A hands-on AWS security laboratory demonstrating a complete attack-to-response lifecycle. A deliberately vulnerable AWS environment was deployed with Terraform, attacked through an authorized simulation, investigated using CloudTrail evidence, contained, remediated, and validated.
Attacker IAM User → Vulnerable IAM Role → Temporary STS Credentials → S3 Access → Simulated Sensitive Data Retrieval → CloudTrail Investigation → Containment → Session Revocation → Recovery → Final Validation
01-vulnerable-environment/— Terraform deployment of the vulnerable AWS environment02-attack-simulation/— Authorized attack simulation and evidence of data access03-detection/— Detection and security monitoring04-investigation/— CloudTrail forensics, incident timeline, attack-path analysis, and containment validation05-containment-remediation/— Containment and remediation activities05-final-report.md— Final incident-response reportmetrics.md— Incident-response metrics04-investigation/attack-chain-diagram.md— Attack-chain visualization
- Over-permissioned IAM role
- Weak IAM trust policy
- S3 access to simulated confidential data
- Successful role assumption using the attacker identity
- CloudTrail evidence of the attack chain
- Successful containment through attacker access-key deactivation and explicit session revocation, with post-revocation access testing
- Preparation
- Attack Simulation
- Detection
- Investigation
- Containment
- Remediation
- Recovery
- Validation
The investigation includes:
- CloudTrail JSON evidence
- Incident timeline
- CloudTrail forensic analysis
- Attack-path summary
- Simulated sensitive-data recovery evidence
- Containment validation
- Attack-chain diagram
- AWS IAM
- AWS S3
- AWS STS
- AWS CloudTrail
- Amazon GuardDuty
- Terraform
- Pacu
- AWS CLI
- Python
This project is an authorized security laboratory using simulated data and deliberately vulnerable infrastructure. No real customer data, credentials, or production systems were targeted.