Lab: Automating Security Controls and Data Protection

This hands-on lab focuses on Domain 6 of the AWS Certified DevOps Engineer Professional exam: Security and Compliance. You will implement automation for data protection and security controls using AWS Secrets Manager, AWS KMS, and AWS Config.

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges for AWS KMS keys and AWS Config recorders.

Prerequisites

To successfully complete this lab, you will need:

An AWS Account with Administrative access.
AWS CLI configured on your local machine with appropriate credentials.
A target region (e.g., us-east-1).
Basic familiarity with JSON and Bash/PowerShell.

Learning Objectives

Automate Data Protection: Provision an AWS KMS Customer Managed Key (CMK) and use it to encrypt S3 storage.
Automate Credential Rotation: Configure a secret in AWS Secrets Manager with placeholders for rotation logic.
Implement Compliance Automation: Deploy an AWS Config rule to monitor and report on S3 bucket encryption status.
Defense in Depth: Understand how these services layer together to secure a multi-service environment.

Architecture Overview

In this lab, you will build a simplified secure environment where data is encrypted at rest, and infrastructure compliance is automatically monitored.

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create a Customer Managed Key (CMK)

AWS KMS is the foundation for data protection. Using a CMK allows you to control the key policy and rotation separately from AWS Managed keys.

bash

# Generate a unique CMK
aws kms create-key --description "Lab Key for S3 and Secrets"

[!IMPORTANT] Note the KeyId (UUID) from the output. You will use it in the following steps.

▶Console alternative

Navigate to KMS > Customer managed keys.
Click Create key.
Choose Symmetric and click Next.
Provide an Alias (e.g., brainybee-lab-key) and click Next through the defaults to Finish.

Step 2: Create a Secure S3 Bucket

Next, we will create an S3 bucket and enforce server-side encryption using the KMS key created in Step 1.

bash

# Replace <YOUR_UNIQUE_BUCKET_NAME> with a unique string
# Replace <YOUR_KMS_KEY_ID> with the ID from Step 1
aws s3api create-bucket --bucket brainybee-lab-data-<YOUR_UNIQUE_BUCKET_NAME> --region us-east-1

aws s3api put-bucket-encryption \
    --bucket brainybee-lab-data-<YOUR_UNIQUE_BUCKET_NAME> \
    --server-side-encryption-configuration '{
        "Rules": [{
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms",
                "KMSMasterKeyID": "<YOUR_KMS_KEY_ID>"
            }
        }]
    }'

▶Console alternative

Navigate to S3 > Create bucket.
Name the bucket (e.g., brainybee-lab-data-123).
Under Default encryption, select Enable.
Choose AWS Key Management Service key (SSE-KMS).
Select the key you created in Step 1.
Click Create bucket.

Step 3: Automate Secret Management

Secrets Manager allows for the automation of credential rotation. We will create a secret that uses our KMS key for encryption.

bash

aws secretsmanager create-secret --name "brainybee/lab/db-creds" \
    --description "Database credentials for automation lab" \
    --kms-key-id <YOUR_KMS_KEY_ID> \
    --secret-string '{"username":"admin","password":"P@ssw0rd123!"}'

[!TIP] In a real-world DevOps scenario, you would attach a Lambda function to this secret to handle the RotationRules.

▶Console alternative

Navigate to Secrets Manager > Store a new secret.
Choose Other type of secret.
Enter Key/Value pairs (e.g., username / admin).
Select your CMK from the encryption key dropdown.
Name the secret brainybee/lab/db-creds and click Store.

Step 4: Implement AWS Config for Compliance

AWS Config continuously monitors resources. We will enable the s3-bucket-server-side-encryption-enabled rule to ensure all buckets are encrypted.

bash

# Note: This assumes AWS Config is already initialized in your account.
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "s3-bucket-encryption-check",
        "Description": "Checks if S3 buckets have encryption enabled",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
        }
    }'

▶Console alternative

Navigate to AWS Config > Rules.
Click Add rule.
Search for s3-bucket-server-side-encryption-enabled.
Click Next and Add rule.

Checkpoints

KMS Verification: Run aws kms describe-key --key-id <YOUR_KMS_KEY_ID> and confirm KeyState is Enabled.
S3 Encryption: Run aws s3api get-bucket-encryption --bucket <YOUR_BUCKET_NAME>. You should see SSEAlgorithm: aws:kms.
Config Compliance: Navigate to the Config console. Within 2-3 minutes, the s3-bucket-encryption-check rule should show your bucket as Compliant.

