AWS Intrusion Detection & Prevention System IDS/IPS

An Intrusion Prevention System (IPS)
- is an appliance that monitors and analyzes network traffic to detect malicious patterns and potentially harmful packets and prevent vulnerability exploits
- Most IPS offer firewall, unified threat management and routing capabilities
An Intrusion Detection System (IDS) is
- an appliance or capability that continuously monitors the environment
- sends alerts when it detects malicious activity, policy violations or network & system attack from someone attempting to break into or compromise the system
- produces reports for analysis.

AWS Native IDS/IPS Services

AWS now provides several native managed services that deliver IDS/IPS capabilities without requiring third-party appliances:

AWS Network Firewall

AWS Network Firewall is a managed, stateful network firewall and intrusion detection and prevention service for VPCs.
Uses the open-source Suricata IPS engine for stateful inspection, supporting Suricata-compatible rules.
Provides deep packet inspection (DPI), examining packet payloads beyond just header information.
Supports both stateless and stateful rule engines:
- Stateless engine – inspects each packet in isolation, evaluating against standard network attributes.
- Stateful engine – maintains connection state, performs protocol detection, and applies IPS signatures.
Key IDS/IPS capabilities:
- Active Threat Defense – AWS-managed rules that automatically block traffic to malicious IPs, domains, and URLs including C2 channels, malware staging hosts, sinkholes, and mining pools.
- Managed Threat Signatures – rule groups protecting against malware, exploits, botnets, web attacks, credential phishing, scanning tools, and DoS attempts.
- TLS Inspection – decrypts and inspects encrypted SSL/TLS traffic (both inbound and outbound) for hidden threats.
- Domain Filtering – allows/denies traffic based on domain names.
- Geographic IP Filtering – filters traffic based on country codes (added Dec 2024).
- Automated Domain Lists – analyzes HTTP/HTTPS traffic patterns and simplifies outbound traffic control.
Supports thousands of custom rules based on domain, port, protocol, IP addresses, and pattern matching.
Auto-scales based on traffic load and provides built-in redundancy across Availability Zones.
Filters traffic at VPC perimeter – internet gateway, NAT gateway, VPN, or Direct Connect.
In April 2026, AWS expanded support for Marketplace partner managed rules with up to 10 million domain indicators and 1 million IP addresses per rule group.

Amazon GuardDuty

Amazon GuardDuty is an intelligent threat detection service providing continuous monitoring and intrusion detection for AWS accounts, workloads, and data.
Analyzes multiple data sources: VPC Flow Logs, CloudTrail events, DNS logs, EKS audit logs, S3 data events, and runtime activity.
Uses machine learning, anomaly detection, and integrated threat intelligence to identify threats.
Protection plans extend detection to:
- S3 Protection – monitors S3 data access patterns
- EKS Protection – monitors Kubernetes audit logs and runtime
- Runtime Monitoring – monitors OS-level activity on EC2 and containers
- Malware Protection – scans EBS volumes for malware
- RDS Protection – monitors login activity for databases
- Lambda Protection – monitors serverless function network activity
Extended Threat Detection (Dec 2024) – uses AI/ML to identify multi-stage attack sequences across accounts, correlating related activities like credential misuse, unusual S3 access, and network anomalies.
Extended Threat Detection for EC2 and ECS (Dec 2025) – expands sequence-level detection to virtual machine and container environments.
Extended Threat Detection for EKS (Jun 2025) – covers Kubernetes cluster compromise sequences.
Custom Entity Lists (Sep 2025) – allows incorporating custom domain-based and IP-based threat intelligence.
Integrates with AWS Security Hub for centralized findings management.

VPC Traffic Mirroring

VPC Traffic Mirroring copies network traffic from EC2 elastic network interfaces to out-of-band security and monitoring appliances.
Enables deployment of network-based IDS/IPS, NDR (Network Detection and Response), SIEM, and network forensics tools without agents.
Supports sending mirrored traffic to:
- Individual EC2 instances running IDS/IPS software
- A fleet behind a Network Load Balancer
- A fleet behind a Gateway Load Balancer (UDP listener)
- Amazon S3 (via Mountpoint) for offline packet capture and analysis
Supports traffic filters to capture only relevant traffic (reducing costs and noise).
Supports packet truncation to extract only headers or specific payload portions.
Replaces the traditional need for network TAPs or SPAN ports that are not available in AWS.
Use cases: content inspection, threat monitoring, troubleshooting, network performance monitoring.

