Curriculum Overview: Designing and Implementing Security Controls for AWS Compute Workloads

This curriculum is designed for security professionals preparing for the AWS Certified Security - Specialty (SCS-C03) exam. It focuses specifically on Task 3.2, covering the protection of EC2 instances, containers, and Lambda functions throughout their lifecycle—from image creation to runtime monitoring and administrative access.

Prerequisites

Before starting this curriculum, learners should possess:

• AWS Cloud Practitioner Level Knowledge: Understanding of the AWS Shared Responsibility Model.
• IAM Foundations: Ability to create IAM roles and write basic JSON policies.
• Compute Fundamentals: Familiarity with Amazon EC2 (instances, AMIs), Amazon ECR (container registries), and AWS Lambda.
• Basic Networking: Understanding of VPCs, Security Groups, and Public/Private subnets.

Module Breakdown

Learning Objectives per Module

Module 1: Image Hardening

• Design and implement hardened Amazon EC2 AMIs and container images.
• Use EC2 Image Builder to automate the creation, testing, and distribution of secure images.
• Embed security agents (e.g., CloudWatch, Inspector) directly into baseline images.

Module 2: Workload Authorization

• Apply instance profiles to authorize EC2 applications to call AWS APIs.
• Configure Lambda execution roles following the principle of least privilege.
• Troubleshoot "Access Denied" errors using CloudTrail and IAM Policy Simulator.

Module 3: Detection & Runtime Monitoring

• Configure Amazon Inspector for automated, continuous vulnerability scanning of EC2 and ECR.
• Leverage GuardDuty runtime monitoring to detect malicious behavior within compute environments.

Module 4: Patching & Remediation

• Automate patch deployment using Systems Manager Patch Manager across large fleets.
• Integrate continuous validation to ensure patches do not break application functionality.

Module 5: Administrative Access

• Replace traditional SSH/RDP with SSM Session Manager to eliminate the need for bastion hosts and open port 22/3389.
• Use EC2 Instance Connect for temporary, IAM-based key injection.

Module 6: Emerging Tech & Pipelines

• Implement security tools like Amazon CodeGuru to find vulnerabilities in the CI/CD pipeline.
• Apply GenAI OWASP Top 10 protections to secure Large Language Model (LLM) applications.

Success Metrics

To demonstrate mastery of this curriculum, the learner must be able to:

1. Automate a Golden AMI Pipeline: Successfully configure an Image Builder pipeline that triggers an Inspector scan.
2. Zero-Trust Access: Access a private EC2 instance via Session Manager without an Internet Gateway or open inbound security group rules.
3. Vulnerability Remediation: Identify a vulnerable package via Amazon Inspector and automate its replacement using SSM State Manager or Patch Manager.
4. Policy Precision: Write an IAM policy for a Lambda function that restricts access to a specific S3 bucket prefix and verify it with IAM Access Analyzer.

Real-World Application

The Security Engineer's Perspective

In a production environment, "Compute Security" isn't just about a firewall. It is a defense-in-depth strategy.

[!IMPORTANT] Real-world compute security moves away from manual intervention. If you are SSHing into an instance to fix a security setting, you are creating a "snowflake" server. This curriculum emphasizes Immutable Infrastructure and Policy as Code.

Secure Administrative Access Architecture

Using TikZ, we can visualize the flow of Session Manager, which is a key exam topic for troubleshooting administrative access.

\begin{tikzpicture} % Elements \draw[thick] (0,0) rectangle (2,1.5) node[midway, align=center] {Administrator$IAM Auth)}; \draw[->, thick] (2,0.75) -- (4,0.75) node[above, midway] {HTTPS (443)}; \draw[thick] (4,0) rectangle (7,1.5) node[midway, align=center] {AWS Systems\Manager API}; \draw[->, thick] (7,0.75) -- (9,0.75) node[above, midway] {SSM Agent}; \draw[thick] (9,-0.5) rectangle (12,2) node[midway, align=center] {Target EC2$Private Subnet)};

\end{tikzpicture}

Career Relevance

• Compliance: Skills in Patch Manager and Inspector are essential for maintaining SOC2, PCI-DSS, and HIPAA status.
• Operational Efficiency: Automating the "Golden AMI" process reduces the overhead of security reviews for development teams.
• Incident Response: Understanding instance profiles and GuardDuty findings allows for rapid isolation and forensic analysis of compromised workloads.