Teardown

To avoid charges, delete the resources created in this lab:

bash

# 1. Delete the S3 Bucket (must be empty)
aws s3 rb s3://brainybee-lab-data-<YOUR_UNIQUE_BUCKET_NAME> --force

# 2. Delete the Secret
aws secretsmanager delete-secret --secret-id "brainybee/lab/db-creds" --force-deletion-without-recovery

# 3. Delete the Config Rule
aws configservice delete-config-rule --config-rule-name "s3-bucket-encryption-check"

# 4. Schedule KMS Key Deletion (7-day minimum waiting period)
aws kms schedule-key-deletion --key-id <YOUR_KMS_KEY_ID> --pending-window-in-days 7

Troubleshooting

Error	Likely Cause	Solution
`AccessDeniedException`	IAM user lacks KMS or S3 permissions.	Attach the `AdministratorAccess` or specific KMS/S3/Config managed policies.
`BucketAlreadyExists`	S3 bucket names are globally unique.	Change the bucket suffix to something random (e.g., date-time).
`ConfigRuleNotAvailable`	AWS Config is not enabled in the region.	Run `aws configservice subscribe` or enable it via the Console first.

Stretch Challenge

Automated Remediation: Enhance your AWS Config rule by adding a Remediation Action. Configure AWS Config to trigger an SSM Document that automatically enables encryption on any bucket found to be non-compliant.

Cost Estimate

Service	Usage	Estimated Cost (USD)
AWS KMS	1 CMK	$1.00 / month (pro-rated)
AWS Secrets Manager	1 Secret	$0.40 / month (pro-rated)
AWS Config	1 Rule / 1 Evaluation	< $0.10
Total	30 Min Lab	<$0.05 (if deleted promptly)

Concept Review

Service	Role in Automation	Key Benefit
AWS KMS	Centralized Key Management	Decouples encryption logic from application code.
Secrets Manager	Lifecycle Management	Enables automatic rotation of DB passwords without downtime.
AWS Config	Continuous Auditing	Provides a detective control to ensure security standards are met.
S3 Encryption	Data Protection	Ensures data at rest is unreadable to unauthorized parties even if physical media is accessed.

Theoretical Model: The Shared Responsibility Pipeline

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Lab: Automating Security Controls and Data Protection

[!WARNING] Remember to run the teardown commands at the end of this lab to avoid ongoing charges for AWS KMS keys and AWS Config recorders.

Prerequisites

To successfully complete this lab, you will need:

An AWS Account with Administrative access.
AWS CLI configured on your local machine with appropriate credentials.
A target region (e.g., us-east-1).
Basic familiarity with JSON and Bash/PowerShell.

Learning Objectives

Automate Data Protection: Provision an AWS KMS Customer Managed Key (CMK) and use it to encrypt S3 storage.
Automate Credential Rotation: Configure a secret in AWS Secrets Manager with placeholders for rotation logic.
Implement Compliance Automation: Deploy an AWS Config rule to monitor and report on S3 bucket encryption status.
Defense in Depth: Understand how these services layer together to secure a multi-service environment.

Architecture Overview

In this lab, you will build a simplified secure environment where data is encrypted at rest, and infrastructure compliance is automatically monitored.

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Create a Customer Managed Key (CMK)

AWS KMS is the foundation for data protection. Using a CMK allows you to control the key policy and rotation separately from AWS Managed keys.

bash

# Generate a unique CMK
aws kms create-key --description "Lab Key for S3 and Secrets"

[!IMPORTANT] Note the KeyId (UUID) from the output. You will use it in the following steps.

▶Console alternative

Navigate to KMS > Customer managed keys.
Click Create key.
Choose Symmetric and click Next.
Provide an Alias (e.g., brainybee-lab-key) and click Next through the defaults to Finish.

Step 2: Create a Secure S3 Bucket

Next, we will create an S3 bucket and enforce server-side encryption using the KMS key created in Step 1.

bash

# Replace <YOUR_UNIQUE_BUCKET_NAME> with a unique string
# Replace <YOUR_KMS_KEY_ID> with the ID from Step 1
aws s3api create-bucket --bucket brainybee-lab-data-<YOUR_UNIQUE_BUCKET_NAME> --region us-east-1

aws s3api put-bucket-encryption \
    --bucket brainybee-lab-data-<YOUR_UNIQUE_BUCKET_NAME> \
    --server-side-encryption-configuration '{
        "Rules": [{
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms",
                "KMSMasterKeyID": "<YOUR_KMS_KEY_ID>"
            }
        }]
    }'

▶Console alternative

Navigate to S3 > Create bucket.
Name the bucket (e.g., brainybee-lab-data-123).
Under Default encryption, select Enable.
Choose AWS Key Management Service key (SSE-KMS).
Select the key you created in Step 1.
Click Create bucket.

