Toggle Side Panel

Close search
Back to Course

Introduction to AWS Security

0% Complete
0/0 Steps

  1. Introduction

    About the course and authors
  2. AWS cloud architecture
  3. Security concerns with our architecture
  4. Regions and Availability Zones (AZs)
  5. Shared responsibility in the cloud
  6. [Cheat Sheet] AWS Security Services
  7. Create a billing alert to avoid surprise bills
  8. Infrastructure Security
    VPC networks
  9. Default VPCs
  10. [DEMO] Creating VPCs and Subnets
  11. How many VPCs should you use?
  12. [DEMO] Subnet, Route Table, and Gateway Configurations
  13. [LAB] [Challenge] Create a VPC with public and private subnets
  14. [LAB] Launching an EC2 instance
  15. [DEMO] Security Groups (SGs)
  16. Security Groups Best Practices
  17. [DEMO] Network Access Control Lists (NACLs)
  18. [Cheat Sheet] SGs vs. NACLs
  19. [LAB] [Challenge] Configure security groups and NACLs to specific requirements
  20. Elastic Load Balancers
  21. [DEMO] AWS WAF
  22. [LAB] [Challenge] Deploy AWS WAF ACL for Application Load Balancer
  23. [DEMO] AWS Network Firewall - Part 1
  24. [DEMO] AWS Network Firewall - Part 2
  25. AWS Shield for DDoS Protection
  26. [LAB] Reduce AWS attack surface with port scanning and Security Groups
  27. AWS Firewall Manager
  28. Identity and Access Management (IAM)
    Key Concepts of IAM in AWS
  29. [DEMO] Getting started with IAM in AWS
  30. [DEMO] Creating our first admin user
  31. Assigning permissions with policies
  32. [Cheat Sheet] Anatomy of an AWS IAM Policy
  33. [DEMO] Using Identity Center AWS SSO
  34. IAM Roles
  35. [DEMO] Creating a role for EC2 instances to access S3 buckets
  36. End-User Management with Amazon Cognito
  37. IAM Access Analyzer
  38. [DEMO] IAM Access Analyzer Unused Access
  39. [LAB] Check policies for new access before deployment with IAM Access Analyzer
  40. [LAB] Check IAM policies against a deny list with IAM Access Analyzer
  41. [LAB] IAM Credentials Report
  42. Data Protection
    Data protection in the cloud
  43. EBS Data Protection and Encryption
  44. [LAB] Encrypt Existing Unencrypted EBS Volumes and Snapshots
  45. Amazon RDS Data Protection and Encryption
  46. Key Management with AWS KMS
  47. [Cheat Sheet] Getting Started with AWS KMS
  48. [DEMO] Creating a Symmetric Encryption KMS Key
  49. [Cheat Sheet] Encrypt and Decrypt Data with KMS and Data Keys
  50. [LAB] Encrypt and Decrypt Data with KMS and Data Keys
  51. Amazon S3 Bucket Protection
    Understanding Bucket Ownership
  52. [LAB] Creating Buckets and Uploading Objects in S3
  53. Managing Access to Buckets
  54. [Cheat Sheet] S3 Bucket Policies vs. ACLs vs. IAM Policies
  55. [LAB] [Challenge] Create an IAM role for secure access to S3 based on a scenario
  56. Using Signed URLs
  57. [LAB] S3 Presigned URLs
  58. Encrypting S3 Data
  59. [DEMO] Enable S3 Object Versioning
  60. [Cheat Sheet] Amazon S3 Protection Summary
  61. [Cheat Sheet] Create a least privilege S3 bucket policy
  62. AWS Log Types and Auditing Options
  63. Logging, Monitoring, and Incident Response
    [DEMO] Enable S3 Server Access Logs
  64. AWS CloudTrail
  65. Amazon CloudWatch
  66. [DEMO] CloudTrail Security Automation with CloudWatch Logs and SNS
  67. [LAB] Amazon VPC Flow Logs
  68. Proper Logging and Monitoring
  69. Amazon GuardDuty
  70. [LAB] [DEMO] Enable Threat Detection with GuardDuty
  71. [DEMO] Amazon EventBridge
  72. AWS Config
  73. AWS Systems Manager
  74. [LAB] Secure EC2 Access with SSM Session Manager and KMS
  75. [DEMO] AWS Config Automated Remediation with SSM
  76. [LAB] Automated S3 Remediation to Enforce Block Public Access
  77. [LAB] Remediate Open SSH Security Groups with AWS Config and SSM
  78. Amazon Detective
  79. [DEMO] Amazon Inspector
  80. [LAB] Find vulnerable Lambda Functions with Amazon Inspector
  81. About Amazon Macie
  82. [DEMO] Deploying Amazon Macie
  83. [DEMO] AWS Security Hub CSPM
  84. [DEMO] Must-have AWS monitoring and alerting with SSK
  85. [DEMO] AWS Organizations
  86. Multi-Account Security
    [DEMO] Centrally managing root access
  87. [DEMO] AWS SCPs and Management Policies
  88. [DEMO] Resource Control Policies (RCPs)
  89. AWS Control Tower
  90. [DEMO] Using RAM to share resources across accounts
  91. About IaC
  92. Infrastructure as Code (IaC)
    [DEMO] Deploying resources with CloudFormation
  93. [DEMO] Deploying a Lambda function with CloudFormation
  94. [DEMO] Multi-account and multi-region deployments
  95. [DEMO] Detecting drift
  96. [LAB] CloudFormation Guard
  97. [DEMO] Using AWS Service Catalog - Part 1
  98. [DEMO] Using AWS Service Catalog - Part 2
  99. [DEMO] Getting started with the Cloud Development Kit (CDK)
  100. [DEMO] Deploying a project with the CDK
  101. Wrap-up and Key Takeaways
    What next?
  1. Introduction to AWS Security
  2. [LAB] [Challenge] Create a VPC with public and private subnets
Lesson 13 of 101
In Progress

