Assess Your AWS Security Posture

Set up Security Hub and GuardDuty to monitor and assess your AWS security posture.

Introduction

30 Second Summary

Think about how companies protect their cloud accounts from hackers and misconfigurations. Every day, security teams monitor dashboards that flag vulnerabilities and detect active threats before they cause damage.

In this project, you will set up enterprise-grade security monitoring on a brand new AWS account using AWS Security Hub and Amazon GuardDuty. You'll assess your compliance posture against industry benchmarks and investigate simulated threat alerts.

What You'll Build

You'll open a live security dashboard that scores your AWS account against industry benchmarks and surfaces threat alerts you can click into and investigate on the spot.

By the end of this project, you'll have:

A live security score showing how your account measures up against the CIS AWS Foundations Benchmark, with individual controls flagging real misconfigurations.
Active threat detection monitoring your account for malicious activity like unauthorized access and cryptocurrency mining.
Hands-on experience investigating simulated security alerts and triaging them by severity, exactly like a professional security analyst.
Secret Mission: Remediate a real CIS compliance finding by enabling MFA on your root account to boost your security score.

Do I need an existing AWS account?

No, this project walks you through creating a brand new AWS account from scratch with the Paid account plan needed for Security Hub and GuardDuty free trials. You will need a credit or debit card for verification, but you will not be charged during the 30-day free trials.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Create Your AWS Account

You've committed to building a cloud security monitoring environment. The next step is getting access to the platform where it all happens.

To use Security Hub and GuardDuty, you need an AWS account. You'll sign up with the Paid plan, which unlocks 30-day free trials for both services.

In this step, get ready to:

Create an AWS account with the Paid plan.
Sign in to the AWS Management Console and select your Region.

Create your AWS account

The signup process takes about 10 minutes. You'll need your email address, a phone number, and a credit or debit card.

Open your browser and navigate to the AWS Free Tier page.
Click Create an AWS Account.
Enter your email address in the Root user email address field.
Edit the AWS account name to something you'll recognise.
Click Verify email address.

AWS sends a verification code to the email address you entered. Check your inbox for the code.

Enter the verification code on the signup page and click Verify.
Create a strong root user password and confirm it.
Click Continue.

The next page asks you to choose an account plan.

Select the Paid plan.

Why choose the Paid plan?

AWS offers two account plans. The Free plan only includes Always Free services. The Paid plan adds access to short-term free trial services.

Security Hub and GuardDuty are trial services, not Always Free services. Choosing the Paid plan unlocks their 30-day free trials, which is what you need for this project.

Choose Personal as the account type on the contact information page.
Enter your contact details and click Continue.
Enter your credit or debit card details on the billing information page.

Will I be charged?

Your card is required for identity verification, but you will not be charged during the 30-day free trials for Security Hub and GuardDuty.

New AWS accounts also receive $100 in credits after account creation, regardless of plan choice.

Complete the phone verification step by entering the code sent via text or voice call.
Select the Basic (Free) support plan.
Click Complete sign up.

You should see a confirmation page letting you know your account is being activated. Accounts usually activate within a few minutes, but it can take up to 24 hours.

Account not activating?

If you see an activation pending message after a few minutes, wait and try again shortly. In rare cases, activation can take up to 24 hours.

If your account still isn't activated after 24 hours, help me troubleshoot my AWS account activation.

Sign in and set your Region

Once your account is activated, you can sign in to the console and choose a Region. Every AWS service you use in this project runs inside the Region you select here.

Navigate to console.aws.amazon.com.
Choose Root user and enter the email address you used during signup.
Enter your password on the next page.

You should land on the Console Home page. Now set your Region.

In the navigation bar at the top of the page, click the Region name displayed in the upper-right area.
Select a Region close to you from the dropdown. For example, US East (N. Virginia) us-east-1.
Record the Region you selected: e.g. us-east-1.

Why does your Region matter?

AWS runs its services in data centres grouped by geographic Region. The resources you create in one Region do not appear in another. Selecting a Region close to you reduces latency.

You will use the same Region for Security Hub, GuardDuty, and every other service in this project.

Verify your Console Home page

Before continuing, take a moment to predict what you expect to see on the Console Home page. What elements should confirm your account is active and your Region is set?

You should see the AWS logo in the top-left corner, a search bar across the top, and your selected Region displayed in the upper-right. A list of recently visited services may appear below.

Seeing an activation pending message?

If the console shows that your account is still being activated, wait a few minutes and refresh the page. You can also try signing out and signing back in.

If the issue persists, help me get past the AWS activation pending screen.

Your AWS account is live and ready. In the next step, you'll enable Security Hub and get your first look at your account's security score against industry benchmarks.

