multicloud with Azure support and an AI asset inventory, and Cognito removes the last big migration blocker by importing password hashes. Seven AWS bulletins land in four days, including a prompt-and-response leak in AgentCore telemetry.
AWS CloudTrail Security Best Practices
Comprehensive guide to securing AWS CloudTrail. Covers organization trails, KMS encryption, log integrity validation, S3 bucket hardening, CloudWatch integration, data events, Network Activity Events, Insights, SCP anti-tampering, CloudTrail Lake, and continuous audit.
AWS Security Hub Best Practices
Comprehensive guide to AWS Security Hub for centralized security posture management. Covers central configuration, security standards (FSBP, CIS v5.0), automation rules, cross-region aggregation, custom insights, integrations with GuardDuty, Inspector, and Config, and operational best practices for multi-account environments.
Automating Compliance Mapping: SOC 2, ISO 27001, PCI DSS, HIPAA on AWS
Mapping cloud configuration to compliance controls by hand is slow and goes stale immediately. Automated mapping keeps the score current and the evidence ready.
CIS AWS Foundations
AWS's default account settings alone don't guarantee a secure configuration. CIS brings together security practitioners to agree on a prescriptive, vendor-neutral baseline, specific IAM, logging, networking, and monitoring settings, that represent a reasonable security floor for any AWS account.
PCI DSS
To reduce credit card fraud by giving every business that touches payment card data a common set of technical and operational security requirements, rather than leaving each card brand to set its own rules.
SOC 2
To give a service organization's customers and partners independent, CPA-audited assurance that its controls around security, availability, processing integrity, confidentiality, and privacy actually work, without each customer having to audit the vendor themselves.
ISO/IEC 27001
To give organizations of any size or sector a systematic, internationally recognized framework, an Information Security Management System (ISMS), for identifying, treating, and continually improving how they manage information security risk.
GDPR
To give individuals in the EU/EEA real rights over their personal data (access, correction, erasure, portability) and to force any organization processing that data to justify why, secure it properly, and report breaches quickly.
HIPAA
To protect the privacy and security of individuals' health information while still allowing it to flow where it's legitimately needed, between providers, insurers, and the systems that keep healthcare running.
NIST 800-53
Originally built to secure US federal information systems under FISMA. It has since become the reference control catalog that other frameworks, including FedRAMP, build on, because it's exhaustive, regularly maintained, and free to use.
DORA
Financial services now run almost entirely on digital infrastructure, including cloud providers who are themselves outside financial regulators' direct reach. DORA harmonizes ICT risk management, mandatory incident reporting, resilience testing, and, notably, direct oversight of critical third-party ICT providers across the EU financial sector.
FFIEC
To give US banking regulators, and the institutions they examine, a consistent, repeatable way to assess technology and cybersecurity risk across the banking system, instead of every examiner improvising their own standard.
Need Help with AWS Security?
Our AWS security experts can help you implement best practices across all these topics.
Contact Us