Week 5 Worklog

Week 5 Objectives:

  • Learn foundational knowledge and core security services on AWS, centered around the “Security is job zero” philosophy.
  • Start with the most basic concept: the Shared Responsibility Model.
  • Focus deeply on managing identity and access (Identity and Access Management - IAM), including components: User, Group, Policy, and Role.
  • Expand learning to identity management services at a larger scale, such as AWS Organizations (managing multiple accounts), AWS Identity Center (SSO) (single sign-on), and Amazon Cognito (user management for web/mobile apps).
  • Gain solid knowledge of data protection through encryption with AWS KMS and monitoring/compliance checks with AWS Security Hub.

Tasks to be carried out this week:

DayTaskStart DateCompletion DateReference Material
2Shared Responsibility Model

- Learn about the Shared Responsibility Model, in which AWS is responsible for security of the cloud (physical infrastructure, underlying software) and the customer is responsible for security in the cloud (configuration, data, applications).
- Understand how security responsibilities change depending on the service type (infrastructure, combined management, or fully managed).

AWS Identity and Access Management (IAM)

- Learn about the Root Account, the account with absolute full permissions, and best practices to protect it (create an IAM Admin User for regular use, lock away root credentials).
- Learn about IAM User, a principal used to interact with AWS, which has no permissions by default when created.
- Understand the technique for efficient user management by grouping multiple IAM Users into an IAM Group.
- Learn about IAM Policy, a JSON document that defines permissions, including 2 types:
+ Identity-based Policy: Attached directly to an IAM Principal (User, Group, Role).
+ Resource-based Policy: Attached directly to a resource (e.g., S3 Bucket Policy).
- Understand the IAM permission evaluation technique, where an explicit deny always takes precedence, regardless of any other Allow policy.
- Learn about the architecture of IAM Role, a set of permissions (policy) without permanent credentials (password/access key).
- Understand the Assume Role technique: An IAM User (or Service) uses the AWS STS (Security Token Service) to temporarily “assume” the IAM Role’s permissions and receive temporary credentials.
- Understand the practical application of IAM Role, e.g., granting an EC2 service permission to access S3 without storing access keys on the server.
06/10/202506/10/2025Module 05
3
Amazon Cognito

- Learn about Amazon Cognito, a service for managing authentication (login, sign-up) and authorization for end-users of web and mobile applications (different from IAM Users, who are AWS administrators).
- Learn about the two main components of Cognito:
+ User Pool: A user directory that manages users, supporting direct login or login via third-party providers (Facebook, Google).
+ Identity Pool: Grants application users access (usually temporary) to other AWS services.

AWS Organizations

- Learn about AWS Organizations, a service that helps centrally manage and govern multiple AWS accounts.
- Understand the Consolidated Billing technique for all accounts.
- Understand the technique of grouping accounts into OUs (Organization Units) and applying Service Control Policies (SCP) to limit the maximum permissions that IAM Users/Roles in that account can perform (including deny-based).

AWS Identity Center (SSO)

- Learn about AWS Identity Center (SSO), a service that helps centrally manage access (single sign-on) to all AWS accounts in an Organization and to external applications.
- Understand the technique of using Permission Sets (a set of permissions stored in Identity Center) to assign to Users/Groups. When a user accesses an account, the Permission Set is granted as an IAM Role within that account.
07/10/202507/10/2025Module 05
4AWS Key Management Service (KMS)

- Learn about AWS KMS, a service to create and manage encryption keys to protect data at rest (Encryption at rest).
- Learn about… CMK (Customer Managed Key) (the master key within KMS) and Data Key (the key used to encrypt/decrypt actual data, generated by the CMK).

AWS Security Hub

- Learn about AWS Security Hub, a service for continuous security checks, based on AWS best practices and industry standards (like PCIDSS).
- Understand how Security Hub provides results as a score and identifies resources that need attention.

