aws-cloud-security-essentials-lab

# AWS Cloud Security Essentials Lab > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides guidance for working with the IKB42603 Cloud Computing Security Essentials lab repository, which contains hands-on exercises covering fundamental AWS security concepts including IAM, VPC isolation, encryption, access control, and security monitoring. ## What This Project Does This is an educational repository structured around five core AWS security labs: - **Lab 1**: Account Security and IAM (Identity and Access Management) - **Lab 2**: Secure Isolation and Multitenancy (VPC, Security Groups) - **Lab 3**: Encryption and Key Management (KMS, data protection) - **Lab 4**: Access Control and Network Security (Network ACLs, Security Groups) - **Lab 5**: Monitoring, Logging, and Incident Detection (CloudTrail, CloudWatch) Each lab teaches practical AWS security implementation through hands-on exercises. ## Repository Setup ### Initial Repository Creation ```bash # Clone the repository git clone https://github.com/<username>/IKB42603-CLOUD-COMPUTING-SECURITY-ESSENTIALS.git cd IKB42603-CLOUD-COMPUTING-SECURITY-ESSENTIALS # Create lab structure mkdir -p Lab{1..5} touch Lab0_Environment_Setup.md touch Lab1_Account_Security_and_IAM.md touch Lab2_Secure_Isolation_and_Multitenancy.md touch Lab3_Encryption_and_Key_Management.md touch Lab4_Access_Control_and_Network_Security.md touch Lab5_Monitoring_Logging_and_Incident_Detection.md # Initial commit git add . git commit -m "Initial lab structure setup" git push origin main ``` ### Standard Lab Documentation Structure Each lab markdown file should follow this structure: ```markdown # Lab X - [Lab Title] ## Objective [What you will accomplish] ## Learning Outcomes - Outcome 1 - Outcome 2 ## Prerequisites - AWS Account - AWS CLI installed - Appropriate IAM permissions ## Environment Setup [Required tools and configuration] ## Implementation Steps ### Step 1: [Task Name] [Description] **Commands:** ```bash # Command with explanation aws [service] [action] --options ``` **Screenshot:**  ### Step 2: [Next Task] ... ## Verification [How to verify successful completion] ## Challenges Encountered [Document any issues and solutions] ## Lessons Learned [Key takeaways] ## Cleanup ```bash # Commands to remove resources ``` ## References - [Documentation links] ``` ## Lab 1: Account Security and IAM ### Creating IAM Users with MFA ```bash # Create IAM user aws iam create-user --user-name lab-user-01 # Create login profile aws iam create-login-profile \ --user-name lab-user-01 \ --password 'TempPassword123!' \ --password-reset-required # Attach policy for MFA enforcement aws iam attach-user-policy \ --user-name lab-user-01 \ --policy-arn arn:aws:iam::aws:policy/IAMUserChangePassword # Enable virtual MFA device aws iam create-virtual-mfa-device \ --virtual-mfa-device-name lab-user-01-mfa \ --outfile QRCode.png \ --bootstrap-method QRCodePNG ``` ### Creating Custom IAM Policy ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowS3ReadOnly", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::lab-bucket-*", "arn:aws:s3:::lab-bucket-*/*" ] }, { "Sid": "DenyWithoutMFA", "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "BoolIfExists": { "aws:MultiFactorAuthPresent": "false" } } } ] } ``` ```bash # Create the policy aws iam create-policy \ --policy-name LabS3ReadOnlyWithMFA \ --policy-document file://policy.json # Attach to user aws iam attach-user-policy \ --user-name lab-user-01 \ --policy-arn arn:aws:iam::ACCOUNT_ID:policy/LabS3ReadOnlyWithMFA ``` ## Lab 2: Secure Isolation and Multitenancy ### Creating Isolated VPC ```bash # Create VPC aws ec2 create-vpc \ --cidr-block 10.0.0.0/16 \ --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=lab-secure-vpc}]' # Store VPC ID VPC_ID=$(aws ec2 describe-vpcs \ --filters "Name=tag:Name,Values=lab-secure-vpc" \ --query 'Vpcs[0].VpcId' \ --output text) # Create public subnet aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.1.