AWS Security

This roadmap teaches you to secure workloads on Amazon Web Services: identities, networks, data, logging and incident response. You need basic cloud and Linux knowledge and a free-tier AWS account for practice.

• Create a separate AWS account for learning
• Enable MFA on the root user and stop using it
• Set a billing alert before you build anything

• CyberA4U Academy — courses

AWS secures the cloud infrastructure; you secure what you put in it — identities, configuration, data and code. Most AWS breaches are customer-side misconfigurations.

• Explain the shared responsibility model
• Identify customer responsibilities for EC2, S3 and Lambda
• Recognize how responsibility shifts with managed services

Tools & tech: AWS

• AWS — Shared Responsibility Model

IAM decides who can do what in your account. Least-privilege policies, roles instead of long-lived keys, and MFA are the most important controls in AWS.

• Read and write IAM policies (effect, action, resource, condition)
• Prefer roles and temporary credentials over access keys
• Use IAM Access Analyzer to find overly broad access

Tools & tech: AWS

• AWS IAM — Security best practices

AWS Organizations groups accounts, and Service Control Policies set guardrails that no account can bypass — for example, blocking disabled logging or unapproved regions.

• Design a simple multi-account structure
• Write SCPs as guardrails
• Understand how SCPs combine with IAM policies

Tools & tech: AWS

• AWS Organizations — Service control policies (SCPs)

A VPC is your private network in AWS. Subnets, route tables, security groups and network ACLs decide what can talk to what.

• Separate public and private subnets
• Use security groups as least-privilege firewalls
• Explain when to use NACLs, VPC endpoints and flow logs

Tools & tech: AWS

• Amazon VPC — Security

S3 buckets hold huge amounts of data and are a classic source of leaks. Block Public Access, encryption and bucket policies prevent most incidents.

• Enable S3 Block Public Access
• Use bucket policies and encryption (SSE-S3, SSE-KMS)
• Log and monitor access to sensitive buckets

Tools & tech: AWS

• Amazon S3 — Security best practices

CloudTrail records API activity and AWS Config records resource configuration over time. Together they answer "who changed what, and when?"

• Enable an organization-wide CloudTrail trail
• Protect logs from tampering
• Use AWS Config rules to detect drift from your baseline

Tools & tech: AWS

• AWS CloudTrail User Guide
• What is AWS Config?

GuardDuty is AWS's managed threat detection service. It analyzes CloudTrail, VPC flow logs and DNS logs for signs of compromise.

• Enable GuardDuty across accounts
• Understand common finding types
• Route findings to a response process

Tools & tech: AWS

• What is Amazon GuardDuty?

KMS manages encryption keys and Secrets Manager stores credentials with rotation. Together they keep secrets out of code and control who can decrypt data.

• Choose between AWS-managed and customer-managed keys
• Write key policies with least privilege
• Store and rotate a secret with Secrets Manager

Tools & tech: AWS

• AWS KMS — Developer Guide overview
• What is AWS Secrets Manager?

EC2 instances are servers you manage. Harden the image, restrict access, require IMDSv2 and keep them patched.

• Use Systems Manager instead of open SSH
• Require IMDSv2 on instances
• Patch with Systems Manager Patch Manager

Tools & tech: AWS

• Amazon EC2 — Security

Serverless functions shrink your attack surface but move risk to permissions, event inputs and dependencies.

• Give each function its own least-privilege role
• Validate event input
• Manage secrets and dependencies safely

Tools & tech: AWS

Learn it on CyberA4U:Module 21: Cloud Environment Attack Techniques

• OWASP Serverless Top 10

Public buckets, over-privileged roles, open security groups and disabled logging cause most AWS incidents. Security Hub's best-practice checks catch many of them automatically.

• Recognize the most common AWS misconfigurations
• Enable Security Hub foundational best practices
• Prioritize and fix findings

Tools & tech: AWS

Learn it on CyberA4U:Module 21: Cloud Environment Attack Techniques

• AWS Security Hub — Foundational Security Best Practices standard

Cloud incident response uses the same lifecycle as on-premises, but with new tools: isolating instances with security groups, snapshotting disks and revoking credentials quickly.

• Prepare roles and runbooks before an incident
• Contain a compromised instance or access key
• Preserve evidence (snapshots, logs)

Tools & tech: AWS

• AWS Security Incident Response Guide

The Security Pillar of the AWS Well-Architected Framework summarizes best practices for identity, detection, infrastructure protection, data protection and incident response.

• Explain the seven design principles of the Security Pillar
• Run a Well-Architected review question set
• Turn gaps into an improvement plan

Tools & tech: AWS

• AWS Well-Architected — Security Pillar

Practice turns reading into skill. AWS workshops provide guided labs you can run in your own account at little or no cost.

• Pick labs that match the topics above
• Clean up resources after each lab
• Record what you learned

Tools & tech: AWS

• AWS Workshops catalog

Check that you can secure a small AWS workload end to end — identity, network, data, logging and response — without step-by-step guides.

• Design least-privilege IAM
• Secure network and data
• Enable logging and detection

• CyberA4U CTF Arena — practice challenges

You can now secure common AWS workloads. Consider the AWS Certified Security – Specialty exam, and continue with Cloud Detection & Response or Kubernetes Security.

• Keep your practice account clean and cheap
• Choose your next roadmap
• Document one architecture you secured

• CyberA4U CTF Arena — practice challenges