John D. · AWS Cloud Security
AWS CLOUD SECURITY · DETECTION & RESPONSE

AWS Security Monitoring Platform

Terraform reference architecture for centralized audit logging, GuardDuty threat detection, Security Hub aggregation, EventBridge alert routing, encrypted SNS notifications, threat hunting, and incident response.

CloudTrailS3GuardDutySecurity HubEventBridgeSNSTerraformAthena
View AWS Architecture ↓
PROJECT STATUSImplemented
CI VALIDATIONLoading…
DEPLOYMENTManual by Design
MODELDetect → Route → Respond
SECURITY OPERATIONS FLOW

Telemetry to incident response

AUDITCloudTrail + S3

Multi-Region management events in protected log storage.

DETECTGuardDuty

Threat findings evaluated for actionable severity.

AGGREGATESecurity Hub

HIGH and CRITICAL active findings centralized.

ROUTEEventBridge + SNS

Filtered events routed to an encrypted alert topic.

RESPONDSecurity Operations

Runbook-driven triage, containment, and recovery.

DATA FLOW DIAGRAM

Security Event Data Flow

Telemetry moves from AWS workloads through audit logging, threat detection, centralized investigation, prioritized routing, alerting, and security-operations response.

AWS Security Monitoring Platform data flow showing AWS workloads, CloudTrail, GuardDuty, S3, Athena, Security Hub, EventBridge, SNS, and security operations response
AWS ARCHITECTURE DIAGRAM

Centralized AWS Security Monitoring

End-to-end reference architecture for AWS audit logging, threat detection, Security Hub aggregation, EventBridge routing, encrypted SNS alerting, Athena threat hunting, and security-operations response.

AWS Security Monitoring Platform architecture showing AWS workloads, CloudTrail, S3, Athena, GuardDuty, Security Hub, EventBridge, SNS, KMS, Terraform, GitHub Actions, and security operations
The repository implements these controls with Terraform and validates the infrastructure in GitHub Actions. The portfolio does not claim the stack is currently deployed in production.

Implemented controls

Multi-Region CloudTrailGlobal events + log validation.
Protected Log ArchiveEncryption, versioning, public access blocked.
GuardDutyThreat detection enabled.
Security HubFoundational best practices enabled.
Event FilteringMedium+ GuardDuty and HIGH/CRITICAL Security Hub findings.
Threat HuntingAthena queries for root, IAM, MFA, and logging tamper activity.
This dashboard reports project implementation and CI status; it does not claim the Terraform stack is currently deployed in production.

Recent validation runs

RunResult
Loading…
Reading public GitHub Actions metadata.
MICROSOFT AZURE REFERENCE ARCHITECTURE
Microsoft Azure reference architecture diagram for aws security monitoring platform

Azure reference equivalent for portfolio comparison. The original project implementation remains as documented elsewhere on this page.