Dividing roles among WAF, Shield, GuardDuty, Macie, and KMS
Role mapping: WAF = block web attacks / Shield = DDoS mitigation / GuardDuty = threat detection / Macie = sensitive-data detection / KMS = key management. Swapping service names and roles is the classic trap.