Monitoring and Alerting

Turning a workload into monitoring requirements: the four shapes a security signal takes, EventBridge as the spine, GuardDuty end to end, Security Hub as the aggregator, and Macie, Config and State Manager running continuous assessment.

Content current as of 2026-10.

Lessons

1. Deriving monitoring requirements
2. GuardDuty in depth
3. Security Hub, standards, and aggregation
4. Macie, Config, and automated assessment

Sources

• SCS-C03 exam guide — Content Domain 1 (tasks 1.1–1.3)
• Amazon GuardDuty — foundational data sources
• AWS Security Hub CSPM — standards reference
• AWS Config — conformance packs