Secure AWS Deployment

Author: Ahmed Umar Rehman
Project Type: Cloud Security Implementation (AWS)
Scope: Secure deployment using IAM, S3, VPC, EC2, CloudTrail, and CloudWatch

---

Table of Contents

1. Introduction
2. Project Objectives
3. AWS Services Used
4. Architecture
   • 4.1 Overview
   • 4.2 Architecture Components
   • 4.3 Logical Flow
5. Implementation Steps
   • Step 1: IAM Setup
   • Step 2: Secure S3 Storage
   • Step 3: VPC Setup
   • Step 4: EC2 Launch and Access Control
   • Step 5: CloudTrail Logging
6. Security Best Practices Implemented
7. Conclusion

---

1. Introduction

Cloud computing enables organizations to deploy scalable infrastructure quickly, but insecure configurations can expose environments to unauthorized access, data leakage, and operational risk.

This project demonstrates a secure AWS deployment based on foundational cloud security controls, including:

• strong identity and access management,
• secure object storage,
• private network segmentation,
• hardened compute access,
• and activity monitoring/auditing.

The environment is designed using practical AWS services and follows common security principles such as least privilege, defense in depth, and continuous monitoring.

---

2. Project Objectives

The project objectives are to:

• Implement secure Identity and Access Management (IAM) policies.
• Enable Multi-Factor Authentication (MFA) for stronger account protection.
• Deploy secure Amazon S3 storage with baseline protections.
• Create a Virtual Private Cloud (VPC) for network isolation.
• Launch a secure EC2 instance inside the VPC.
• Enable CloudTrail logging for traceability and auditing.

---

3. AWS Services Used

Service	Purpose
IAM	Identity and access management
Amazon S3	Secure cloud storage
Amazon VPC	Network isolation
Amazon EC2	Virtual server deployment
AWS CloudTrail	Activity logging and auditing
AWS CloudWatch	Monitoring and alerts

---

4. Architecture

4.1 Overview

The architecture combines multiple AWS services to provide:

• controlled authentication and authorization,
• secure and recoverable data storage,
• isolated networking,
• controlled server access,
• and centralized visibility into account activity.

4.2 Architecture Components

IAM (Identity and Access Management)

• Created a dedicated IAM user (instead of using root access for daily operations).
• Enabled MFA to add a second authentication factor.
• Applied permissions for service access based on project needs.

Amazon S3 (Secure Storage)

• Created an S3 bucket for project logs/resources.
• Enabled Block Public Access to prevent unintended exposure.
• Enabled Versioning to improve data resilience and rollback capability.
• Applied secure storage settings to support confidentiality and recoverability.

Amazon VPC (Private Networking)

• Created VPC: SecureProjectVPC
• CIDR block: 10.0.0.0/16
• Configured networking components:
  • public/private subnets,
  • route tables,
  • internet gateway,
  • NAT gateway.

This allows controlled ingress/egress while isolating internal resources.

Amazon EC2 (Compute)

• Launched EC2 instance: SecureServer
• AMI: Amazon Linux
• Instance type: t2.micro
• Storage: 8 GB
• Key pair: secure-key

A restrictive security group allows only SSH (port 22) from the authorized source IP.

CloudTrail and CloudWatch (Visibility & Monitoring)

• Enabled CloudTrail with trail name: SecureProjectTrail
• Logged account-level API activity such as:
  • user sign-ins,
  • resource creation,
  • configuration updates,
  • security-relevant events.

CloudWatch supports monitoring and alerting workflows for operational visibility.

4.3 Logical Flow

flowchart LR
    U[Authorized IAM User + MFA] --> AWS[AWS Account]
    AWS --> S3[S3 Bucket\nBlock Public Access + Versioning]
    AWS --> VPC[VPC 10.0.0.0/16\nPublic/Private Subnets]
    VPC --> EC2[EC2 SecureServer\nSSH: Port 22 from trusted IP]
    AWS --> CT[CloudTrail\nAPI Activity Logs]
    CT --> CW[CloudWatch\nMonitoring / Alerts]

---

5. Implementation Steps

Step 1: IAM Setup

5.1 Create IAM User

• Created IAM user: AhmedUmarRehman
• Avoided routine use of the root account to reduce account-level risk.

5.2 Enable MFA

• Enabled Multi-Factor Authentication for the IAM user.
• Added stronger login protection against credential compromise.

---

Step 2: Secure S3 Storage

6.1 Create S3 Bucket

• Created bucket: secure-deployment-bucket-ahmed
• Region: US East (N. Virginia)

6.2 Block Public Access

• Enabled full public access blocking at bucket level.
• Reduced risk of accidental public exposure of stored objects.

6.3 Enable Versioning

• Enabled bucket versioning.
• Improved recovery from accidental deletion or overwrite.

---

Step 3: VPC Setup

7.1 Create VPC

• Created VPC: SecureProjectVPC
• CIDR: 10.0.0.0/16

7.2 Configure Subnets and Routing

Configured foundational networking:

• public subnets,
• private subnets,
• route tables,
• internet gateway,
• NAT gateway.

This enables controlled communication while preserving internal isolation.

---

Step 4: EC2 Launch and Access Control

8.1 Launch EC2 Instance

Parameter	Value
Instance Name	SecureServer
Instance Type	t2.micro
AMI	Amazon Linux
Key Pair	secure-key
Storage	8 GB

8.2 Configure Security Group

• Restricted inbound access to SSH (port 22) only.
• Allowed SSH only from the authorized user IP address.
• Minimized exposed attack surface for the server.

---

Step 5: CloudTrail Logging

9.1 Create CloudTrail

• Created CloudTrail trail: SecureProjectTrail
• Enabled API-level activity logging across the environment.

Tracked events include:

• user logins,
• resource provisioning,
• configuration changes,
• security-relevant actions.

---

6. Security Best Practices Implemented

The deployment includes the following security controls:

• IAM user usage instead of root for daily administration.
• MFA enabled for stronger authentication.
• S3 public access blocked.
• S3 versioning enabled.
• VPC-based network isolation.
• Security-group-based restricted server access.
• CloudTrail-enabled auditing and accountability.
• CloudWatch-backed operational visibility.

---

7. Conclusion

This project successfully demonstrates a practical and secure AWS deployment using core cloud security services and controls.

By combining secure identity practices, protected storage, isolated networking, controlled compute access, and continuous monitoring, the environment establishes a strong baseline security posture suitable for foundational cloud workloads.

It also reinforces a key principle of cloud operations: security should be designed into the architecture from the start, not added later.