Lab: Implementing Automated Security Monitoring and Auditing with AWS Config and GuardDuty

This lab focuses on implementing a robust security monitoring solution as required by the AWS Certified DevOps Engineer Professional curriculum. You will configure AWS Config to detect non-compliant resources and set up Amazon GuardDuty for intelligent threat detection, using Amazon EventBridge and SNS for real-time alerting.

Prerequisites

Before starting this lab, ensure you have:

An AWS Account with Administrator access.
AWS CLI installed and configured on your local machine.
Basic knowledge of IAM roles and JSON policy syntax.
A valid email address for receiving security alerts.

[!IMPORTANT] Ensure you are working in a Region that supports all services (e.g., us-east-1 or us-west-2).

Learning Objectives

By the end of this lab, you will be able to:

Configure AWS Config to monitor resource configuration changes.
Enable Amazon GuardDuty to identify malicious activity and unauthorized behavior.
Create automated alerting pipelines using Amazon EventBridge and SNS.
Remediate security findings manually based on automated alerts.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Set up the Alerting Infrastructure (SNS)

We need a way to receive alerts when a security event occurs.

bash

# Create an SNS Topic
aws sns create-topic --name SecurityAlertsTopic

# Subscribe your email (Replace the placeholder)
aws sns subscribe \
    --topic-arn arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic \
    --protocol email \
    --notification-endpoint <YOUR_EMAIL_ADDRESS>

[!NOTE] You must click the confirmation link in the email sent by AWS to activate the subscription.

▶Console alternative

Navigate to SNS > Topics > Create topic.
Select Standard, name it SecurityAlertsTopic.
Once created, click Create subscription.
Select Email as the protocol and enter your email address.

Step 2: Enable AWS Config and Managed Rules

AWS Config tracks configuration changes. We will add a rule to check if S3 buckets allow public read access.

bash

# Start the Config Recorder (Note: Assumes default role is available)
aws configservice subscribe --s3-bucket <YOUR_LOGGING_BUCKET_NAME> --sns-topic arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic

# Add the S3 Public Read Prohibited managed rule
aws configservice put-config-rule --config-rule '{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
    }
}'

▶Console alternative

Navigate to AWS Config > Settings.
Click Turn on (if not already enabled) and follow the setup wizard.
Go to Rules > Add rule.
Search for s3-bucket-public-read-prohibited and click Next then Save.

Step 3: Enable Amazon GuardDuty

GuardDuty provides intelligent threat detection by analyzing VPC Flow Logs and CloudTrail events.

bash

# Enable GuardDuty in the current region
aws guardduty create-detector --enable

▶Console alternative

Navigate to GuardDuty.
Click Get Started.
Click Enable GuardDuty.

Step 4: Configure EventBridge for Real-time Notifications

We will bridge Config findings to our SNS topic.

bash

# Create an EventBridge Rule for Config compliance changes
aws events put-rule \
    --name "ConfigComplianceAlert" \
    --event-pattern '{"source":["aws.config"],"detail-type":["Config Rules Compliance Change"],"detail":{"newEvaluationResult":{"complianceType":["NON_COMPLIANT"]}}}'

# Add SNS as a target for the rule
aws events put-targets --rule "ConfigComplianceAlert" --targets "Id"="1","Arn"="arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic"

Checkpoints

SNS Confirmation: Have you confirmed the subscription in your email inbox?
Config Status: Run aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-read-prohibited. Is the state currently COMPLIANT?
GuardDuty Status: Does the GuardDuty console show "GuardDuty is actively monitoring your AWS environment"?

Teardown

[!WARNING] Remember to run these commands to avoid ongoing charges for AWS Config and GuardDuty.

bash

# 1. Delete the Config Rule
aws configservice delete-config-rule --config-rule-name s3-bucket-public-read-prohibited

# 2. Disable GuardDuty (Replace <DETECTOR_ID> with your ID from Step 3)
aws guardduty delete-detector --detector-id <YOUR_DETECTOR_ID>

# 3. Delete the EventBridge Rule
aws events remove-targets --rule "ConfigComplianceAlert" --ids "1"
aws events delete-rule --name "ConfigComplianceAlert"

# 4. Delete the SNS Topic
aws sns delete-topic --topic-arn arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic

Troubleshooting

Error	Likely Cause	Fix
`No available configuration recorder`	AWS Config was never initialized.	Run the setup wizard in the Config Console or use `put-configuration-recorder` via CLI.
`Email alert not received`	SNS subscription not confirmed or Event pattern mismatch.	Check your Spam folder and verify the EventBridge rule pattern JSON.
`GuardDuty Detector already exists`	GuardDuty was previously enabled.	Use `list-detectors` to find the existing ID instead of creating a new one.

Stretch Challenge

Auto-Remediation: Research and implement an AWS Systems Manager (SSM) Automation document that triggers when AWS Config detects a public S3 bucket. The automation should automatically set the bucket to private without human intervention.

Cost Estimate

Service	Estimated Cost (Monthly/Unit)	Lab Cost (30 Mins)
AWS Config	$0.003 per configuration item recorded	< $0.05
Amazon GuardDuty	30-day Free Trial for new accounts; otherwise based on log volume	Free (Trial) or < $0.10
Amazon SNS	$0.50 per 1 million Amazon SNS Requests	$0.00
Total		Approx. $0.15

Concept Review

Service	Primary Function	Data Source
AWS CloudTrail	Auditing API activity	AWS Management Console, SDKs, CLI
AWS Config	Resource inventory and compliance	Resource configuration metadata
Amazon GuardDuty	Threat detection (Intelligent)	VPC Flow Logs, DNS Logs, CloudTrail
VPC Flow Logs	Network traffic monitoring	IP traffic from Network Interfaces

[!TIP] For the exam, remember that AWS Config is for "What happened to my resource configuration?" while CloudTrail is for "Who made the API call to change it?"

