AWS Security Engineering: Detect, Encrypt, Respond

GuardDuty looks for malicious behavior happening now, such as a credential used from an impossible location. Inspector looks for weaknesses that could be exploited later, such as an unpatched library. You usually want both.

No. AWS managed keys are enough when you only need encryption at rest and audit visibility. Use a customer managed key when you need control over who can use it, cross-account sharing, or custom rotation and deletion rules.

No. Isolate it, snapshot its volumes, and revoke the credentials it used first. Terminating early destroys the running state that shows how the attacker got in.

Use Secrets Manager when a credential must rotate automatically or be shared across accounts. Use Parameter Store for static configuration and values you are happy to rotate by hand.