Step 3: Automate Secret Management

Secrets Manager allows for the automation of credential rotation. We will create a secret that uses our KMS key for encryption.

bash

aws secretsmanager create-secret --name "brainybee/lab/db-creds" \
    --description "Database credentials for automation lab" \
    --kms-key-id <YOUR_KMS_KEY_ID> \
    --secret-string '{"username":"admin","password":"P@ssw0rd123!"}'

[!TIP] In a real-world DevOps scenario, you would attach a Lambda function to this secret to handle the RotationRules.

▶Console alternative

Navigate to Secrets Manager > Store a new secret.
Choose Other type of secret.
Enter Key/Value pairs (e.g., username / admin).
Select your CMK from the encryption key dropdown.
Name the secret brainybee/lab/db-creds and click Store.

Step 4: Implement AWS Config for Compliance

AWS Config continuously monitors resources. We will enable the s3-bucket-server-side-encryption-enabled rule to ensure all buckets are encrypted.

bash

# Note: This assumes AWS Config is already initialized in your account.
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "s3-bucket-encryption-check",
        "Description": "Checks if S3 buckets have encryption enabled",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
        }
    }'

▶Console alternative

Navigate to AWS Config > Rules.
Click Add rule.
Search for s3-bucket-server-side-encryption-enabled.
Click Next and Add rule.

Checkpoints

KMS Verification: Run aws kms describe-key --key-id <YOUR_KMS_KEY_ID> and confirm KeyState is Enabled.
S3 Encryption: Run aws s3api get-bucket-encryption --bucket <YOUR_BUCKET_NAME>. You should see SSEAlgorithm: aws:kms.
Config Compliance: Navigate to the Config console. Within 2-3 minutes, the s3-bucket-encryption-check rule should show your bucket as Compliant.

Teardown

To avoid charges, delete the resources created in this lab:

bash

# 1. Delete the S3 Bucket (must be empty)
aws s3 rb s3://brainybee-lab-data-<YOUR_UNIQUE_BUCKET_NAME> --force

# 2. Delete the Secret
aws secretsmanager delete-secret --secret-id "brainybee/lab/db-creds" --force-deletion-without-recovery

# 3. Delete the Config Rule
aws configservice delete-config-rule --config-rule-name "s3-bucket-encryption-check"

# 4. Schedule KMS Key Deletion (7-day minimum waiting period)
aws kms schedule-key-deletion --key-id <YOUR_KMS_KEY_ID> --pending-window-in-days 7

Troubleshooting

Error	Likely Cause	Solution
`AccessDeniedException`	IAM user lacks KMS or S3 permissions.	Attach the `AdministratorAccess` or specific KMS/S3/Config managed policies.
`BucketAlreadyExists`	S3 bucket names are globally unique.	Change the bucket suffix to something random (e.g., date-time).
`ConfigRuleNotAvailable`	AWS Config is not enabled in the region.	Run `aws configservice subscribe` or enable it via the Console first.

Stretch Challenge

Cost Estimate

Service	Usage	Estimated Cost (USD)
AWS KMS	1 CMK	$1.00 / month (pro-rated)
AWS Secrets Manager	1 Secret	$0.40 / month (pro-rated)
AWS Config	1 Rule / 1 Evaluation	< $0.10
Total	30 Min Lab	<$0.05 (if deleted promptly)

Concept Review

Service	Role in Automation	Key Benefit
AWS KMS	Centralized Key Management	Decouples encryption logic from application code.
Secrets Manager	Lifecycle Management	Enables automatic rotation of DB passwords without downtime.
AWS Config	Continuous Auditing	Provides a detective control to ensure security standards are met.
S3 Encryption	Data Protection	Ensures data at rest is unreadable to unauthorized parties even if physical media is accessed.

Theoretical Model: The Shared Responsibility Pipeline

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Lab: Automating Security Controls and Data Protection with AWS Secrets Manager and Config

Lab: Automating Security Controls and Data Protection

Prerequisites

Learning Objectives

Architecture Overview

Step-by-Step Instructions

Step 1: Create a Customer Managed Key (CMK)

Step 2: Create a Secure S3 Bucket

Step 3: Automate Secret Management

Step 4: Implement AWS Config for Compliance

Checkpoints

Teardown

Troubleshooting

Stretch Challenge

Cost Estimate

Concept Review

Theoretical Model: The Shared Responsibility Pipeline

Lab: Automating Security Controls and Data Protection with AWS Secrets Manager and Config

Lab: Automating Security Controls and Data Protection

Prerequisites

Learning Objectives

Architecture Overview

Step-by-Step Instructions

Step 1: Create a Customer Managed Key (CMK)

Step 2: Create a Secure S3 Bucket

Step 3: Automate Secret Management

Step 4: Implement AWS Config for Compliance

Checkpoints

Teardown

Troubleshooting

Stretch Challenge

Cost Estimate

Concept Review

Theoretical Model: The Shared Responsibility Pipeline