The security service map

Lesson 2 of 3 in Shared Responsibility and the Security Map.

The SCS-C03 guide publishes an in-scope service list that runs to sixty-odd entries, and it is not decoration. Matching items pair requirements with services; multiple-choice distractors are plausible precisely because the named service is real and does something adjacent. Service recognition is worth real marks, and the cheapest way to earn them is to be able to say what each in-scope service does in one line.

So put them on a board. Five jobs cover everything: work out who is asking (identify), stop what should not happen (protect), see what did happen (detect), act on it (respond), and set the rules for all of it across the estate (govern). The grouping is a study device modelled on the Well-Architected security pillar, not an AWS product boundary — but it maps almost perfectly onto the exam's own domains, which is the point.

Watch one request cross the board, and watch the findings and the remediation ride back.

Identify

Who or what is asking, and what are they allowed to be?

IAM — users, roles, identity and resource policies, permission boundaries, paths. The grammar everything else is written in.
IAM Identity Center — workforce access at scale: your identity provider, permission sets, assignments across every account. The answer to "employees need console access to 200 accounts".
AWS STS — issues the temporary credentials behind every role session. AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithSAML, session duration, session policies.
IAM Roles Anywhere — lets on-premises and other-cloud workloads obtain IAM role sessions using X.509 certificates instead of stored access keys.
Amazon Cognito — identity for your application's end users: user pools for sign-up and sign-in, identity pools for AWS credentials.
AWS Directory Service — managed Microsoft AD and connectors for workloads that must talk to Active Directory.
Amazon Verified Permissions — externalised, fine-grained authorization for your application's own resources, written in a policy language rather than in code.
AWS Verified Access — application access based on identity and device posture, with no VPN. Reach for it when the stem says "without a VPN" or "zero-trust access to internal apps".

Protect

Stop it happening — the preventive layer.

AWS WAF — layer-7 request filtering: managed rule groups including OWASP-style protections, rate-based rules, geo matching, bot control, custom headers.
AWS Shield / Shield Advanced — DDoS protection. Standard is automatic; Advanced is a subscription you then apply to specific resources, adding cost protection and the response team.
AWS Network Firewall — stateful, managed layer 3–7 inspection inside the VPC: domain lists, Suricata-compatible rules, east-west and north-south filtering.
Route 53 Resolver DNS Firewall — blocks DNS resolution of known-bad domains; the answer to data exfiltration over DNS.
AWS Firewall Manager — applies WAF, Shield Advanced, Network Firewall and DNS Firewall policies centrally across the organization.
Security groups and network ACLs — the instance-level stateful filter and the subnet-level stateless one. Know which is which; see the traps lesson.
CloudFront, ELB, API Gateway — the edge termination points where TLS policies, headers, CORS, authorizers and throttling live.
VPC endpoints and PrivateLink — private paths to AWS services and partner services, with endpoint policies as an extra control.
Site-to-Site VPN, Client VPN, Direct Connect (with MACsec) — encrypted hybrid connectivity.
AWS KMS — managed keys, key policies, grants, rotation, multi-Region keys, imported key material, external key stores.
AWS CloudHSM — single-tenant hardware security modules when you must hold custody yourself.
ACM and AWS Private CA — public certificates with managed renewal, and your own internal certificate authority.
AWS Secrets Manager — secret storage with managed rotation, resource policies for cross-account use, and replication.
Amazon S3 controls — Block Public Access, bucket policies, access points, Object Lock, versioning.
EC2 Image Builder — hardened golden AMIs and container images, built on a pipeline rather than by hand.

Detect

See what happened — the detective layer.

Amazon GuardDuty — continuous threat detection from telemetry it reads for you, plus Runtime Monitoring inside EC2, ECS and EKS, and malware protection.
Amazon Inspector — continuous CVE scanning of EC2 instances, ECR container images, and Lambda functions and layers.
Amazon Macie — discovery and classification of sensitive data in Amazon S3.
AWS Security Hub — cross-account, cross-service aggregation of findings with security standards and scoring, through a delegated administrator.
Amazon Detective — graphs the activity around a finding to establish scope and root cause.
AWS Config — configuration history, rules, conformance packs, aggregators, and automatic remediation.
AWS CloudTrail / CloudTrail Lake — the record of API calls, including organization trails and managed queryable retention.
Amazon Security Lake — a security data lake normalising AWS, on-premises and third-party sources into OCSF.
IAM Access Analyzer — external-access findings, unused-access findings, policy validation, and policy generation from CloudTrail activity.
Amazon CloudWatch — metrics, alarms, Logs, metric filters, Logs Insights, and Logs data protection policies for masking sensitive data in logs.
Amazon Athena, Amazon OpenSearch Service, Amazon Managed Grafana — query, correlate and visualise logs at scale.
Network Access Analyzer — finds network paths that exist but should not.
AWS Trusted Advisor and AWS User Notifications — standing checks, and one place to route the alerts.

