HACKING PROJECT · cloud · Beginner
AWS Cloud Security (Foundations)
Enable a student to assess and harden an AWS environment to a defensible security baseline and continuously detect posture drift.
Cloud misconfiguration is the leading cause of cloud breaches, with public S3 buckets, over-permissive IAM policies, and disabled logging exposing data at scale. Teams migrating to AWS often lack a security baseline and cannot detect drift from best practice. Without foundational cloud security posture management, organizations inherit invisible risk.
**What you'll build**
Build an AWS security foundations project that hardens an account against the CIS AWS Benchmark: least-privilege IAM, CloudTrail/Config/GuardDuty enablement, S3 public-access blocking, and encryption enforcement. Add automated posture scanning (Prowler/ScoutSuite) and remediation-as-code via Terraform. The result is a repeatable, auditable secure landing zone aligned to the AWS Well-Architected Security Pillar and NIST 800-207 Zero Trust principles.
**Objective** — Enable a student to assess and harden an AWS environment to a defensible security baseline and continuously detect posture drift.
**Expected outcome** — A hardened AWS account plus an automated CSPM report (Prowler/ScoutSuite) with Terraform remediation and a CIS-benchmark compliance scorecard.
**Difficulty** — Beginner — foundational with AWS free tier, though IAM depth and IaC push toward Intermediate.
**Primary category** — Cloud Security / CSPM; Secondary = IAM, GRC, DevSecOps
**Security domains** — Primary = Cloud Security; Secondary = Blue Team, GRC, DevSecOps, Incident Response
**Technical focus** — IAM least-privilege, CSPM, CloudTrail/Config logging, GuardDuty threat detection, S3/data security, KMS encryption, security groups/VPC, IaC security, compliance benchmarking, Zero Trust identity
**Core technologies** — Languages: Python (boto3), HCL; Frameworks/Libraries: boto3, Terraform, AWS CLI; Security Tools: Prowler, ScoutSuite, AWS GuardDuty, AWS Config, IAM Access Analyzer; Cloud/Infra: AWS (IAM, S3, VPC, CloudTrail, KMS); AI/Data: optional GuardDuty ML findings; Databases: DynamoDB/S3 for evidence storage
**Where it's valued** — SaaS, fintech, healthcare, e-commerce, startups, any cloud-native or cloud-migrating enterprise
**Careers it builds toward** — Cloud Security Engineer, Cloud Security Analyst, DevSecOps Engineer, Security Engineer, GRC/Compliance Analyst
**Framework alignment**
• MITRE ATT&CK: Cloud matrix — Valid Accounts: Cloud Accounts (T1078.004), Unused/Unsupported Cloud Regions (T1535), Data from Cloud Storage (T1530), Modify Cloud Compute Infrastructure (T1578)
• NIST CSF 2.0: Protect (Identity Management, Data Security), Detect (GuardDuty/CloudTrail), Identify, Govern; NIST 800-207 Zero Trust identity/least-privilege
• OWASP: OWASP Cloud-Native / Top 10 CI/CD; API Top 10 for exposed cloud APIs
• CIS Controls v8: 3 (Data Protection), 5 (Account Management), 6 (Access Control Management), 4 (Secure Configuration), 8 (Audit Log Management); CIS AWS Foundations Benchmark
**Innovation** — Improved Existing Solution — CSPM is mature, but a Terraform-driven auto-remediating baseline with continuous benchmarking is highly marketable and enterprise-relevant. Scores: Innovation 5/10, Startup 6/10, Enterprise-Readiness 7/10, Patent = No.