Gateway Load Balancer (GWLB)

Gateway Load Balancer enables transparent insertion of third-party virtual IDS/IPS appliances into the traffic path.
Operates at Layer 3 (network layer), listening on all IP packets across all ports.
Uses GENEVE encapsulation (port 6081) to forward original packets to appliances – appliances see unmodified traffic.
Provides a single entry and exit point for all traffic while distributing load across a fleet of virtual appliances.
Supports flow stickiness using 5-tuple (default), 3-tuple, or 2-tuple.
Auto-scales appliance capacity based on demand.
Supports target failover for existing flows, ensuring continuity if an appliance becomes unhealthy.
Works with third-party IDS/IPS solutions from AWS Marketplace (Palo Alto, Fortinet, Check Point, etc.).
Integrates with AWS PrivateLink via Gateway Load Balancer Endpoints for cross-VPC inspection architectures.

AWS Shield & Shield Advanced

AWS Shield Standard – automatic DDoS protection at layers 3 and 4 for all AWS resources at no additional cost.
AWS Shield Advanced – enhanced DDoS protection with detection and mitigation at layers 3, 4, and 7, plus access to the DDoS Response Team (DRT).
Network Security Director (Preview, Jun 2025) – a new Shield capability that:
- Discovers resources across AWS accounts and identifies connectivity
- Identifies missing or misconfigured network security services (WAF, security groups, NACLs, Network Firewall)
- Provides severity-prioritized findings with actionable remediation recommendations
- Supports multi-account analysis (Dec 2025)
- Findings integrate with AWS Security Hub (Mar 2026)

AWS Security Hub

Aggregates and prioritizes security findings from GuardDuty, Network Firewall, Inspector, Shield, and third-party tools.
Provides centralized dashboard for IDS/IPS findings across all services.
Runs compliance checks against CIS, PCI DSS, and AWS Foundational Security Best Practices.
Near Real-Time Risk Analytics (Dec 2025) – correlates signals from GuardDuty, Inspector, and CSPM to surface active risks.
Exposure Findings (Jun 2025) – helps prioritize security issues based on resource exposure.

Traditional Approaches for AWS IDS/IPS

Network Tap or SPAN

Traditional approach involves using a network Test Access Point (TAP) or Switch Port Analyzer (SPAN) to access & monitor all network traffic.
Connection between the AWS Internet Gateway (IGW) and the Elastic Load Balancer would be an ideal place to capture all network traffic.
However, there is no place to plug this in between IGW and ELB as there are no SPAN ports, network taps, or a concept of Layer 2 bridging.
Modern Alternative: Use VPC Traffic Mirroring to copy network traffic from ENIs to IDS/IPS appliances, or use AWS Network Firewall for inline inspection.

Packet Sniffing

It is not possible for a virtual instance running in promiscuous mode to receive or sniff traffic that is intended for a different virtual instance.
While interfaces can be placed into promiscuous mode, the hypervisor will not deliver any traffic to an instance that is not addressed to it.
Even two virtual instances that are owned by the same customer located on the same physical host cannot listen to each other’s traffic.
Promiscuous mode is not allowed in AWS.
Modern Alternative: Use VPC Traffic Mirroring which provides an authorized, AWS-native mechanism to copy and inspect network traffic.

Host Based Firewall – Forward Deployed IDS

Deploy a network-based IDS on every instance – IDS workload scales with your infrastructure.
Host-based security software works well with highly distributed and scalable application architectures because network packet inspection is distributed across the entire software fleet.
However, CPU-intensive process is deployed onto every single machine.
Modern Alternative: Use GuardDuty Runtime Monitoring for lightweight agent-based threat detection, or AWS Network Firewall for centralized inline inspection.

Host Based Firewall – Traffic Replication

An Agent is deployed on every instance to capture & replicate traffic for centralized analysis.
Actual workload of network traffic analysis is not performed on the instance but on a separate server.
Traffic capture and replication is still CPU-intensive (particularly on Windows machines).
It significantly increases the internal network traffic in the environment as every inbound packet is duplicated.
Modern Alternative: Use VPC Traffic Mirroring which performs traffic replication at the hypervisor level without consuming instance CPU, and sends traffic to a Gateway Load Balancer backed fleet of IDS/IPS appliances.

In-Line Firewall – Inbound IDS Tier

Add another tier to the application architecture where a load balancer sends all inbound traffic to a tier of instances that performs the network analysis.
IDS workload is now isolated to a horizontally scalable tier in the architecture.
You have to maintain and manage another mission-critical elastic tier in the architecture.
Modern Alternative: Use AWS Network Firewall (fully managed inline IPS) or Gateway Load Balancer with third-party appliances (Fortinet, Palo Alto, Check Point) for a scalable, managed inline inspection tier.

