Hands-On Lab: Implementing AWS Data Security Controls

Welcome to this guided lab on determining and implementing appropriate data security controls in AWS. According to the AWS SAA-C03 objectives, effective data protection requires ensuring the confidentiality, integrity, and availability (the "CIA" triad) of your data.

In this lab, you will secure an S3 bucket containing sensitive data by creating a Customer Managed Key (CMK) in AWS Key Management Service (KMS), enforcing server-side encryption, blocking public access, and mandating in-transit encryption using bucket policies.

Prerequisites

Before starting this lab, ensure you have the following:

• An active AWS Account with AdministratorAccess or permissions to manage S3 and KMS.
• AWS CLI installed and configured (aws configure) with access keys and a default region.
• A local text editor to create and modify policy files.
• Basic understanding of the AWS Shared Responsibility Model.

Learning Objectives

By completing this lab, you will be able to:

1. Provision and manage symmetric encryption keys using AWS KMS.
2. Configure Amazon S3 to enforce server-side data encryption at rest.
3. Implement S3 Public Access Block to prevent accidental data exposure.
4. Author and apply S3 Bucket Policies to enforce TLS/SSL (in-transit encryption).

Architecture Overview

This lab implements a defense-in-depth strategy for object storage. Here is the flow of the security controls you will build:

The security controls align directly with the foundational information security principles:

Step-by-Step Instructions

Step 1: Create an AWS KMS Customer Managed Key (CMK)

We will create a specific encryption key managed by you (the customer) rather than relying solely on the default AWS-managed S3 key. This provides greater control over key rotation and access.

[!TIP] Copy the output string (e.g., abcd-1234-5678-efgh). This is your <KEY_ID>. You will need it in later steps.

▶Console alternative

1. Navigate to the KMS Console.
2. Click Customer managed keys on the left menu, then Create key.
3. Choose Symmetric and click Next.
4. Give it an alias (e.g., lab-data-sec-key) and click Next.
5. Select your IAM user as the Key Administrator and Key User.
6. Review and click Finish.

Step 2: Create a Secure Amazon S3 Bucket

Create a globally unique S3 bucket to store your sensitive workload data.

▶Console alternative

1. Navigate to the S3 Console.
2. Click Create bucket.
3. Enter a unique bucket name brainybee-lab-sec-bucket-<UNIQUE_SUFFIX>.
4. Select your preferred region and click Create bucket.

Step 3: Enable Block Public Access

Ensure that no objects in this bucket can ever become public, regardless of individual object ACLs or future policies.

▶Console alternative

1. In the S3 Console, click on your new bucket.
2. Navigate to the Permissions tab.
3. Under Block public access (bucket settings), ensure it says On. (If off, click Edit, check "Block all public access", and Save).

Step 4: Configure Default Encryption with KMS

Force the bucket to automatically encrypt any uploaded objects using the CMK you created in Step 1.

▶Console alternative

1. Go to your bucket in the S3 Console and click the Properties tab.
2. Scroll down to Default encryption and click Edit.
3. Choose Server-side encryption with AWS Key Management Service keys (SSE-KMS).
4. Select Choose from your AWS KMS keys and pick your lab key.
5. Enable Bucket Key and click Save changes.

Step 5: Enforce Encryption in Transit via Bucket Policy

To protect against eavesdropping, we will mandate that all requests to the bucket use HTTPS (TLS). We do this by denying any request where aws:SecureTransport is false.

Create a local file named bucket-policy.json:

Apply the policy using the CLI:

▶Console alternative

1. Go to your bucket's Permissions tab.
2. Scroll down to Bucket policy and click Edit.
3. Paste the JSON above (remembering to replace <UNIQUE_SUFFIX> with your actual bucket name).
4. Click Save changes.

Checkpoints

Let's verify that our data security controls are active and functioning correctly.

Checkpoint 1: Verify Encryption Settings Check that default encryption is applied to the bucket.

Expected result: The output should display SSEAlgorithm as aws:kms and list your <KEY_ID>.

Checkpoint 2: Test File Upload Create a test file and upload it. Because you are using the AWS CLI, it uses HTTPS by default, which complies with our SecureTransport policy.

Expected result: upload: ./secret.txt to s3://brainybee-lab-sec-bucket-<UNIQUE_SUFFIX>/secret.txt

Clean-Up / Teardown

[!WARNING] Remember to run the teardown commands to avoid ongoing charges. While S3 storage costs for a few KB are negligible, KMS keys incur a $1/month charge if left active.

Execute the following commands to destroy the resources provisioned in this lab:

Troubleshooting