Lab: 000002 - Getting Started with IAM and IAM Role
- IAM Group and IAM User
- Create IAM Role
- Assume Role

Lab: 000044 - IAM Role and Condition
- Introduction to IAM
- Create EC2 Admin User
- Create RDS Admin User
- Create Admin Group-Configure IAM Role Condition
- Create IAM Role with Admin rights 5.2 Create IAM User 5.3 Configure Switch role 5.4 Restrict IP 5.5 Restrict by time.
08/10/202508/10/2025Module 05
5Lab: 000048 - IAM Role and Application
- Use access key
- IAM Role on EC2

Lab: 000030 - IAM Permission Boundary
- Introduction to IAM Permission Boundary
- Create limiting Policy
- Create IAM User with limited permissions
- Test the limited User

Lab: 000027 - Tags and Resource Groups
- Use tags
- Use tags via Console
- Display tags
- Add or remove tags
- Tag a virtual machine
- Filter resources by tag
- Use tags via CLI
- Resource Group

Lab: 000028 - Manage EC2 via Resource Tag
- Create IAM Policy
- Create IAM Role
- Test IAM Role
09/10/202509/10/2025Module 05
6Lab: 000018 - Using AWS Security Hub
- Security standards
- Activate Security Hub
- Score for each standard set

Lab: 000012 - Using AWS SSO
- Preparation steps
- Create AWS Account in AWS Organizations
- Set up Organization Unit
- Set up AWS SSO
- Verify

Lab: 000033 - KMS Workshop
- Set up environment
- Getting started with AWS KMS
- Encryption with AWS KMS
- Key Policy and best practices
- Monitoring AWS KMS usage.

[Supplemental Research] - AWS Certified Security Specialty All-in-One-Exam Guide (Exam SCS-C01)
- Study material for the Security Specialty certification exam
10/10/202510/10/2025Module 05
Research Link

Week 5 Achievements:

  • Foundational Lesson: Master the Shared Responsibility Model, clearly understanding AWS’s responsibilities versus the customer’s.
  • IAM Service (Core):
    • Clearly distinguish between the Root Account (full permissions, needs to be locked away) and IAM User (used daily, no permissions by default).
    • Master the 3 main components for granting permissions: IAM User (the entity), IAM Policy (the permission - written in JSON), and IAM Group (a group of entities).
    • Clearly understand IAM Role: a mechanism to grant temporary permissions (no permanent credentials) to both Users and Services (like EC2).
  • IAM Techniques (Important):
    • Know how a User/Service “receives” a Role’s permissions through the Assume Role technique (using the STS service).
    • Understand the permission evaluation rule: An Explicit Deny always overrides any Allow permissions.
  • Identity Management Services (Identity Services):
    • Clearly differentiate between IAM (manages AWS administrators) and Amazon Cognito (manages end-users of web/mobile apps).
    • Know that Cognito User Pool is the user directory (can log in with Facebook, Google) and Identity Pool is what grants those users access to AWS resources.
  • Multi-Account Management Service (Multi-Account):
    • Understand AWS Organizations is used for centrally managing multiple accounts, enabling Consolidated Billing.
    • Know how to use Service Control Policies (SCP) within an Organization to limit the maximum permissions of member accounts.
    • Understand AWS Identity Center (SSO) as the single sign-on solution, using Permission Sets to grant access to accounts within the Organization.
  • Encryption Service (Encryption):
    • Know AWS KMS is the service for creating and managing encryption keys.
    • Understand the Encryption at Rest mechanism and differentiate between CMK (the master key in KMS) and Data Key (the key used to encrypt the actual data).
  • Security Monitoring Service (Monitoring):
    • Know AWS Security Hub is the service that scans and provides security scores, helping to check compliance against standards (like PCIDSS).
  • Hands-on:
    • Practice creating and managing Users, Groups, Policies, and Roles.
    • Practice implementing SSO and KMS.
    • Practice using advanced IAM features like Conditions and Permission Boundaries.