Recommended Modern IDS/IPS Architecture

Inline Network Protection: Deploy AWS Network Firewall in your VPC for managed IPS with Suricata rules, TLS inspection, and AWS-managed threat intelligence.
Threat Detection & Monitoring: Enable Amazon GuardDuty across all accounts for continuous AI/ML-based threat detection.
Third-Party Appliances: Use Gateway Load Balancer to transparently insert third-party IDS/IPS appliances (if advanced DPI or specific vendor features are required).
Network Visibility: Use VPC Traffic Mirroring for deep packet capture and out-of-band analysis with NDR/SIEM tools.
DNS-Level Protection: Use Route 53 Resolver DNS Firewall with managed domain lists to block DNS queries to known malicious domains.
Centralized Management: Use AWS Security Hub to aggregate findings from all security services and AWS Firewall Manager for centralized policy management.
Posture Assessment: Use AWS Shield Network Security Director to continuously identify missing or misconfigured network security controls.

AWS Certification Exam Practice Questions

Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).

AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.

AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated

Open to further feedback, discussion and correction.

A web company is looking to implement an intrusion detection and prevention system into their deployed VPC. This platform should have the ability to scale to thousands of instances running inside of the VPC. How should they architect their solution to achieve these goals?
1. Configure an instance with monitoring software and the elastic network interface (ENI) set to promiscuous mode packet sniffing to see all traffic across the VPC. (virtual instance running in promiscuous mode to receive or “sniff” traffic is not allowed)
2. Create a second VPC and route all traffic from the primary application VPC through the second VPC where the scalable virtualized IDS/IPS platform resides.
3. Configure servers running in the VPC using the host-based ‘route’ commands to send all traffic through the platform to a scalable virtualized IDS/IPS (host based routing is not allowed)
4. Configure each host with an agent that collects all network traffic and sends that traffic to the IDS/IPS platform for inspection.
You are designing an intrusion detection prevention (IDS/IPS) solution for a customer web application in a single VPC. You are considering the options for implementing IDS/IPS protection for traffic coming from the Internet. Which of the following options would you consider? (Choose 2 answers)
1. Implement IDS/IPS agents on each Instance running in VPC
2. Configure an instance in each subnet to switch its network interface card to promiscuous mode and analyze network traffic. (virtual instance running in promiscuous mode to receive or “sniff” traffic is not allowed)
3. Implement Elastic Load Balancing with SSL listeners in front of the web applications (ELB with SSL does not serve as IDS/IPS)
4. Implement a reverse proxy layer in front of web servers and configure IDS/IPS agents on each reverse proxy server
A company wants to implement a managed intrusion prevention system that can inspect all traffic entering and leaving their VPC, including encrypted HTTPS traffic. They want to minimize operational overhead. Which AWS service should they use?
1. Amazon GuardDuty with VPC Flow Logs analysis
2. AWS Network Firewall with TLS inspection and managed threat signature rule groups
3. VPC Traffic Mirroring with third-party IDS appliances on EC2
4. AWS WAF with AWS Shield Advanced
AWS Network Firewall provides managed inline IPS with Suricata rules, TLS inspection for encrypted traffic, and managed threat signatures – all fully managed with minimal operational overhead.
An organization needs to deploy third-party IDS/IPS virtual appliances to inspect all traffic flowing through their VPC transparently, without modifying application configurations. Which AWS service enables this architecture?
1. Application Load Balancer with target groups
2. Network Load Balancer with pass-through routing
3. Gateway Load Balancer with GENEVE encapsulation
4. VPC Traffic Mirroring with Network Load Balancer targets
Gateway Load Balancer operates at Layer 3, transparently routing traffic through appliance fleets using GENEVE encapsulation. Applications never know the appliances are there.
A security team wants to capture network packets from specific EC2 instances for forensic analysis without installing agents on the instances. Which AWS feature should they use?
1. VPC Flow Logs with CloudWatch Logs
2. GuardDuty Runtime Monitoring
3. VPC Traffic Mirroring
4. AWS Network Firewall logging
VPC Traffic Mirroring copies actual network packets (not just metadata like Flow Logs) from ENIs without requiring any agents on the source instances.
Which AWS service uses AI/ML to detect multi-stage attack sequences by correlating signals across IAM credential misuse, unusual S3 access, and network anomalies?
1. AWS Network Firewall with managed threat signatures
2. AWS Security Hub with compliance checks
3. Amazon GuardDuty Extended Threat Detection
4. VPC Traffic Mirroring with third-party SIEM
GuardDuty Extended Threat Detection (launched Dec 2024) uses AI/ML to identify sophisticated multi-stage attacks by correlating related activities across AWS services.
A company wants to block network traffic to known malicious command-and-control (C2) servers and malware staging hosts automatically, without manually managing threat intelligence feeds. Which feature should they enable?
1. GuardDuty with custom threat lists
2. AWS WAF managed rule groups
3. VPC Network ACLs with deny rules
4. AWS Network Firewall Active Threat Defense managed rule groups
AWS Network Firewall Active Threat Defense managed rules automatically block traffic to malicious IPs, domains, and URLs using AWS threat intelligence, with no manual management required.