One-line conclusion
- Amazon Inspector scans EC2, ECR images, and Lambda for software vulnerabilities.
- Amazon GuardDuty continuously detects suspicious account, network, and workload behavior.
- Amazon Macie discovers sensitive data such as PII in S3.
- Amazon Detective investigates root causes, relationships, and attack paths.
- AWS Security Hub aggregates and standardizes findings from multiple security services.
Core differences
| Service | Primary scope | Typical keywords | Main output |
|---|---|---|---|
| Inspector | EC2, ECR, Lambda | CVE, packages, vulnerability scan | Vulnerability findings and remediation |
| GuardDuty | Account, network, workload behavior | Malicious IP, anomalous API, threat intelligence | Threat findings |
| Macie | Amazon S3 data | PII, sensitive data, discovery | Sensitive-data findings |
| Detective | Security-event context | Root cause, timeline, relationship graph | Investigation context and impact |
| Security Hub | Findings from multiple sources | Aggregation, normalization, compliance | Unified security view and insights |
Combined workflow
Inspector, GuardDuty, and Macie detect issues → Security Hub aggregates and prioritizes → Detective investigates → EventBridge triggers automated response.
Common traps
- Inspector is not a behavioral threat-detection service.
- GuardDuty does not patch vulnerabilities.
- Macie focuses on sensitive data in S3.
- Detective investigates; it is not the central findings hub.