Tagged
GuardDuty bills across nine separate data sources — CloudTrail management events at $4/M tiered down, VPC Flow Logs at $1/GB tiered, EKS Runtime Monitoring per vCPU-hour, plus S3, DNS, Lambda, RDS, and Malware Protection. The 30-day free trial regularly hides the true production bill, and organization-wide auto-enable turns every new account into a billing line.
Macie bills two ways: bucket-level evaluation at $0.10 per bucket per month, and sensitive-data discovery at $1.00 per GB inspected. A 500 GB bucket scanned for PII costs $500 just for the discovery; multi-bucket organizations easily hit $10K+ per month. Automated discovery is cheaper than full jobs but compounds across the bucket footprint.
Management events are free for the first trail. Data events bill $0.10 per 100K — and on a busy S3 bucket that lands at thousands per month. CloudTrail Lake is $2.50/GB ingested plus $0.10/GB-month storage. Insights events analyze every management event for anomalies at $0.35/100K. Most accounts pay 5× more for CloudTrail than they need to.
Default Docker seccomp is not enough for regulated workloads. EKS Pod Security Standards, seccomp profiles, and Fargate platform version constraints.
Local JWT validation is fast until revocation lags bite you. When to introspect at Cognito, use API Gateway JWT authorizers, and add Verified Permissions for fine-grained authz.
Token buckets allow bursts; leaky buckets smooth traffic—WAF rate rules and API Gateway usage plans implement neither perfectly but both matter for layered defense.
A full TLS handshake on every API call adds RTTs your p99 cannot afford. This guide walks TLS 1.3 1-RTT resumption, ACM cert rotation, and security policies on ALB and CloudFront.
Control Tower gets you an org; it does not tell you how many OUs you need or which policy type owns VPC public access. Since re:Invent 2024 you have four layers — SCP, RCP, declarative, and tag policies — and RCP coverage grew through Feb 2026 (DynamoDB). A composite 60-account enterprise cut exception SCP attachments from 14 ad-hoc to 3 time-boxed RFCs in two quarters by moving accounts out of "temporary" prod OUs.
Security Hub detects control failures. It is not the compliance pipeline — and treating it as one is why teams still scramble for evidence at audit time. The four jobs are distinct: AWS Config detects drift, conformance packs deploy rules org-wide as immutable bundles, SSM Automation remediates the safe class, and evidence accrues via conformance-pack exports plus Security Hub control status (Audit Manager only if you onboarded before it closed to new customers on 30 April 2026). Here is the tool-per-job matrix, a conformance pack with auto-remediation, and the auto-remediation gotcha to design around.
Two 2025 shifts rewrite the IR playbook: GuardDuty Extended Threat Detection now emits a single critical attack-sequence finding instead of a pile of high findings, and AWS Security Incident Response moved to metered pricing (free first 10,000 findings/month, then $0.000676 each) on November 21, 2025. The lesson is to page humans on the top 1% of correlated criticals, isolate instead of terminate, and let auto-triage absorb the rest. Here are the runbooks.
Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. Here is the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.
Production CloudTrail: multi-region org trails, log validation, CMK, Lake + Athena. July 2026 checklist — Event History is not enough.