case study
Project Zero: Cloud Lab (Part 3)
An AWS security lab that builds a production style cloud environment, simulates realistic attack paths, and implements monitoring and defensive controls.
The lab covers IAM, VPC networking, EC2, RDS, centralized logging, serverless automation, CloudTrail ingestion with Wazuh, and cloud attack-and-defense scenarios.
#Lab Architecture
A segmented AWS VPC with public and private subnets, a jump box, EC2 application resources, S3 and EBS storage, an RDS PostgreSQL database, centralized logging, and a Lambda based threat-intelligence pipeline. CloudTrail logs are ingested into Wazuh for centralized security monitoring.
#What I Built
| Area | What I worked with |
| Cloud Infrastructure | VPC, internet gateway, public and private subnets, route tables, NAT gateway, security groups, and EC2. |
| Identity and Access | IAM users, groups, custom policies, roles, least-privilege access, and Secrets Manager permissions. |
| Storage & Databases | EBS snapshots, AMIs, S3, PostgreSQL RDS, database users, and secret storage. |
| Monitoring | CloudTrail, VPC Flow Logs, S3 log archiving, lifecycle rules, and Wazuh integration. |
| Serverless Threat Intelligence | Lambda functions, Lambda layers, IAM execution roles, S3 event triggers, and threat-intelligence ingestion. |
| Offensive Security | Vulnerable CloudFormation stacks, exposed S3 buckets, hard-coded secrets, SSRF, insecure APIs, and cloud reconnaissance. |
| Defensive Security | AWS Config, EventBridge, SNS, IAM policy checks, secrets-access controls, and cloud log detection workflows. |
The lab uses temporary infrastructure for many attack exercises so vulnerable resources can be created, tested, documented, and removed without affecting the core environment.
#Deep Dives
-docs/01-aws-infrastructure-&-web-application-environment.md - Built the AWS foundation for the lab: IAM access, VPC networking, security groups, EC2 instances, and secure administrative access through a jump box. This section establishes the environment used throughout the project.administration.
-docs/02-storage.md - Explored AWS storage, snapshots, and machine images to understand how cloud workloads can be backed up, restored, and managed securely.
-docs/03-databases.md - Deployed a PostgreSQL database environment using Amazon RDS and secured application credentials with AWS Secrets Manager and IAM-based access controls.
-docs/04-monitor-and-logging.md - Configured CloudTrail, VPC Flow Logs, and centralized S3 log storage to capture AWS activity. Integrated cloud telemetry with Wazuh to support investigation and detection workflows.
-docs/05-serverless.md - Built a Python based serverless workflow with AWS Lambda to collect, process, and store threat-intelligence data automatically.
-docs/06-cloud-attacks.md - Simulated common cloud attack paths, including exposed S3 resources, leaked credentials, SSRF, insecure APIs, and cloud service reconnaissance.
-docs/07-cloud-defenses.md - Implemented cloud native controls such as AWS Config, EventBridge, SNS notifications, IAM restrictions, and secrets management protections to detect and reduce cloud risk.
AWS Infrastructure & Web Application Environmentopen →Storageopen →Databasesopen →Monitoring & Loggingopen →Serverless (Lambda)open →Attacksopen →Defensesopen →