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=lab-public-subnet}]' # Create private subnet aws ec2 create-subnet \ --vpc-id $VPC_ID \ --cidr-block 10.0.2.0/24 \ --availability-zone us-east-1a \ --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=lab-private-subnet}]' # Create Internet Gateway aws ec2 create-internet-gateway \ --tag-specifications 'ResourceType=internet-gateway,Tags=[{Key=Name,Value=lab-igw}]' IGW_ID=$(aws ec2 describe-internet-gateways \ --filters "Name=tag:Name,Values=lab-igw" \ --query 'InternetGateways[0].InternetGatewayId' \ --output text) # Attach IGW to VPC aws ec2 attach-internet-gateway \ --vpc-id $VPC_ID \ --internet-gateway-id $IGW_ID ``` ### Security Groups for Multi-tier Architecture ```bash # Create web tier security group aws ec2 create-security-group \ --group-name lab-web-sg \ --description "Security group for web tier" \ --vpc-id $VPC_ID WEB_SG_ID=$(aws ec2 describe-security-groups \ --filters "Name=group-name,Values=lab-web-sg" \ --query 'SecurityGroups[0].GroupId' \ --output text) # Allow HTTP/HTTPS from internet aws ec2 authorize-security-group-ingress \ --group-id $WEB_SG_ID \ --protocol tcp \ --port 80 \ --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress \ --group-id $WEB_SG_ID \ --protocol tcp \ --port 443 \ --cidr 0.0.0.0/0 # Create database tier security group aws ec2 create-security-group \ --group-name lab-db-sg \ --description "Security group for database tier" \ --vpc-id $VPC_ID DB_SG_ID=$(aws ec2 describe-security-groups \ --filters "Name=group-name,Values=lab-db-sg" \ --query 'SecurityGroups[0].GroupId' \ --output text) # Allow MySQL only from web tier aws ec2 authorize-security-group-ingress \ --group-id $DB_SG_ID \ --protocol tcp \ --port 3306 \ --source-group $WEB_SG_ID ``` ## Lab 3: Encryption and Key Management ### Creating and Using KMS Keys ```bash # Create customer managed key aws kms create-key \ --description "Lab encryption key for S3" \ --key-usage ENCRYPT_DECRYPT \ --origin AWS_KMS KEY_ID=$(aws kms list-keys --query 'Keys[0].KeyId' --output text) # Create alias aws kms create-alias \ --alias-name alias/lab-s3-key \ --target-key-id $KEY_ID # Create encrypted S3 bucket aws s3api create-bucket \ --bucket lab-encrypted-bucket-$(date +%s) \ --region us-east-1 BUCKET_NAME=$(aws s3api list-buckets \ --query 'Buckets[?contains(Name, `lab-encrypted-bucket`)].Name' \ --output text) # Enable default encryption aws s3api put-bucket-encryption \ --bucket $BUCKET_NAME \ --server-side-encryption-configuration '{ "Rules": [{ "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "'$KEY_ID'" }, "BucketKeyEnabled": true }] }' # Upload encrypted file echo "Sensitive data" > test-file.txt aws s3 cp test-file.txt s3://$BUCKET_NAME/ \ --server-side-encryption aws:kms \ --ssekms-key-id $KEY_ID ``` ### Encrypting EBS Volumes ```bash # Create encrypted EBS volume aws ec2 create-volume \ --availability-zone us-east-1a \ --size 10 \ --volume-type gp3 \ --encrypted \ --kms-key-id $KEY_ID \ --tag-specifications 'ResourceType=volume,Tags=[{Key=Name,Value=lab-encrypted-volume}]' # Verify encryption aws ec2 describe-volumes \ --filters "Name=tag:Name,Values=lab-encrypted-volume" \ --query 'Volumes[0].[Encrypted,KmsKeyId]' \ --output table ``` ## Lab 4: Access Control and Network Security ### Network ACL Configuration ```bash # Get subnet ID SUBNET_ID=$(aws ec2 describe-subnets \ --filters "Name=tag:Name,Values=lab-public-subnet" \ --query 'Subnets[0].SubnetId' \ --output text) # Create Network ACL aws ec2 create-network-acl \ --vpc-id $VPC_ID \ --tag-specifications 'ResourceType=network-acl,Tags=[{Key=Name,Value=lab-nacl}]' NACL_ID=$(aws ec2 describe-network-acls \ --filters "Name=tag:Name,Values=lab-nacl" \ --query 'NetworkAcls[0].NetworkAclId' \ --output text) # Allow inbound HTTP aws ec2 create-network-acl-entry \ --network-acl-id $NACL_ID \ --rule-number 100 \ --protocol tcp \ --port-range From=80,To=80 \ --cidr-block 0.0.0.0/0 \ --rule-action allow \ --ingress # Allow inbound HTTPS aws ec2 create-network-acl-entry \ --network-acl-id $NACL_ID \ --rule-number 110 \ --protocol tcp \ --port-range From=443,To=443 \ --cidr-block 0.0.0.0/0 \ --rule-action allow \ --ingress # Deny specific IP range aws ec2 create-network-acl-entry \ --network-acl-id $NACL_ID \ --rule-number 50 \ --protocol -1 \ --cidr-block 10.0.100.0/24 \ --rule-action deny \ --ingress # Allow outbound traffic aws ec2 create-network-acl-entry \ --network-acl-id $NACL_ID \ --rule-number 100 \ --protocol -1 \ --cidr-block 0.0.0.0/0 \ --rule-action allow \ --egress ``` ### VPC Flow Logs ```bash # Create CloudWatch log group aws logs create-log-group --log-group-name /aws/vpc/flowlogs # Create IAM role for flow logs cat > trust-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "vpc-flow-logs.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } EOF aws iam create-role \ --role-name VPCFlowLogsRole \ --assume-role-policy-document file://trust-policy.json # Attach policy cat > flow-logs-policy.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams" ], "Resource": "*" } ] } EOF aws iam put-role-policy \ --role-name VPCFlowLogsRole \ --policy-name VPCFlowLogsPolicy \ --policy-document file://flow-logs-policy.json # Enable flow logs aws ec2 create-flow-logs \