Respond

Act on it — the responsive layer.

AWS Systems Manager — the response workhorse: Automation documents as runbooks, Session Manager for shell access with no open ports or keys, Patch Manager, State Manager, OpsCenter for the incident record.
AWS Step Functions — orchestrates multi-step response with branching, approvals and retries, so the plan is versioned and auditable.
AWS Lambda and Amazon EventBridge — the glue that turns a finding into an action in seconds.
Automated Forensics Orchestrator for Amazon EC2 — an AWS solution that automates artefact acquisition and isolation for a compromised instance.
AWS Backup — centralised, policy-driven backup with vault locking: the ransomware-recovery answer.
Amazon Data Lifecycle Manager and AWS DataSync — scheduled EBS snapshots, and moving data between on-premises and AWS securely.
Amazon Application Recovery Controller and AWS Resilience Hub — readiness checks and recovery orchestration.
AWS Fault Injection Service — the way the guide expects you to test a response plan rather than assume it works.
Amazon SNS — notification fan-out, with message data protection to mask sensitive payloads.

Govern

Set the rules for the whole estate.

AWS Organizations — the account boundary, OUs, and policy types: SCPs (cap what principals may do), RCPs (cap what resources will accept), declarative policies, and AI service opt-out policies. Also centralised root access for member accounts.
AWS Control Tower — a governed landing zone with managed and custom controls, applied to OUs.
AWS Config (again) — organization-wide conformance packs are the compliance backbone.
AWS Audit Manager — collects and organises evidence continuously against a framework, for your controls.
AWS Artifact — AWS's own compliance reports and agreements, for the controls you inherit.
AWS Well-Architected Tool — evaluates a workload against the framework's security guidance and produces an improvement plan.
AWS CloudFormation — infrastructure as code, with StackSets for multi-account deployment and CloudFormation Guard / cfn-lint for policy-as-code checks in the pipeline.
AWS RAM — shares resources such as subnets, Transit Gateways and Private CAs across accounts without copying them.
AWS Service Catalog — a curated set of approved, pre-hardened products teams may self-serve.
Tagging — the substrate for attribute-based access control, cost allocation and inventory. Tags are a security control once a policy condition depends on them.

Five tabs, one board. Now compress it into the form an exam item actually arrives in: a verb and a constraint. The table below is the function-level reflex — the phrase-level version, dense enough to drill, lives in the readiness module.

The verb in the question, the job it names, and the service that owns that job.
If the question says…	The job	Reach for
“employees must sign in to many accounts”	identify	IAM Identity Center federated to your IdP, with permission sets — not IAM users per account.
“our application’s end users must sign up and sign in”	identify	Amazon Cognito user pools; identity pools when those users also need AWS credentials.
“credentials must be short-lived” / “no stored access keys”	identify	AWS STS role sessions; IAM Roles Anywhere for on-premises workloads; S3 presigned URLs for one object.
“ensure it cannot happen at all”	protect	A preventive control: SCP or RCP, an explicit deny, S3 Block Public Access, a security group with no matching rule.
“SQL injection” / “bad bots” / “rate limit by IP”	protect	AWS WAF on CloudFront, ALB, API Gateway or AppSync — managed rule groups plus rate-based rules.
“large volumetric DDoS with AWS support engagement”	protect	AWS Shield Advanced, subscribed and then applied to the specific resources.
“inspect traffic between VPCs” / “block known-bad domains”	protect	AWS Network Firewall for stateful inspection; Route 53 Resolver DNS Firewall for DNS-based exfiltration.
“same firewall rules in every account, enforced”	protect + govern	AWS Firewall Manager policies at the organization level.
“keys we control” / “single-tenant FIPS custody”	protect	KMS customer managed keys normally; AWS CloudHSM only when single-tenant hardware custody is explicitly required.
“rotate the database password automatically”	protect	AWS Secrets Manager managed rotation — Parameter Store has none.
“who called this API, and when”	detect	AWS CloudTrail; an organization trail to a locked archive account when the answer must be tamper-resistant.
“detect compromise without building a log pipeline”	detect	Amazon GuardDuty — it reads the telemetry itself.
“find the sensitive data” / “find the CVEs”	detect	Amazon Macie for data at rest in S3; Amazon Inspector for vulnerabilities in instances, images and functions.
“one view across all accounts” / “against standards”	detect	AWS Security Hub with a delegated administrator.
“remediate automatically, in seconds”	respond	EventBridge → Systems Manager Automation (or Step Functions, or Lambda); Config auto-remediation for drift.
“prove it to the auditor”	govern	AWS Audit Manager for your controls, AWS Artifact for AWS’s, Well-Architected Tool for architecture review.

Key terms: In-scope service list, Preventive control, Detective control, Responsive control, Well-Architected security pillar