GuardDuty vs Inspector vs Macie vs Security Hub: AWS Security Services Compared

Amazon GuardDuty, Amazon Inspector, Amazon Macie, and AWS Security Hub each answer a different security question. GuardDuty detects active threats by analyzing account activity logs. Inspector scans workloads for software vulnerabilities and unintended network exposure. Macie discovers sensitive data, such as personally identifiable information, in Amazon S3. Security Hub aggregates findings from all of them into one prioritized view of your security posture. The CLF-C02 exam tests whether you can match a scenario to the right service, so the distinctions are worth learning precisely.

Amazon GuardDuty: intelligent threat detection

GuardDuty answers the question “is something malicious happening in my account right now?” It is a threat detection service that continuously analyzes telemetry AWS already collects: AWS CloudTrail events (management activity and S3 data events), Amazon VPC (Virtual Private Cloud) Flow Logs, and DNS (Domain Name System) query logs. It applies machine learning, anomaly detection, and threat intelligence feeds of known malicious IP addresses and domains.

Typical GuardDuty findings: an EC2 instance communicating with a cryptocurrency-mining server, API calls from an IP address on a threat list, credential behavior that suggests compromised access keys, or unusual data access patterns in S3. Protection plans extend coverage to EKS (Elastic Kubernetes Service) audit logs, RDS login activity, Lambda network activity, and malware scanning of EBS volumes.

Two properties matter for the exam. GuardDuty is agentless: you enable it and it reads log sources; nothing is installed on your instances. And it is detective, not preventive: it raises findings, and remediation is up to you (often automated by routing findings through Amazon EventBridge to a Lambda function).

Amazon Inspector: vulnerability management

Inspector answers “what weaknesses exist in my workloads before anyone exploits them?” It is an automated vulnerability management service that continuously scans Amazon EC2 instances, container images in Amazon ECR (Elastic Container Registry), and AWS Lambda functions for two things: known software vulnerabilities (CVEs, Common Vulnerabilities and Exposures, in operating system packages and application dependencies) and unintended network exposure, such as a database port reachable from the internet.

Each finding carries a risk score that blends CVE severity with environmental factors like network reachability, which helps teams patch the riskiest items first. EC2 scanning works through the AWS Systems Manager (SSM) Agent or an agentless method; either way, scanning is continuous rather than a scheduled point-in-time assessment.

The mental hook: GuardDuty watches behavior (what is happening), Inspector inspects software (what could be exploited). A scenario about unpatched operating systems, vulnerable packages, or CVE reports is Inspector every time.

Amazon Macie: sensitive data discovery

Macie answers “where does sensitive data live in my S3 buckets, and is it exposed?” It uses machine learning and pattern matching to discover and classify sensitive data in Amazon S3: personally identifiable information (PII) like names, addresses, and passport numbers, financial data such as credit card numbers, and credentials. It also continuously evaluates your bucket inventory, flagging buckets that are publicly accessible, unencrypted, or shared outside your organization.

Macie’s scope is the discrimination point: it is S3-only and data-focused. It does not scan EC2, does not detect intrusions, and does not patch anything. Scenarios built around compliance regimes like GDPR (General Data Protection Regulation) or HIPAA that need to locate regulated data in S3 are Macie scenarios. Note that Macie discovers and classifies data; encrypting it is a separate job, covered in the AWS KMS encryption basics article.

AWS Security Hub: the aggregation layer

Security Hub answers “what is my overall security posture, in one place?” It ingests findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, AWS Config, and dozens of third-party tools, normalizes them into a common format, and presents consolidated dashboards. It also runs its own automated checks against security standards such as the AWS Foundational Security Best Practices and CIS (Center for Internet Security) benchmarks, and it can aggregate across all accounts in an organization.

Security Hub generates comparatively little original detection; its value is the single pane of glass and the compliance-standard scoring. When a stem says “centralized view of security alerts across multiple accounts and services,” the answer is Security Hub, not any individual detector.

	GuardDuty	Inspector	Macie	Security Hub
Core question	Active threats?	Vulnerabilities?	Sensitive data?	Overall posture?
What it examines	CloudTrail, VPC Flow Logs, DNS logs	EC2, ECR images, Lambda	S3 objects and bucket settings	Findings from other services
Finds	Compromised credentials, malicious activity	CVEs, network exposure	PII, financial data, public buckets	Aggregated, prioritized findings; standards scores
Keyword triggers	”threat detection”, “unusual activity”, “malicious IP"	"vulnerability”, “CVE”, “unpatched"	"PII”, “sensitive data in S3”, “data classification"	"single view”, “aggregate”, “security standards”

All four services live on the customer side of the AWS shared responsibility model: AWS provides the tooling, but enabling it and acting on findings is security “in” the cloud, which is your job.

How the CLF-C02 exam tests this

• A scenario reports unusual API calls, traffic to a known malicious IP, or possible compromised credentials, and asks which service detects it. GuardDuty. The words “continuously monitors for malicious activity” are practically its product tagline.
• A scenario needs EC2 instances or container images checked for software vulnerabilities or exposure to known CVEs. Inspector. Distractors will include GuardDuty; the tell is vulnerabilities versus active threats.
• A compliance team must find where PII is stored across hundreds of S3 buckets. Macie. If the data store named is anything other than S3, Macie is the wrong answer.
• An organization wants one consolidated dashboard of findings from multiple security services and accounts, or wants automated checks against CIS benchmarks. Security Hub.
• A trap pattern gives you a Macie-sounding phrase like “discover sensitive data” but sets it on EC2 volumes, or a GuardDuty-sounding phrase set as a scheduled vulnerability scan. Match the object of the sentence (logs, software, data, findings) to the service, not just the adjective.

Quick reference

• GuardDuty: threat detection from CloudTrail, VPC Flow Logs, and DNS logs; agentless; detective, not preventive.
• Inspector: continuous vulnerability scanning of EC2, ECR container images, and Lambda; thinks in CVEs and network reachability.
• Macie: machine-learning discovery of sensitive data (PII) in S3, plus bucket exposure monitoring; S3 only.
• Security Hub: aggregates findings from the others, scores you against standards like CIS; the single pane of glass.
• Logs point to GuardDuty, software flaws point to Inspector, S3 data points to Macie, “one view of everything” points to Security Hub.
• Enabling and responding to all four is customer responsibility under the AWS shared responsibility model.