Why start with a map?
AWS ships more than thirty security and identity services. Several have been renamed, and a few are closed to new customers. The usual mistake is not a bad configuration. It is building a design around the wrong service: picking Cognito when you needed Identity Center, or planning a 2027 audit pipeline on a feature that stopped taking new customers months ago.
Think of this level as the floor plan of a building before you walk the rooms. Each room is a group of services, and every service gets one line saying what job it does. Later levels open each door.
The seven groups on one page
| Group | Service (current name) | Former name or status | One-line job |
|---|---|---|---|
| Workforce and customer identity | AWS IAM | — | Users, roles and policies that decide who can call which AWS API |
| AWS IAM Identity Center | AWS Single Sign-On (AWS SSO), renamed July 2022 | Single sign-on for your staff across every account in an organization | |
| Amazon Cognito | Cognito Sync closed to new customers on 30 Jul 2026 | Sign-up and sign-in for your app's customers | |
| AWS Directory Service | Simple AD closed to new customers on 30 Jul 2026 | Managed Microsoft AD and directory connectors | |
| Access control and governance | AWS Organizations (SCPs, RCPs) | — | Groups accounts and sets guardrails on the most any identity or resource can do |
| IAM Access Analyzer | — | Finds access that is public, shared across accounts or unused | |
| Amazon Verified Permissions | — | Fine-grained authorization inside your own application, written in Cedar policies | |
| Keys, secrets and certificates | AWS KMS | — | Managed encryption keys used by most AWS services |
| AWS CloudHSM | — | Dedicated single-tenant HSMs when you must hold the keys yourself | |
| AWS Secrets Manager | — | Stores and rotates passwords, API keys and other credentials | |
| AWS Certificate Manager (ACM) | — | Public and private TLS certificates for AWS endpoints | |
| AWS Private CA | ACM Private CA, renamed Sept 2022 | Runs your own private certificate authority | |
| Threat detection and posture | Amazon GuardDuty | — | Detects threats in logs and runtime activity |
| AWS Security Hub | New service, GA Dec 2025 | Correlates findings into prioritised risks and exposures (uses OCSF) | |
| AWS Security Hub CSPM | The original Security Hub, renamed June 2025 | Best-practice and compliance checks plus finding aggregation (uses ASFF) | |
| Amazon Inspector | Inspector Classic ended support on 20 May 2026 | Scans EC2, containers and Lambda for vulnerabilities | |
| Amazon Detective | — | Graph-based investigation of a finding | |
| AWS Security Incident Response | GA Dec 2024 | Triage of findings and access to AWS responders | |
| Logging and audit | AWS CloudTrail | CloudTrail Lake closed to new customers on 31 May 2026 | Records every API call |
| AWS Config | — | Records resource configuration over time and evaluates rules against it | |
| Amazon Security Lake | — | Gathers security logs into your own S3 data lake in OCSF format | |
| AWS Audit Manager | Closed to new customers on 30 Apr 2026 | Collects audit evidence | |
| Data protection | Amazon Macie | — | Finds sensitive data such as PII in S3 |
| AWS Shield, AWS WAF, Firewall Manager | Covered in the networking course | DDoS protection, a web application firewall and central rule management | |
| Zero trust access | AWS Verified Access | — | Lets staff reach internal apps without a VPN, checking identity and device on every request |
Gotcha: two Security Hubs. Since the June 2025 rename, "Security Hub" in a blog post from before mid-2025 means what is now Security Hub CSPM. When a colleague says "turn on Security Hub", ask which one. The data formats differ (ASFF against OCSF), so integrations are not interchangeable.
Identity Center, Cognito or Verified Permissions? Identity Center is for your employees signing in to AWS and business apps. Cognito is for your customers signing in to your app. Verified Permissions decides what a signed-in user may do inside your app. People confuse these three more than any others on the page.
Walkthrough: old names live on in the CLI
AWS renames products but usually keeps API namespaces so that existing scripts don't break. That means old names still show up in your terminal:
# IAM Identity Center still uses the AWS SSO namespaces
aws sso-admin list-instances
# {
# "Instances": [{
# "InstanceArn": "arn:aws:sso:::instance/ssoins-1234567890abcdef",
# "IdentityStoreId": "d-1234567890"
# }]
# }
# AWS Private CA keeps the ACM-era prefix
aws acm-pca list-certificate-authorities
# Inspector: 'inspector' was Classic (support ended), 'inspector2' is the current service
aws inspector2 list-findings --max-results 5
Best practice: when you inherit a script, read the namespace as a clue. aws inspector ... (without the 2) points at a service that no longer works, and the script needs migrating. aws sso-admin ... is fine because it is Identity Center under its old label.
Check the lifecycle before you plan
AWS publishes lifecycle changes at docs.aws.amazon.com/general/latest/gr/service-lifecycle.html. The old aws.amazon.com/products/lifecycle address redirects there. It uses three stages, in this order:
- Maintenance: new customers can't onboard. Existing customers carry on, and AWS supports the service but adds no features.
- Sunset: existing customers should migrate. A shutdown date is set, typically about 12 months out.
- Full Shutdown: the service is removed and no longer available.
AWS also posts quarterly "AWS Service Availability Updates" in What's New. The March 2026 update moved Audit Manager and CloudTrail Lake to maintenance. The June 2026 update did the same for Cognito Sync and Simple AD.
A 60-second habit before any design review:
1. Open the lifecycle page and the latest Service Availability Update.
2. Search for each service AND feature in your design (e.g. "Cognito Sync", not just "Cognito").
3. If it is in Maintenance: treat it as unavailable for a NEW account, and pick the named alternative.
4. Record the date you checked in your design notes.
Trade-off: a service in Maintenance still works for current users, so you don't need to rip it out tomorrow. But a new landing zone, a new organization or a fresh account may be unable to enable it. Designs that "work in prod" can fail on the next build.
Key takeaways
- Seven groups: workforce and customer identity; access control and governance; keys, secrets and certificates; threat detection and posture; logging and audit; data protection; zero trust access.
- AWS SSO → IAM Identity Center; ACM Private CA → AWS Private CA; the original Security Hub → Security Hub CSPM (a new Security Hub went GA Dec 2025); Inspector Classic → Amazon Inspector.
- Staff use Identity Center, customers use Cognito, and in-app permissions go to Verified Permissions.
- Old names survive in CLI namespaces (
sso-admin,acm-pca).inspectorwithout the 2 means Classic. - Check the AWS Lifecycle Changes page (Maintenance → Sunset → Full Shutdown) before planning around any service or feature.