AWS Security

Logs are the evidence you will need after an incident. You collect management, network, DNS and application logs from every account into a protected archive, and keep them complete and queryable.

• Organization trails and a central log archive
• VPC Flow Logs, DNS query logs and load balancer logs
• WAF and edge logs
• Querying logs with Athena and Security Lake
• Log integrity and tamper protection
• Finding why logs are missing

You build A central logging architecture with integrity checks and a set of saved investigation queries.

Plans written during an incident are written too late. You define roles, severity levels, playbooks and tooling ahead of time, set up isolated forensic accounts, and test the plan until it works under pressure.

• Roles, severity levels and communication plans
• Playbooks for common AWS incidents
• A forensic account and evidence handling
• Tabletop exercises and game days
• Pre-provisioned access for responders
• Measuring and improving response

You build An incident response plan with three playbooks and a tabletop exercise script.

When credentials leak or a host is compromised, order of action matters. You contain damage, preserve evidence, find the scope with logs, and automate the repeatable steps of your response.

• Responding to exposed access keys
• Isolating a compromised instance and capturing evidence
• Exposed storage and data exfiltration checks
• Revoking sessions and rotating credentials
• Automating containment with EventBridge and Lambda
• Writing the post-incident report

You build An automated containment workflow for a compromised instance, with evidence captured.

Most attacks arrive over the network. You place layered defenses at the edge and inside the network, using web filtering, DDoS protection, firewalls and private paths, and learn to debug why traffic is allowed or blocked.

• CloudFront, WAF and Shield together
• Rules for bots, rate limits and injection attacks
• Security groups, network ACLs and Network Firewall
• Private access with VPC endpoints
• Central policy with Firewall Manager
• Debugging reachability problems

You build A layered edge and network defense for a public web application, with test results.

A server is only as safe as its image and its patches. You build hardened images, remove the need for direct access, scan for vulnerabilities and apply the same thinking to containers and functions.

• Hardened AMIs and image pipelines
• Instance metadata protection and access without SSH
• Patching with Systems Manager
• Vulnerability scanning with Inspector
• Container image and runtime security
• Lambda execution roles and function security

You build An image pipeline that produces a hardened, scanned and patchable server image.

Every access decision begins with proving who is asking. You connect workforce identity providers, protect customer sign-in, and give applications short-lived credentials instead of stored keys.

• IAM Identity Center and federation with SAML and OIDC
• Multi-factor authentication and session control
• Customer identity with Cognito
• Roles and temporary credentials for workloads
• Credentials for systems outside AWS
• Debugging failed federation and sign-in

You build A federated sign-in design for staff, customers and workloads, with no long-lived keys.

Most access incidents come from policies nobody fully understood. You learn exactly how AWS evaluates policies, combine identity, resource and organization-level rules, and find and fix overly broad access.

• How policy evaluation decides allow or deny
• Permission boundaries and service control policies
• Resource policies and cross-account access
• Attribute-based access control with tags
• Access Analyzer and unused access findings
• Debugging access denied errors

You build A least-privilege policy set for three roles, verified with policy analysis tools.

Encryption only helps if the keys are controlled. You apply transport and storage encryption across services, write key policies that separate duties, and decide when to bring your own key material.

• TLS everywhere and certificate management
• KMS keys, key policies and grants
• Encrypting S3, EBS and databases
• Client-side encryption
• CloudHSM and external key options
• Auditing key use

You build An encryption design for three data stores with separated key administration and use.

Secrets that never rotate become permanent liabilities. You store credentials safely, rotate them automatically, manage the lifecycle of cryptographic keys, and find sensitive data that nobody listed.

• Secrets Manager and Parameter Store compared
• Automatic rotation of database credentials
• KMS key rotation, import and deletion
• Multi-Region keys
• Discovering sensitive data with Macie
• Removing secrets from code and images

You build A secrets design with automatic rotation and a scan that finds hard-coded credentials.

Account boundaries are your strongest control. You structure accounts for isolation, enforce baselines with policy, and make secure deployment the easiest path through approved templates and pipelines.

• Account design for isolation and blast radius
• Control Tower and landing zone baselines
• Organization policies and delegated administrators
• Approved templates with Service Catalog
• Secure CloudFormation and pipeline practices
• Detecting configuration drift from the baseline

You build A multi-account security baseline with enforced guardrails and a deployment path.

Compliance is a continuous measurement, not a yearly project. You define rules, evaluate every resource against them, collect evidence automatically and fix non-compliant resources at the source.

• Config rules and conformance packs
• Security Hub standards and scoring
• Audit Manager and evidence collection
• Using AWS compliance reports
• Remediation workflows and exceptions
• Reporting compliance to non-technical readers

You build A compliance dashboard that evaluates accounts against a framework and tracks fixes.

Secure one organization end to end. You set up logging and detection, harden identity, network and data, write the response plan, and prove it all works by attacking your own design.

• Threat modeling the target environment
• Building detection and logging
• Applying identity, network and data controls
• Running an attack simulation and responding
• Reporting findings and closing gaps

You build A secured multi-account environment with a tested response and a findings report.