Lab: Implementing Automated Security Monitoring and Auditing with AWS Config and GuardDuty

Prerequisites

Before starting this lab, ensure you have:

An AWS Account with Administrator access.
AWS CLI installed and configured on your local machine.
Basic knowledge of IAM roles and JSON policy syntax.
A valid email address for receiving security alerts.

[!IMPORTANT] Ensure you are working in a Region that supports all services (e.g., us-east-1 or us-west-2).

Learning Objectives

By the end of this lab, you will be able to:

Configure AWS Config to monitor resource configuration changes.
Enable Amazon GuardDuty to identify malicious activity and unauthorized behavior.
Create automated alerting pipelines using Amazon EventBridge and SNS.
Remediate security findings manually based on automated alerts.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Step-by-Step Instructions

Step 1: Set up the Alerting Infrastructure (SNS)

We need a way to receive alerts when a security event occurs.

bash

# Create an SNS Topic
aws sns create-topic --name SecurityAlertsTopic

# Subscribe your email (Replace the placeholder)
aws sns subscribe \
    --topic-arn arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic \
    --protocol email \
    --notification-endpoint <YOUR_EMAIL_ADDRESS>

[!NOTE] You must click the confirmation link in the email sent by AWS to activate the subscription.

▶Console alternative

Navigate to SNS > Topics > Create topic.
Select Standard, name it SecurityAlertsTopic.
Once created, click Create subscription.
Select Email as the protocol and enter your email address.

Step 2: Enable AWS Config and Managed Rules

AWS Config tracks configuration changes. We will add a rule to check if S3 buckets allow public read access.

bash

# Start the Config Recorder (Note: Assumes default role is available)
aws configservice subscribe --s3-bucket <YOUR_LOGGING_BUCKET_NAME> --sns-topic arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic

# Add the S3 Public Read Prohibited managed rule
aws configservice put-config-rule --config-rule '{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "Source": {
        "Owner": "AWS",
        "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
    }
}'

▶Console alternative

Navigate to AWS Config > Settings.
Click Turn on (if not already enabled) and follow the setup wizard.
Go to Rules > Add rule.
Search for s3-bucket-public-read-prohibited and click Next then Save.

Step 3: Enable Amazon GuardDuty

GuardDuty provides intelligent threat detection by analyzing VPC Flow Logs and CloudTrail events.

bash

# Enable GuardDuty in the current region
aws guardduty create-detector --enable

▶Console alternative

Navigate to GuardDuty.
Click Get Started.
Click Enable GuardDuty.

Step 4: Configure EventBridge for Real-time Notifications

We will bridge Config findings to our SNS topic.

bash

# Create an EventBridge Rule for Config compliance changes
aws events put-rule \
    --name "ConfigComplianceAlert" \
    --event-pattern '{"source":["aws.config"],"detail-type":["Config Rules Compliance Change"],"detail":{"newEvaluationResult":{"complianceType":["NON_COMPLIANT"]}}}'

# Add SNS as a target for the rule
aws events put-targets --rule "ConfigComplianceAlert" --targets "Id"="1","Arn"="arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic"

Checkpoints

SNS Confirmation: Have you confirmed the subscription in your email inbox?
Config Status: Run aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-read-prohibited. Is the state currently COMPLIANT?
GuardDuty Status: Does the GuardDuty console show "GuardDuty is actively monitoring your AWS environment"?

Teardown

[!WARNING] Remember to run these commands to avoid ongoing charges for AWS Config and GuardDuty.

bash

# 1. Delete the Config Rule
aws configservice delete-config-rule --config-rule-name s3-bucket-public-read-prohibited

# 2. Disable GuardDuty (Replace <DETECTOR_ID> with your ID from Step 3)
aws guardduty delete-detector --detector-id <YOUR_DETECTOR_ID>

# 3. Delete the EventBridge Rule
aws events remove-targets --rule "ConfigComplianceAlert" --ids "1"
aws events delete-rule --name "ConfigComplianceAlert"

# 4. Delete the SNS Topic
aws sns delete-topic --topic-arn arn:aws:sns:<YOUR_REGION>:<YOUR_ACCOUNT_ID>:SecurityAlertsTopic

Troubleshooting

Error	Likely Cause	Fix
`No available configuration recorder`	AWS Config was never initialized.	Run the setup wizard in the Config Console or use `put-configuration-recorder` via CLI.
`Email alert not received`	SNS subscription not confirmed or Event pattern mismatch.	Check your Spam folder and verify the EventBridge rule pattern JSON.
`GuardDuty Detector already exists`	GuardDuty was previously enabled.	Use `list-detectors` to find the existing ID instead of creating a new one.

Stretch Challenge

Cost Estimate

Service	Estimated Cost (Monthly/Unit)	Lab Cost (30 Mins)
AWS Config	$0.003 per configuration item recorded	< $0.05
Amazon GuardDuty	30-day Free Trial for new accounts; otherwise based on log volume	Free (Trial) or < $0.10
Amazon SNS	$0.50 per 1 million Amazon SNS Requests	$0.00
Total		Approx. $0.15

Concept Review

Service	Primary Function	Data Source
AWS CloudTrail	Auditing API activity	AWS Management Console, SDKs, CLI
AWS Config	Resource inventory and compliance	Resource configuration metadata
Amazon GuardDuty	Threat detection (Intelligent)	VPC Flow Logs, DNS Logs, CloudTrail
VPC Flow Logs	Network traffic monitoring	IP traffic from Network Interfaces

[!TIP] For the exam, remember that AWS Config is for "What happened to my resource configuration?" while CloudTrail is for "Who made the API call to change it?"