ikb42603-cloud-security-essentials

# IKB42603 Cloud Security Essentials Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. ## Overview IKB42603-CLOUD-COMPUTING-SECURITY-ESSENTIALS is an educational repository containing hands-on laboratory exercises for learning AWS cloud security fundamentals. The project covers five core security domains: IAM and account security, secure isolation and multitenancy, encryption and key management, access control and network security, and monitoring/logging/incident detection. This skill helps developers and students complete practical AWS security implementations using the AWS Console, AWS CLI, and infrastructure-as-code approaches. ## Repository Structure The project is organized into five lab modules: ``` IKB42603-CLOUD-COMPUTING-SECURITY-ESSENTIALS/ ├── README.md ├── Lab0_Environment_Setup.md ├── Lab1_Account_Security_and_IAM.md ├── Lab2_Secure_Isolation_and_Multitenancy.md ├── Lab3_Encryption_and_Key_Management.md ├── Lab4_Access_Control_and_Network_Security.md └── Lab5_Monitoring_Logging_and_Incident_Detection.md ``` ## Installation & Setup ### Clone the Repository ```bash git clone https://github.com/<username>/IKB42603-CLOUD-COMPUTING-SECURITY-ESSENTIALS.git cd IKB42603-CLOUD-COMPUTING-SECURITY-ESSENTIALS ``` ### Prerequisites - AWS Account (Free Tier eligible) - AWS CLI installed and configured - Git for version control - Text editor (VS Code, Vim, etc.) ### Configure AWS CLI ```bash # Configure AWS credentials aws configure # Verify configuration aws sts get-caller-identity ``` ## Lab 1: Account Security and IAM ### Create IAM Users with Policies ```bash # Create a new IAM user aws iam create-user --user-name security-admin # Create a custom policy document cat > security-admin-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:*", "cloudtrail:*", "cloudwatch:*" ], "Resource": "*" } ] } EOF # Create and attach the policy aws iam create-policy \ --policy-name SecurityAdminPolicy \ --policy-document file://security-admin-policy.json aws iam attach-user-policy \ --user-name security-admin \ --policy-arn arn:aws:iam::${AWS_ACCOUNT_ID}:policy/SecurityAdminPolicy ``` ### Enable MFA for Root Account ```bash # Create virtual MFA device aws iam create-virtual-mfa-device \ --virtual-mfa-device-name root-mfa \ --outfile mfa-qr.png \ --bootstrap-method QRCodePNG # Enable MFA (requires MFA codes from authenticator app) aws iam enable-mfa-device \ --user-name root \ --serial-number arn:aws:iam::${AWS_ACCOUNT_ID}:mfa/root-mfa \ --authentication-code1 <CODE1> \ --authentication-code2 <CODE2> ``` ### Create IAM Groups with Least Privilege ```bash # Create developer group aws iam create-group --group-name Developers # Attach managed policies aws iam attach-group-policy \ --group-name Developers \ --policy-arn arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess # Add user to group aws iam add-user-to-group \ --user-name security-admin \ --group-name Developers ``` ## Lab 2: Secure Isolation and Multitenancy ### Create Isolated VPC ```bash # Create VPC aws ec2 create-vpc \ --cidr-block 10.0.0.0/16 \ --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=SecureVPC}]' # Create public subnet aws ec2 create-subnet \ --vpc-id <VPC_ID> \ --cidr-block 10.0.1.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=PublicSubnet}]' # Create private subnet aws ec2 create-subnet \ --vpc-id <VPC_ID> \ --cidr-block 10.0.2.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=PrivateSubnet}]' # Create internet gateway aws ec2 create-internet-gateway \ --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=SecureIGW}]' # Attach to VPC aws ec2 attach-internet-gateway \ --internet-gateway-id <IGW_ID> \ --vpc-id <VPC_ID> ``` ### Configure Security Groups ```bash # Create web tier security group aws ec2 create-security-group \ --group-name web-tier-sg \ --description "Security group for web tier" \ --vpc-id <VPC_ID> # Allow HTTPS from anywhere aws ec2 authorize-security-group-ingress \ --group-id <SG_ID> \ --protocol tcp \ --port 443 \ --cidr 0.0.0.0/0 # Create database tier security group aws ec2 create-security-group \ --group-name db-tier-sg \ --description "Security group for database tier" \ --vpc-id <VPC_ID> # Allow MySQL only from web tier aws ec2 authorize-security-group-ingress \ --group-id <DB_SG_ID> \ --protocol tcp \ --port 3306 \ --source-group <WEB_SG_ID> ``` ### Create Network ACLs ```bash # Create network ACL aws ec2 create-network-acl \ --vpc-id <VPC_ID> \ --tag-specifications 'ResourceType=network-acl,Tags=[{Key=Name,Value=PrivateNACL}]' # Add inbound rule aws ec2 create-network-acl-entry \ --network-acl-id <NACL_ID> \ --ingress \ --rule-number 100 \ --protocol tcp \ --port-range From=443,To=443 \ --cidr-block 10.0.1.0/24 \ --rule-action allow # Add outbound rule aws ec2 create-network-acl-entry \ --network-acl-id <NACL_ID> \ --egress \ --rule-number 100 \ --protocol tcp \ --port-range From=1024,To=65535 \ --cidr-block 0.0.0.0/0 \ --rule-action allow ``` ## Lab 3: Encryption and Key Management ### Create KMS Key ```bash # Create customer managed key aws kms create-key \ --description "Data encryption key for Lab 3" \ --key-usage ENCRYPT_DECRYPT \ --origin AWS_KMS # Create alias aws kms create-alias \ --alias-name alias/lab3-encryption-key \ --target-key-id <KEY_ID> # Set key policy cat > key-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:root" }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Allow use of the key for encryption", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::${AWS_ACCOUNT_ID}:user/security-admin" }, "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*" } ] } EOF aws kms put-key-policy \ --key-id <KEY_ID> \ --policy-name default \ --policy file://key-policy.json ``` ### Encrypt S3 Bucket with KMS ```bash # Create S3 bucket aws s3api create-bucket \ --bucket secure-data-bucket-${AWS_ACCOUNT_ID} \ --region us-east-1 # Enable default encryption with KMS aws s3api put-bucket-encryption \ --bucket secure-data-bucket-${AWS_ACCOUNT_ID} \ --server-side-encryption-configuration '{ "Rules": [{ "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "alias/lab3-encryption-key" }, "BucketKeyEnabled": true }] }' # Upload encrypted file aws s3 cp sensitive-data.txt \ s3://secure-data-bucket-${AWS_ACCOUNT_ID}/ \ --server-side-encryption aws:kms \ --ssekms-key-id alias/lab3-encryption-key ``` ### Encrypt EBS Volume ```bash # Create encrypted EBS volume aws ec2 create-volume \ --availability-zone us-east-1a \ --size 10 \ --volume-type gp3 \ --encrypted \ --kms-key-id alias/lab3-encryption-key \ --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=EncryptedVolume}]' # Attach to EC2 instance aws ec2 attach-volume \ --volume-id <VOLUME_ID> \ --instance-id <INSTANCE_ID> \ --device /dev/sdf ``` ### Encrypt Data at Application Level ```bash # Encrypt plaintext using KMS aws kms encrypt \ --key-id alias/lab3-encryption-key \ --plaintext fileb://plaintext.txt \ --output text \ --query CiphertextBlob > encrypted.bin # Decrypt ciphertext aws kms decrypt \ --ciphertext-blob fileb://encrypted.bin \ --output text \ --query Plaintext | base64 --decode ``` ## Lab 4: Access Control and Network Security ### Create VPC Endpoints ```bash # Create S3 Gateway Endpoint aws ec2 create-vpc-endpoint \ --vpc-id <VPC_ID> \ --service-name com.amazonaws.us-east-1.s3 \ --route-table-ids <ROUTE_TABLE_ID> # Create Interface Endpoint for Secrets Manager aws ec2 create-vpc-endpoint \ --vpc-id <VPC_ID> \ --vpc-endpoint-type Interface \ --service-name com.amazonaws.us-east-1.secretsmanager \ --subnet-ids <SUBNET_ID> \ --security-group-ids <SG_ID> ``` ### Configure AWS WAF ```bash # Create IP set aws wafv2 create-ip-set \ --name BlockedIPs \ --scope REGIONAL \ --ip-address-version IPV4 \ --addresses 192.0.2.0/24 203.0.113.0/24 # Create web ACL aws wafv2 create-web-acl \ --name SecurityLabWAF \ --scope REGIONAL \ --default-action Allow={} \ --rules file://waf-rules.json \ --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=SecurityLabWAF ``` ### Configure AWS Systems Manager Session Manager ```bash # Create IAM role for EC2 cat > ec2-role-trust.json <<EOF { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": {"Service": "ec2.amazonaws.com"}, "Action": "sts:AssumeRole" }] } EOF aws iam create-role \ --role-name SSMRole \ --assume-role-policy-document file://ec2-role-trust.json aws iam attach-role-policy \ --role-name SSMRole \ --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore # Start session without SSH aws ssm start-session --target <INSTANCE_ID> ``` ## Lab 5: Monitoring, Logging, and Incident Detection ### Enable CloudTrail ```bash # Create S3 bucket for logs aws s3api create-bucket \ --bucket cloudtrail-logs-${AWS_ACCOUNT_ID} \ --region us-east-1 # Apply bucket policy cat > trail-bucket-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck", "Effect": "Allow", "Principal": {"Service": "cloudtrail.amazonaws.com"}, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::cloudtrail-logs-${AWS_ACCOUNT_ID}" }, { "Sid": "AWSCloudTrailWrite", "Effect": "Allow", "Principal": {"Service": "cloudtrail.amazonaws.com"}, "Action": "s3:PutObject", "Resource": "arn:aws:s3:::cloudtrail-logs-${AWS_ACCOUNT_ID}/*", "Condition": {