AWS Cloud Security Project: Secure Web Application Deployment

Project Overview

This project demonstrates how to build a secure AWS environment for deploying a simple web application using an EC2 instance. Key AWS security services are integrated to protect resources, monitor threats, and ensure compliance.

By the end of this project, you will have:

• A VPC with public and private subnets protected by NACLs.
• An EC2 instance running a web server with an attached IAM role and Security Group.
• Monitoring via CloudWatch with alarms for CPU and logs.
• Threat detection using GuardDuty.
• Security posture management using Security Hub.
• Investigations enabled with AWS Detective.
• DDoS protection via AWS Shield.

---

Prerequisites

• An active AWS Free Tier account.
• Basic familiarity with AWS Management Console.
• (Optional) AWS CLI installed for verification.

---

GitHub Repo Setup

1. Create a new repository: aws-cloud-security-project.
2. Clone locally:

   git clone https://github.com/yourusername/aws-cloud-security-project.git

3. Inside the repo, create a screenshots/ folder for images.
4. Document your steps in this README using screenshots:

   ![Step 1](screenshots/step1-iam-role-created.png)

5. Commit and push changes:

   git add .
   git commit -m "Initial project setup"
   git push

Estimated Time: 2-3 hours
Cost: Minimal (Free Tier eligible; monitor via AWS Cost Explorer)
Cleanup: Delete all resources after the project to avoid charges.

---

Step-by-Step Implementation

Step 1: Set Up IAM Role

Create a custom IAM role for EC2 with least-privilege access (e.g., AmazonS3ReadOnlyAccess for logs).

Screenshot:
![IAM Role Created](screenshots/step1-iam-role-created.png)

---

Step 2: Create VPC, Subnets, and Configure NACLs

• Create a VPC named SecureWeb-VPC with CIDR 10.0.0.0/16.
• Create public and private subnets (10.0.1.0/24 and 10.0.2.0/24).
• Configure NACLs:
  • Allow HTTP (80) and all traffic inbound from 0.0.0.0/0.
  • Allow ephemeral ports outbound (1024–65535).

Screenshot:
![VPC and NACL Configured](screenshots/step2-vpc-nacl-configured.png)

---

Step 3: Launch EC2 Instance with Security Group

• Launch an EC2 instance (t3.micro) in the public subnet.
• Attach EC2-WebApp-Role.
• Security Group (WebServer-SG):
  • Inbound: SSH (22) from your IP, HTTP (80) from anywhere.
  • Outbound: all traffic.
• Install Apache web server:

  sudo yum update -y
  sudo yum install -y httpd
  sudo systemctl start httpd
  sudo systemctl enable httpd

• Test locally:

  curl localhost

Screenshot:
![EC2 Launched and Web Server Running](screenshots/step3-ec2-launched.png)

---

Step 4: Set Up CloudWatch

• Create a log group /aws/ec2/SecureWebServer.
• Enable detailed monitoring for the EC2 instance.
• Create an alarm for CPU >= 80%.

Screenshot:
![CloudWatch Monitoring Configured](screenshots/step4-cloudwatch-setup.png)

---

Step 5: Enable GuardDuty

• Enable GuardDuty for threat detection (recon, crypto-mining, etc.).
• Optionally export findings to S3.

Screenshot:
![GuardDuty Enabled](screenshots/step5-guardduty-enabled.png)

---

Step 6: Configure Security Hub

• Enable Security Hub and select AWS Foundational Security Best Practices.
• View compliance score and control list.

Screenshot:
![Security Hub Dashboard](screenshots/step6-securityhub-enabled.png)

---

Step 7: Enable AWS Detective

• Enable Detective to investigate findings from GuardDuty and Security Hub.
• View entity relationship graphs.

Screenshot:
![AWS Detective Enabled](screenshots/step7-detective-enabled.png)

---

Step 8: Enable AWS Shield

• Standard protection is automatic.
• For Advanced (optional):
  • Protect your EC2 instance.
  • Enable proactive engagement if subscribed.

Screenshot:
![AWS Shield Protection](screenshots/step8-shield-enabled.png)

---

Cleanup

• Delete EC2, VPC, subnets, Security Groups, IAM role, CloudWatch alarms/logs, GuardDuty, Security Hub, Detective, and Shield (if Advanced enabled) to avoid charges.

---