What are Some Lesser-Known AWS Services that Boost Security and Resilience?

CloudTrail Data Events are absolute lifesavers! I’ve been able to help developers resolve their AccessDenied errors multiple times just by analyzing what they actually did versus what they thought they were doing. Just be aware, though, this can get pricey!

One underrated tool I’ve come across is **Fleet Manager** for managing RDP sessions. It significantly reduces my anxiety about opening port 3389 for RDP access, and that makes my security posture feel a lot stronger!

I like going through the **Well-Architected Framework** questions; it’s such a helpful exercise for identifying potential weak spots in terms of security and reliability. It makes you think critically about your architecture! You can check it out here: [Well-Architected Framework](https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html).

I’ve found a few lesser-known tools really helpful:

- **AWS Organizations** is great for managing multiple accounts under a single umbrella, letting you set up Service Control Policies that enhance security across the board.
- I also love using **Block Public Access** settings to automatically prevent any accidental public exposure of resources.
- Don't overlook **Trusted Advisor** either; it’s handy for checking things like public EBS volumes or S3 bucket permissions, although it has some limitations depending on your support plan.
- And then there's **Session Manager** which lets you manage instances without needing to open port 22. It’s a solid choice!

I’m really into **CloudWatch Logs Insights** for troubleshooting, especially when paired with **CloudTrail Data Events**. It’s way more user-friendly for searching through logs compared to S3 access logs. Plus, I find **Transit Gateway Flow Logs** pretty useful for spotting issues with network traffic.

Definitely check out the **Service Screener** tool on GitHub. It helps you evaluate your AWS service settings based on best practices and shows how to improve your configurations. Here’s the link: https://github.com/aws-samples/service-screener-v2.