Detection

The AWS control plane: API calls made against AWS services (who called which API, from where, and when), regardless of what runs on the instances.

Detection (SEC 4 in the Security Pillar): configure logging, capture logs and findings centrally, correlate and enrich alerts, and start remediation for non-compliant resources.

Because each likely threat needs a data source that would show it; mapping threats to sources exposes gaps (for example, no S3 data events for an exfiltration risk) instead of collecting logs nobody uses.

The security group, NACL and any firewall must allow the published Route 53 health checker IP ranges for the checked port.

A health check based on a CloudWatch alarm: the health check reflects the alarm state instead of probing the endpoint.

It builds a model of expected metric values from history (including daily and weekly patterns) and alarms when the metric leaves the expected band.