Enable Security Hub and See Your Security Score

Your AWS account is live and ready to go. Now it's time to find out how secure it actually is.

Security Hub is AWS's central dashboard for tracking your cloud security posture. You'll enable it in this step and get your first security score, a real measurement of how well your account follows industry best practices.

In this step, get ready to:

Enable AWS Security Hub with all capabilities in your Region.
View your account's initial security score on the dashboard.
Explore failing controls in the CIS AWS Foundations Benchmark.

Enable AWS Security Hub

Security Hub needs to be turned on before it can start checking your account. You'll enable it through the AWS Management Console with just a few clicks.

Type Security Hub in the search bar at the top of the AWS Management Console.
Select Security Hub from the search results.
On the Security Hub homepage, click Get started.
In the Security capabilities section, select Enable all capabilities.
In the Regions section, select Enable specific Regions.
Select only the Region you chose in Step 1 (e.g., US East (N. Virginia)).
Click Enable Security Hub.

After a moment, the Security Hub dashboard loads. You should see a navigation sidebar on the left and a main dashboard area with widgets.

What is Security Hub?

Security Hub is your central command center for cloud security. It continuously checks your AWS account against industry security standards and flags anything that doesn't meet best practices.

By choosing Enable all capabilities, you turned on Security Hub's essential capabilities, threat analytics, and additional capabilities all at once. This also automatically enabled security standards like the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices.

Don't see the Get started button?

If you see a full dashboard instead of a setup page, Security Hub may already be enabled in your account. Check the left sidebar for Summary and Security standards to confirm it's active.

Help me figure out if Security Hub is already enabled in my account.

See your security score

Before you look at the numbers, take a guess. What do you think the security score will be for an account you created just minutes ago with no security configurations in place?

On the Security Hub dashboard, look for the Summary page (it should be selected in the left sidebar by default).
Find the Security standards widget, which shows your summary security score as a percentage.

Your score is likely below 50%. That is completely normal for a brand new account.

Why is my score so low?

A brand new AWS account hasn't been hardened yet. Features like MFA, logging, and password policies all need to be configured manually.

Every unconfigured control counts as a failing check, which pulls your score down. This low score is your starting baseline. It tells you exactly where to focus your security efforts.

Security Hub calculates your first score within about 30 minutes of your first visit to the dashboard. Some findings appear immediately, but it can take up to several hours for all findings to fully show up. If your dashboard looks sparse right now, check back later.

View the CIS AWS Foundations Benchmark results

Your security score comes from checks against specific security standards. Let's look at the individual controls to see exactly what is failing and why.

In the left sidebar, click Security standards.

You should see standards listed including CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices, both shown as enabled with their own security scores.

Click into the CIS AWS Foundations Benchmark to see its individual controls and their pass/fail status.

You'll see a list of controls, each marked as passed or failed. Look for controls failing around MFA for the root account, CloudTrail logging, and password policies.

These are real security gaps in your brand new account. Each one represents a specific improvement you can make.

What is the CIS AWS Foundations Benchmark?

The CIS AWS Foundations Benchmark is a set of security best practices published by the Center for Internet Security. Organizations worldwide use it as a standard checklist for securing their AWS accounts.

Security Hub automatically checks your account against these controls and reports which ones pass or fail. Each failing control is a specific action item for hardening your account.

Not seeing any controls yet?

Security Hub can take some time to evaluate all controls after first being enabled. If you see an empty list or very few results, wait a few minutes and refresh the page.

If the score still shows as generating, Security Hub is still running its initial checks. You can continue to the next step and come back to review findings later.

My Security Hub controls are not showing up. What should I do?

You now have a clear picture of your account's security posture and where it falls short. But there's a gap in your monitoring. Security Hub tells you what's misconfigured. In the next step, you'll add a service that detects active threats trying to break in right now.

Enable GuardDuty for Threat Detection

Your Security Hub dashboard is now showing which security controls your account passes and fails. Compliance checks catch misconfigurations, but what about someone actively trying to break into your account?

That kind of threat won't trigger a compliance finding. Amazon GuardDuty fills this gap by monitoring your account for malicious activity in real time.

In this step, get ready to:

Enable Amazon GuardDuty with all features on your account.
Confirm your Findings page is empty and your free trial is active.
Review the default protection plans GuardDuty enables automatically.

Enable Amazon GuardDuty

In the AWS Console search bar at the top of the page, type GuardDuty.
Select GuardDuty from the search results.
On the GuardDuty page, select Amazon GuardDuty - All features.
Click Get started.
On the Welcome to GuardDuty page, click Enable GuardDuty.

