Week 6 Worklog

Week 6 Objectives:

  • Identity & Access Management (IAM): Implement robust identity controls using IAM Identity Center (SSO), restrict privileges with Permission Boundaries, and secure role assumptions with conditional policies.
  • Security Compliance & Defense: Automate security checks with AWS Security Hub and protect web applications using AWS WAF.
  • Data Protection: Master data encryption using AWS KMS (Key Management Service) and establish comprehensive backup strategies with AWS Backup.
  • Advanced Networking: Implement scalable network architectures using VPC Peering for direct connections and Transit Gateway for hub-and-spoke models.

Tasks to be carried out this week:

DayTaskStart DateCompletion DateReference Material
2Advanced Identity Management
- Setup IAM Identity Center (SSO) for centralized access across accounts.
- Create Permission Boundaries to limit maximum permissions for IAM users/roles.
- Configure IAM Role Conditions to prevent role transfer abuse.		13/10/202513/10/2025https://000012.awsstudygroup.com/

https://000030.awsstudygroup.com/

https://000044.awsstudygroup.com/
3Security Posture & Application Defense
- Enable AWS Security Hub to check compliance (CIS Standards).
- Deploy AWS WAF (Web Application Firewall):
  + Create Web ACLs with Managed Rules.
  + Block SQL Injection/XSS attacks on ALBs.		14/10/202514/10/2025https://000018.awsstudygroup.com/

https://000026.awsstudygroup.com/
4Data Protection (Encryption & Backup)
- Create Customer Managed Keys (CMK) in AWS KMS.
- Encrypt S3 buckets and audit usage via CloudTrail & Athena.
- Configure AWS Backup:
  + Create Backup Vault and Backup Plan.
  + Perform on-demand backup and restore of resources.		15/10/202515/10/2025https://000033.awsstudygroup.com/

https://000013.awsstudygroup.com/
5Network Reliability (Peering & Transit)
- VPC Peering: Connect two isolated VPCs and configure Route Tables/DNS.
- Transit Gateway (TGW): Build a central hub to connect multiple VPCs.
- Configure TGW Route Tables for traffic isolation.		16/10/202516/10/2025https://000019.awsstudygroup.com/

https://000020.awsstudygroup.com/
6Review & Cleanup
- Review all security configurations.
- Important: Delete Transit Gateway, NAT Gateways, and disable Security Hub/Config to avoid high costs.
- Verify deletion of KMS keys (schedule deletion).		17/10/202517/10/2025All Cleanup Sections

Week 6 Achievements

Identity & Access Management (IAM)

  • Successfully deployed IAM Identity Center to centralize user management and simplify login access across the organization.
  • Implemented Permission Boundaries to prevent privilege escalation, ensuring users cannot grant themselves more permissions than authorized.
  • Enhanced security by adding Conditions to IAM Roles, restricting how and where roles can be assumed or passed (e.g., limiting role passing to specific services).

Security Compliance & Application Defense

  • Activated AWS Security Hub to gain a comprehensive view of the security state and automatically check against CIS AWS Foundations Benchmark.
  • Protected web applications by deploying AWS WAF, successfully creating rules to block common threats like SQL Injection and malicious IP addresses before they reach the application load balancer.

Data Encryption & Backup Strategy

  • Managed data security using AWS KMS, creating Customer Managed Keys to encrypt sensitive data in S3.
  • Audited key usage and data access patterns by integrating KMS logs with CloudTrail and querying them via Amazon Athena.
  • Established a robust Disaster Recovery plan using AWS Backup, automating the backup schedules for EBS volumes and testing the successful restoration of data from a recovery point.

Advanced Networking & Connectivity

  • Connected isolated network environments using VPC Peering, enabling private communication between VPCs without traversing the public internet.
  • Solved the complexity of mesh networking by implementing AWS Transit Gateway, creating a scalable hub-and-spoke network architecture to interconnect multiple VPCs efficiently.
  • Configured complex Route Tables for both Peering and Transit Gateway to ensure correct traffic flow and network isolation.