There are four main types of security controls as documented in the prescriptive guidance Implementing security controls on AWS:

• Preventative controls are security controls that are designed to prevent an event from occurring. These guardrails are a first line of defense to help prevent unauthorized access or unwanted changes to your network. An example of a preventative control is an AWS Identity and Access Management (IAM) role that has read-only access because it helps prevent unintended write actions from unauthorized users.
• Proactive controls are security controls that are designed to prevent the creation of noncompliant resources. These controls can reduce the number of security events handled by responsive and detective controls. These controls make sure that deployed resources are compliant before they are deployed; therefore, there is no detection event that requires response or remediation.
• Detective controls react to the changes in the resource configuration or new resources created. They may perform actions to address issues found or correct configuration based on the logic implemented in the control. Examples of such controls could be AWS Config rules that flag non-compliant resources or change their configuration to address the issue (e.g. change resource policy or security group to prevent access to the non-compliant resource).
• Responsive controls are security controls that are designed to drive remediation of adverse events or deviations from your security baseline. Examples of technical responsive controls include patching a system, quarantining a virus, shutting down a process, or rebooting a system.