What just happened?

GuardDuty immediately started monitoring your account for threats. It analyzes CloudTrail management events, VPC Flow Logs, and DNS query logs automatically.

You didn't need to deploy any agents or configure any infrastructure. GuardDuty handles all of that behind the scenes.

Don't see the Get started button?

If you see the Findings page instead of a welcome screen, GuardDuty is already enabled in this Region. This can happen if it was turned on earlier. You can skip ahead to the next substep.

Help me troubleshoot enabling GuardDuty.

Confirm your findings and free trial status

GuardDuty is enabled. Before you check the Findings page, what do you think GuardDuty has found on your brand new account so far?

Click Findings in the left sidebar.

The Findings page is empty. No threats have been detected on your brand new account, which is expected and actually good news.

Click Usage in the left sidebar.

You should see your 30-day free trial status and an estimated cost of $0.00.

Seeing unexpected charges on the Usage page?

Double check that you selected the Paid account plan during signup. The 30-day free trial for GuardDuty is only available on Paid plan accounts. Your estimated cost should show $0.00 during the trial period.

Help me understand my GuardDuty usage costs.

Review the default protection plans

GuardDuty automatically enabled several protection plans with your free trial. Each plan monitors a different part of your AWS environment for threats.

Click Protection plans in the left sidebar.

You should see five protection plans enabled by default. Each one covers a different AWS service category.

What do these protection plans monitor?

S3 Protection monitors access to your S3 buckets for signs of data theft or unauthorized access.
EKS Protection monitors EKS clusters running Kubernetes workloads.
RDS Protection monitors RDS database login activity for suspicious access patterns.
Lambda Protection monitors Lambda function invocations for malicious activity.
Malware Protection for EC2 scans EC2 instances for malware when GuardDuty detects suspicious behavior.

With one click, you activated enterprise-grade threat detection across multiple AWS service categories. This is exactly the kind of coverage a security team would configure in a production environment.

GuardDuty is now watching your account for threats across multiple service categories. Your Findings page is still empty because no real threats have targeted your new account yet.

Next up, you'll generate simulated threat findings and practice the investigation workflow security analysts use every day.

Generate and Investigate Threat Findings

Amazon GuardDuty is now monitoring your account for threats. It analyzes network traffic, DNS queries, and API calls around the clock to catch malicious activity.

Your Findings page is still empty because no real attacks have targeted your brand new account. You need to know what threat alerts look like and how to investigate them before a real incident happens, and GuardDuty includes a built-in sample findings generator for exactly this purpose.

In this step, get ready to:

Generate sample threat findings in GuardDuty.
Investigate a high-severity finding and examine its details.
Explore the different categories of security threats GuardDuty detects.

Generate sample findings in GuardDuty

GuardDuty's sample findings generator creates realistic-looking threat scenarios across multiple categories. These are the same finding types you would encounter during a real security incident, populated with placeholder values for practice.

In the GuardDuty console, click Settings in the left sidebar.
Scroll down to the Sample findings section.
Click Generate sample findings.

Before you navigate back to Findings, what do you think you will see there now? Will the page still be empty?

Click Findings in the left sidebar.

Your Findings page now shows dozens of sample findings. Each row represents a simulated security threat, complete with a finding type, severity level, and affected resource. Sample findings are prefixed with [SAMPLE] in the console to distinguish them from real detections.

Don't see any findings?

Confirm you clicked Generate sample findings on the Settings page. Scrolling past it without clicking is easy to do.
Try clicking Findings in the left sidebar again to refresh the page.
Make sure the Status dropdown at the top of the Findings page is set to Current, not Archived.
Why are my GuardDuty sample findings not appearing?

Investigate a high-severity finding

Security analysts triage alerts by severity. The highest severity findings demand immediate attention because they indicate an actively compromised resource.

In the Findings list, click a column header that has an arrow icon next to it (like Severity) to sort the table. Click it again if needed to bring the highest severity findings to the top.
Find a finding with severity High. Look for finding types like Backdoor:EC2/DenialOfService.Udp or CryptoCurrency:EC2/BitcoinTool.B!DNS.
Click on the finding's title to open its details side panel.

Can't find a high-severity finding?

Not all column headers support sorting. Look for column headers with a small arrow icon next to them. If sorting does not bring high-severity findings to the top, try scrolling through the list and visually scanning for findings labeled High in the severity column.

Help me find a high-severity sample finding in the GuardDuty console.

The detail panel shows the full story of this simulated threat. This is exactly what a security analyst reviews during a real incident.

What am I looking at in the detail panel?

