Lab: Implementing Automated Security Remediation and Secrets Management

This hands-on lab focuses on the practical application of Task 3.2 from the AWS SAP-C02 exam guide: Determining a strategy to improve security. You will practice auditing for least privilege, managing secrets, and implementing automated remediation using AWS Config and AWS Security Hub.

[!WARNING] Always run the commands in the Clean-Up / Teardown section at the end of this lab to avoid ongoing charges in your AWS account.

Prerequisites

• An AWS Account with AdministratorAccess permissions.
• AWS CLI installed and configured with credentials: aws configure.
• Basic knowledge of IAM policies and JSON syntax.
• A preferred terminal (Bash or Zsh recommended).

Learning Objectives

By the end of this lab, you will be able to:

1. Centralize Security Visibility: Enable and configure AWS Security Hub and AWS Config.
2. Secure Credentials: Implement secrets management using AWS Secrets Manager to replace hardcoded credentials.
3. Automate Compliance: Create an AWS Config Rule to detect and automatically remediate non-compliant S3 buckets.
4. Audit for Least Privilege: Review and implement IAM policies that follow the principle of least privilege.

Architecture Overview

The following diagram illustrates the flow of automated security auditing and remediation you will build today.

Step-by-Step Instructions

Step 1: Enable AWS Config Recording

AWS Config is required to track resource changes and evaluate them against security rules.

▶Console alternative

1. Navigate to AWS Config > Settings.
2. Click Turn on.
3. Under Recording strategy, choose Record all resources supported in this region.
4. For Data management, create an S3 bucket for logs and use the default service-linked role.

Step 2: Enable AWS Security Hub

Security Hub aggregates findings from multiple AWS services.

▶Console alternative

1. Navigate to Security Hub.
2. Click Go to Security Hub.
3. Ensure AWS Foundational Security Best Practices is checked and click Enable Security Hub.

Step 3: Implement Secure Secrets Management

Instead of using hardcoded API keys, we will store a dummy API key in Secrets Manager.

▶Console alternative

1. Navigate to Secrets Manager > Store a new secret.
2. Select Other type of secret.
3. Add key: api_key and value: AKIA-EXAMPLE-12345.
4. Name the secret brainybee/app/api-key and click Store.

Step 4: Deploy Automated Remediation Rule

We will deploy a rule that checks if S3 buckets have public read access and triggers an AWS Systems Manager (SSM) automation to set the bucket to private.

[!TIP] In a production environment, you would use PutRemediationConfigurations to link this rule to an SSM document like AWS-ConfigureS3BucketPublicAccessBlock.

Checkpoints

Clean-Up / Teardown

To prevent ongoing costs, delete the resources created in this lab:

1. Delete Secret:
   bashCopy

   aws secretsmanager delete-secret --secret-id "brainybee/app/api-key" --force-deletion-without-recovery
2. Delete Config Rule:
   bashCopy

   aws configservice delete-config-rule --config-rule-name s3-bucket-public-read-prohibited
3. Disable Security Hub:
   bashCopy

   aws securityhub disable-security-hub
4. Delete S3 Bucket:
   bashCopy

   aws s3 rb s3://<YOUR_BUCKET_NAME> --force

Troubleshooting

Stretch Challenge

Goal: Implement an automated response for a GuardDuty finding.

1. Enable Amazon GuardDuty via CLI: aws guardduty create-detector --enable.
2. Create an Amazon EventBridge rule that triggers a Lambda function when GuardDuty detects a "CryptoCurrency:EC2/BitcoinTool.B!DNS" finding.
3. The Lambda function should stop the affected EC2 instance automatically.

Cost Estimate

Total estimated cost for running this lab for 1 hour:

• AWS Config: ~$0.003 per configuration item (negligible for this lab).
• AWS Security Hub: Free for the first 30 days.
• AWS Secrets Manager: $0.40 per secret/month (pro-rated to ~$0.0006 for 1 hour).
• S3 Standard: ~$0.023/GB (negligible for empty buckets).
• Total: < $0.05 (well within Free Tier limits).

Concept Review

Security improvement is a continuous cycle. As specified in the SAP-C02 guide, a robust strategy involves layers of defense.

The Layered Security Model

\begin{tikzpicture}[node distance=1.5cm] \draw[thick] (0,0) circle (3cm); \node at (0,2.5) {\textbf{Network Security (WAF/Shield)}}; \draw[thick] (0,0) circle (2cm); \node at (0,1.5) {\textbf{IAM & Secrets}}; \draw[thick] (0,0) circle (1cm); \node at (0,0) {\textbf{Data (KMS)}}; \end{tikzpicture}

Key Concepts Comparison