Course
AWS Cloud Security
Secure AWS the way breaches actually happen: IAM policy anatomy and privilege escalation, S3 and network exposure, CloudTrail/GuardDuty detection, and the day-one hardening baseline.
Identity: where AWS breaches actually start
IAM policy anatomy, evaluation logic, and the privilege escalation paths used in real incidents.
- 01Reading an IAM policy like an attackerPolicy anatomy, the three evaluation rules that matter, the wildcards that leak, and how to simulate before you ship.25mOpen
- 02IAM privilege escalation paths that actually get usedPassRole laundering, self-modifying policies, and the indirect paths pentesters reach for first — plus how to close them.30mOpen
- 03Role trust policies and the confused deputyWho can assume a role, ExternalId for third parties, SourceArn for services, and OIDC that kills stored AWS keys in CI.30mMembers
Data and network exposure
How S3 buckets end up public, security group traps that survive audits, and VPC layouts that limit blast radius.
- 01S3: how buckets actually end up publicThe four exposure mechanisms, account-level Block Public Access, and auditing your buckets the way scanners do.30mMembers
- 02Security groups and the 0.0.0.0/0 reflexStateful allow-only semantics, SG-to-SG references, the ::/0 blind spot, and auditing for world-open rules.25mMembers
- 03VPC design that limits blast radiusPublic vs private by routing not naming, free VPC endpoints, flow logs, and how many VPCs a team actually needs.30mMembers
Detection and the account baseline
CloudTrail that survives an incident, GuardDuty signal, and the day-one hardening checklist every account needs.
- 01CloudTrail: the log you'll wish you hadEvent history vs real trails, management vs data events, putting logs where attackers can't reach, and Athena queries.30mPremium
- 02GuardDuty and the signal chain around itAgentless detection that works on day one, the findings worth paging on, and Security Hub, Inspector, and Detective.25mPremium
- 03The day-one hardening baseline every account needsRoot lockdown, SCPs, IMDSv2, encryption defaults, and the billing alarm that's the cheapest detector AWS sells.30mPremium