Severity tells you how urgent the response should be. Critical (9.0-10.0) and High (7.0-8.9) findings demand immediate attention.
Resource affected shows which AWS resource is under attack and whether it was the target or the actor in the suspicious activity.
Action describes what malicious activity was detected, including the action type (network connection, API call, DNS request) and related details.
Actor or Target reveals where the threat originated, including IP addresses and geolocation data when available.

Understand the finding categories

Each finding type name starts with a category prefix that tells you what kind of threat you are dealing with. The category determines the urgency and type of response needed.

Close the detail panel and browse through several findings with different type names.
Notice how each finding type name follows a pattern: the prefix before the colon is the threat category.

What do the finding categories mean?

Backdoor means a compromised resource is being used to launch attacks on other targets.
CryptoCurrency means resources are being hijacked for cryptocurrency mining.
Trojan means malware activity has been detected on a resource.
UnauthorizedAccess means someone is accessing resources without proper authorization.
Recon means someone is scanning your environment for vulnerabilities before launching a targeted attack.

In a real incident, a Backdoor or CryptoCurrency finding demands faster response than a Recon finding because the former means damage is already happening.

How does the finding type naming work?

GuardDuty finding types follow a structured format: ThreatPurpose:ResourceType/ThreatFamily.Mechanism!Artifact. For example, CryptoCurrency:EC2/BitcoinTool.B!DNS tells you the threat purpose is cryptocurrency mining, the affected resource is an EC2 instance, the threat family is BitcoinTool, and the detection artifact is DNS traffic.

Reading these names becomes second nature with practice. The structure lets you instantly understand the nature of a threat without opening the full detail panel.

Your GuardDuty Findings page is now populated with sample threats across all major categories. You have practiced the core investigation workflow: sort by severity, drill into the detail panel, and read the finding type to understand the threat.

You have just practiced the same threat triage workflow that security analysts perform every day. Next up, you will see how Security Hub pulls these threat findings together with your compliance data into a single unified dashboard.

Connect Security Hub and GuardDuty

You've generated and investigated sample threat findings in GuardDuty. You can spot the difference between a backdoor alert and a cryptocurrency mining attempt, and you know how to triage a high-severity finding.

Right now, your security data lives in two separate places. Security Hub shows what's misconfigured. GuardDuty shows who's attacking you. In the real world, security analysts don't check two dashboards separately. In this step, you'll see how Security Hub pulls everything into a single unified view, the same way real security operations centers monitor their environments.

In this step, get ready to:

View GuardDuty threat findings inside Security Hub's unified Findings page.
Compare findings from different sources using the standardized AWS Security Finding Format.
Review your overall security posture and note your current score.

View GuardDuty findings inside Security Hub

Security Hub doesn't just track compliance. It aggregates findings from other services like GuardDuty into one place. Before you check, think about what you expect to see on Security Hub's Findings page. Will it only show compliance findings, or something more?

Return to the Security Hub console by typing Security Hub in the AWS Console search bar and selecting it.
In the left sidebar, click Findings.

You'll see a mix of findings. Some are compliance findings from Security Hub's own checks (the ones you explored in Step 2). Others are threat findings pulled in from GuardDuty (the sample findings you generated in Step 4).

Why are GuardDuty findings here automatically?

Security Hub automatically imports findings from GuardDuty without any extra configuration. When you enabled both services in the same Region, Security Hub began pulling in GuardDuty's threat detections alongside its own compliance checks.

This means security analysts get one place to see all findings. No dashboard-hopping during an incident.

Now filter the findings to confirm the GuardDuty integration is working.

In the filter bar at the top of the Findings page, click Add filter.
Set the filter field to Product name.
Set the value to GuardDuty.
Press Enter or click the filter to apply it.

The list now shows only findings that originated from GuardDuty. You can see your sample threat findings right here inside Security Hub, with standardized severity labels and resource details.

Don't see any GuardDuty findings?

Make sure the Product name filter is set to GuardDuty (not a different value). If the list is still empty, confirm you generated sample findings in the previous step by switching back to the GuardDuty console and checking the Findings page there.

Also verify that both Security Hub and GuardDuty are enabled in the same Region (check the Region selector in the top-right corner of the console).

Help me troubleshoot why GuardDuty findings aren't showing in Security Hub.

Compare findings from different sources

The filter proved that GuardDuty findings flow into Security Hub. Now clear it so you can see how Security Hub presents findings from all sources in a consistent format.

Clear the GuardDuty filter by clicking the X next to the Product name: GuardDuty filter tag.

With the filter cleared, your full findings list is back. Notice how every finding follows the same structure, regardless of whether it came from Security Hub's compliance checks or GuardDuty's threat detection.

What is the AWS Security Finding Format?

