Protect application files, credentials, configuration and web requests with focused AWS security controls. You will connect each control to a permitted operation and a meaningful denial.
Five guided labs cover KMS, S3 SSE-KMS, Secrets Manager, Parameter Store and WAF. The independent challenge diagnoses an application that cannot read its intended secret.
What You Will Learn
- Encrypt and decrypt a private export with a customer KMS key
- Diagnose encryption-context, permission and key-state failures
- Protect S3 objects with SSE-KMS and test object/key permissions separately
- Move an inline application credential into Secrets Manager with scoped access
- Separate development and production using hierarchical Parameter Store names
- Associate a WAF rule with a supplied endpoint and test allowed and blocked requests
- Repair a secret-read failure while preserving unrelated resource boundaries
Who This Course Is For
This course is for AWS learners who want to apply IAM knowledge to application data and access controls.
Prerequisites: Start with AWS preparation and IAM scoped policies/temporary role sessions. SEC02 also needs S3 object storage and SEC01 KMS. SEC03 needs Lambda configuration and data access (FN02/FN03); SEC04 follows SEC03 and SEC01. WAF has its own supplied REST stage and can be studied independently after preparation and scoped policies. Complete SEC03 before the secret-read challenge. Follow each lab’s specific prerequisites.
Learning environment: All activities run in a provided browser-based LabEx Linux environment. Use Terminal for AWS CLI commands and AWS View, next to Terminal, to inspect the same resource and application state. Tools and the connection are prepared; you do not need a personal AWS account or access keys. Each lab starts independently in a fresh VM. AWS View shows resource state, safe cryptographic hashes, actual executions and logs. The WAF lab supplies its own HTTP fixture and does not require earlier ALB or VPC construction.
Frequently Asked Questions
Does permission to read an object allow key decryption?
Not by itself. The S3/KMS lab tests object access and key decryption separately. The Parameter Store lab similarly separates parameter reading from KMS decryption.
Will I provide real application credentials?
No. Use the supplied synthetic data, keep private files protected and never print credentials. Test only the intended resources and preserve unrelated references.
Are KMS keys deleted immediately during cleanup?
No. Keys use a documented pending-deletion window. Scheduling deletion does not establish immediate absence. Finish functional checks first, then use successful queries to verify the required cleanup state.
Does this cover every AWS security feature?
No. Custom KMS key policies/grants, cross-account access and managed-default keys are outside these focused units. The course practices the taught controls and does not claim complete production compatibility.
