This project demonstrates how to build a secure AWS cloud environment using AWS security best practices. It includes a custom VPC, secure remote access, centralized monitoring, audit logging, compliance monitoring, and automated notifications.
The project showcases secure infrastructure design, monitoring, and compliance using native AWS services.
- Amazon EC2
- Amazon VPC
- Internet Gateway
- NAT Gateway
- AWS Systems Manager (SSM)
- Amazon CloudWatch
- Amazon SNS
- AWS CloudTrail
- Amazon S3
- AWS Config
- IAM
- MFA
- OpenVPN Access Server
This project demonstrates the implementation of a secure AWS cloud infrastructure using AWS security best practices. The environment was designed with a secure network architecture, private workload deployment, centralized monitoring, audit logging, and compliance monitoring.
The project showcases how to securely deploy and manage Windows workloads in AWS using Amazon VPC, Systems Manager (SSM), Amazon CloudWatch, Amazon SNS, AWS CloudTrail, Amazon S3, and AWS Config.
- Build a secure AWS infrastructure.
- Deploy workloads in private subnets.
- Secure administrative access without exposing RDP to the internet.
- Monitor infrastructure health using Amazon CloudWatch.
- Configure automated alerts using Amazon SNS.
- Enable audit logging using AWS CloudTrail.
- Continuously evaluate security compliance using AWS Config.
| AWS Service | Purpose |
|---|---|
| IAM | Identity and access management |
| MFA | Secure user authentication |
| Amazon VPC | Isolated virtual network |
| Internet Gateway | Internet connectivity |
| Public Subnet | Bastion Host deployment |
| Private Subnet | Windows Application Server deployment |
| Amazon EC2 | Compute instances |
| AWS Systems Manager | Secure instance management |
| Amazon CloudWatch Agent | Collect OS-level metrics |
| Amazon CloudWatch | Infrastructure monitoring |
| CloudWatch Dashboard | Visualize system metrics |
| CloudWatch Alarm | Threshold-based monitoring |
| Amazon SNS | Email notifications |
| AWS CloudTrail | Audit logging |
| Amazon S3 | CloudTrail log storage |
| AWS Config | Compliance monitoring |
- Created an IAM Administrator User.
- Enabled Multi-Factor Authentication (MFA).
- Avoided using the AWS Root Account for daily operations.
- Created a custom Amazon VPC.
- Configured Public and Private Subnets.
- Attached an Internet Gateway.
- Configured Route Tables.
- Applied Security Groups following least-privilege principles.
- Configured a NAT Gateway to provide outbound internet access for resources in the private subnet.
A custom Amazon VPC was created with separate public and private subnets. Route tables, an Internet Gateway, and a NAT Gateway were configured to provide secure, controlled, and reliable network connectivity between public and private resources.
The environment consists of a Bastion Host deployed in the public subnet and a Windows Application Server deployed in the private subnet. The Application Server is managed securely using AWS Systems Manager (SSM) and monitored using the CloudWatch Agent.
The screenshot below shows both EC2 instances in the Running state.
OpenVPN Access Server was configured to provide secure remote access to the AWS environment. Administrators connect through an encrypted VPN tunnel before accessing resources inside the VPC.
Benefits:
- Encrypted communication
- Secure remote administration
- Controlled access to private resources
- Deployed in the Public Subnet.
- Used for administrative access.
- Deployed in the Private Subnet.
- No Public IP assigned.
- Managed securely using AWS Systems Manager.
AWS Systems Manager Session Manager was configured to securely manage the Windows Application Server without exposing RDP (3389) to the internet.
Benefits:
- No Public IP required
- No inbound RDP access
- IAM-controlled access
- Encrypted session
Amazon CloudWatch Agent was installed on the Windows Application Server to collect operating system metrics.
Collected Metrics:
- CPU Utilization
- Memory Utilization
- Disk Usage
- Network In
- Network Out
A custom CloudWatch dashboard was created to monitor the health and performance of the Windows Application Server.
The dashboard displays the following metrics:
- CPU Utilization
- Memory Utilization
- Network In
- Network Out
CloudWatch Alarms were configured to monitor CPU and memory utilization. When the configured threshold is exceeded, the alarm state changes from OK to ALARM and triggers an Amazon SNS notification.
Configured alarms:
- High CPU Utilization
- High Memory Utilization
Amazon SNS was integrated with CloudWatch Alarms to send email notifications whenever a CPU or memory alarm enters the ALARM state. This helps administrators respond quickly to potential issues.
Workflow:
CloudWatch Alarm
↓
Amazon SNS
↓
Email Notification
AWS CloudTrail records AWS API activities and securely stores the log files in an Amazon S3 bucket. These logs help monitor user activity and support security auditing.
Benefits:
- Tracks AWS account activities
- Records API calls
- Supports security auditing
- Helps with compliance
AWS Config continuously evaluates AWS resources against configured compliance rules. In this project, the managed rule s3-bucket-public-read-prohibited checks whether Amazon S3 buckets allow public read access.
Managed Rule:
s3-bucket-public-read-prohibited
Compliance Status:
- ✅ COMPLIANT
For detailed implementation steps, refer to:
IAM User + MFA
│
▼
Secure Access
│
▼
Amazon VPC
│
┌──────┴──────────┐
│ │
▼ ▼
Public Subnet Private Subnet
│ │
▼ ▼
Bastion Host Windows Application Server
│
CloudWatch Agent
│
▼
Amazon CloudWatch
├──────────────┐
▼ ▼
Dashboard Alarm
│
▼
Amazon SNS
│
▼
Email
CloudTrail ─────────► Amazon S3
AWS Config ────────► Managed Rules
- IAM User Authentication
- Multi-Factor Authentication (MFA)
- Private Subnet Deployment
- AWS Systems Manager Session Manager
- CloudWatch Monitoring
- CloudWatch Alarms
- Amazon SNS Notifications
- AWS CloudTrail Logging
- AWS Config Compliance Monitoring
- OpenVPN Access Server for secure remote access
Through this project, I gained practical experience with:
- AWS Identity and Access Management (IAM)
- Multi-Factor Authentication (MFA)
- Amazon VPC Architecture
- Public & Private Subnets
- AWS Systems Manager (SSM)
- Amazon CloudWatch Agent
- CloudWatch Dashboards
- CloudWatch Alarms
- Amazon SNS
- AWS CloudTrail
- Amazon S3
- AWS Config
- Cloud Security Best Practices
- VPN-based secure access using OpenVPN Access Server
Planned enhancements include:
- AWS GuardDuty
- Amazon Inspector
- AWS Security Hub
- AWS WAF
- AWS Shield
- Amazon EventBridge
- AWS Lambda Auto Remediation
aws-cloud-security-project/
│
├── README.md
│
├── architecture/
│ ├── AWS-Cloud-Security-Architecture.drawio
│ └── architecture-diagram.png
│
├── screenshots/
│ ├── cloudwatch-dashboard.png
│ ├── cloudwatch-alarm.png
│ ├── sns-topic.png
│ ├── cloudtrail.png
│ ├── aws-config-rule.png
│ └── architecture-overview.png
│
└── docs/
└── implementation-guide.md
This project was created as part of my hands-on learning journey in AWS Cloud Security to strengthen practical skills in secure infrastructure design, monitoring, logging, and compliance.