Every finding in Security Hub uses the AWS Security Finding Format (ASFF). This format standardizes how findings look, no matter which service detected them.

Each finding has a consistent severity label (CRITICAL, HIGH, MEDIUM, LOW, or INFORMATIONAL), a resource identifier showing which AWS resource is affected, and a remediation recommendation. One format, one place, all your security data.

Click on any finding in the list to open its detail panel.
Confirm the detail panel shows a Severity label, a Resource section, and a Remediation section.
Close the detail panel when you're done.

This is the value proposition of Security Hub. Whether a finding comes from a compliance check or a live threat detector, it always has the same structure. A security analyst can triage and prioritize across all sources without switching tools.

Review your overall security posture

You've seen how individual findings flow together. Now step back to the big picture. The Summary page is where a security analyst would start their day, checking the organization's overall health at a glance.

In the left sidebar, click Summary.

Your security score shows your compliance posture. The findings count shows your total security workload. On a brand-new account, your score is likely below 50% because many best-practice controls aren't configured yet.

Find your Security score on the Summary page and take note of the current percentage.

Why note your score now?

In a real environment, a security analyst would use this dashboard to report to leadership on the organization's security health and track improvement over time.

You'll use your current score as a baseline. In the Secret Mission, you'll remediate a real finding and watch that score improve.

Secret mission

Remediate a Finding to Improve Your Score

You've detected security gaps and investigated simulated threats. Now complete the full security operations lifecycle by fixing a real finding. Identify a failing CIS control in Security Hub, remediate it by enabling MFA on your root account, and verify that your compliance score improves.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Both AWS Security Hub and Amazon GuardDuty have 30-day free trials active, so charges will begin only after those trials expire if the services remain enabled.

Cost warning

Security Hub and GuardDuty each have a 30-day free trial. After the trial ends, you will be charged based on usage if the services remain enabled.

AWS Config service-linked rules were also created by Security Hub and may generate minimal charges for configuration items while active. Disabling Security Hub removes these rules automatically.

Resources you used:

AWS Security Hub (30-day free trial active, charges begin after trial if not disabled).
Amazon GuardDuty (30-day free trial active, charges begin after trial if not disabled).
AWS Config rules (service-linked rules created by Security Hub, automatically removed when Security Hub is disabled).

Keep everything running

No action needed. Choose this if you want to continue monitoring your account during the 30-day free trial period.

Leave Security Hub and GuardDuty active to keep monitoring your account's security posture and threat detection.
Monitor your estimated costs in the GuardDuty console by navigating to Usage in the left sidebar. Estimated costs should show $0.00 during the trial.
Set a calendar reminder for 30 days from today to decide whether to keep or disable the services before charges begin.

Pause - I'll come back to this later

Security Hub and GuardDuty cannot be paused. You can only disable them entirely or keep them running.

If you want to stop all charges, follow the steps in the Delete tab to disable both services.
If you plan to come back within the 30-day free trial window, leave the services active at no cost.

Delete - I don't want to use this again

Remove all project resources and stop any future charges. Disabling these services permanently removes all findings and configuration.

Disable Security Hub:

Open the Security Hub console at https://console.aws.amazon.com/securityhub/v2/home.
In the left navigation pane, click General.
In the Security Hub section, click Disable.
In the pop-up window, type Disable and click Disable to confirm.

What about AWS Config?

Disabling Security Hub automatically deletes the AWS Config rules it created for security checks. You do not need to disable AWS Config separately.

Disable GuardDuty:

Open the GuardDuty console at https://console.aws.amazon.com/guardduty/.
In the left navigation pane, click Settings.
In the Suspend GuardDuty section, click Disable GuardDuty.
Click Confirm to complete the action.

This action is permanent

Disabling GuardDuty deletes all existing findings and configuration. They cannot be recovered. If you want to keep your findings, export them before disabling.

Nice Work!

Nice work! You've just built a fully operational cloud security monitoring environment using AWS Security Hub and Amazon GuardDuty. These are the same tools Fortune 500 security teams rely on every single day.

You've learned how to:

Enable Security Hub and assess your AWS account's compliance posture against the CIS AWS Foundations Benchmark, identifying real security gaps on a brand new account.
Enable GuardDuty for real-time threat detection, generate sample findings, and investigate high-severity alerts using the same triage workflow security analysts perform during real incidents.
Connect both tools into a unified security operations dashboard using the AWS Security Finding Format, giving you one place to triage compliance findings and threat detections together.
Secret Mission: Remediated a real CIS finding by enabling MFA on your root account, completing the full detect-investigate-remediate lifecycle.

Ready to quiz yourself?