Which service is designed for intelligent threat detection for AWS infrastructure?

Amazon GuardDuty is the service specifically designed for intelligent threat detection within AWS infrastructure. It provides continuous monitoring for malicious or unauthorized behavior to help protect AWS accounts, workloads, and data stored in Amazon S3. GuardDuty analyzes continuous streams of data from sources such as AWS CloudTrail, Amazon VPC Flow Logs, and DNS logs to identify threats and anomalies.

This service uses machine learning, anomaly detection, and integrated threat intelligence to spot potential security issues. By automating the detection of threats, it helps organizations respond quickly and effectively to safeguard their environment against potential attacks. Its ability to recognize known threats and identify unfamiliar or suspicious patterns makes it an essential tool for enhancing the security posture of AWS users.

In contrast, other options serve different purposes within the AWS ecosystem. For example, AWS KMS is primarily used for creating and managing cryptographic keys for data encryption; Nitro Enclaves offers a secure environment for sensitive workloads; AWS Shield Advanced is focused on providing advanced DDoS protection. Each of these services contributes significantly to AWS security but does not specialize in intelligent threat detection like Amazon GuardDuty does.