[LAB] [Challenge] Create a VPC with public and private subnets

Christophe
Christophe October 18, 2022

🧪Hands-On Lab
Help/Info

Lab Details 👨‍🔬

  • Length of time: < 20 minutes
  • Cost:
    • $0 when using Cybr’s Hands-On Labs
    • $0 if you decide to use your own AWS account instead * Please note that we can’t guarantee this since a) AWS can change pricing unexpectedly and b) some resources will continue accruing charges if they’re left on, so if you forget to stop them or delete them, you may incur additional costs. We are not responsible for any unexpected costs. With that said, this lab does not require any resources that cost money to run so you should not have to pay anything at all
  • Difficulty: Easy

We did something very similar in the demo lesson titled “Creating VPCs and Subnets” but I want you to try and complete this scenario as much as possible without looking back at that lesson. Of course, if you’re stuck and you can’t find answers by searching online, I do recommend using the course lesson material to break through. Pretend like you’ve been asked to do this on the job and troubleshoot to the best of your ability. That will help you build practical skills.

Scenario 🧪

Create a VPC named cybr-vpc-lab that contains 2 public subnets and 2 private subnets. Each of the public subnets should reside in different availability zones, with a private subnet in each of those zones as well.

Use a CIDR block of /16 for the VPC and CIDRs of /24 for the subnets.

Create an S3 Gateway VPC Endpoint that is connected to both of the private subnets.

While you can use the “VPC and more” option to automate a lot of this, I challenge you to manually create these resources instead to really apply what you’ve learned so far.

Tips:

  • Remember what makes a public subnet versus a private one
  • Before you launch a resource, it’s a great idea to verify its pricing first. For example, you should not be launching a NAT Gateway if you want to keep the cost at $0.00 since NAT Gateways cost money — all resources needed for this lab don’t cost anything so that’s a hint you don’t need a NAT Gateway

Conclusion

If you’d like us to verify your work after you’ve completed this lab, feel free to post in Discord here so as to avoid sharing any spoilers on this page.

Note: if you are running this scenario in your own AWS account and plan on experimenting with these resources further, feel free to keep them around. Otherwise, I’d recommend deleting them so that they don’t just sit around collecting dust for no reason. Otherwise, if you’re using Cybr’s lab environment, you don’t have to worry about deleting the resources, although though it is good practice, especially since deleting VPC resources can be a pain due to dependencies.

Solution

If you’re stuck or want to compare your work, here’s a fantastic write-up by Mariana from the community.

Want to achieve this using Infrastructure as Code with Terraform? Cybr member Kuljot Biring wrote up a guide!

Responses

Your email address will not be published. Required fields are marked *

    1. Christophe April 14, 2024

      Hey, in this case it’s up to you! If you plan on using the VPC further, then you can keep the resources around since they won’t cost you. Otherwise I’d go ahead and delete them!

  2. guga June 28, 2024

    route 53 resolver says that it cannot load rule groups, because arn:aws:iam::546027517081:user/create-a-vpc-with-public-and-private-subnet-LabUser-m9CixWe1it8R is not authorized to perform: route53resolver:ListFirewallRuleGroupAssociations, is this something im doing incorrectly?

    1. Christophe June 28, 2024

      Hey, seeing errors like that in the console is perfectly normal and expected when you are working from an identity with least privilege, because the AWS console is displaying all sorts of information by default. Some of it you will have access to and some of it you won’t. As long as it didn’t prevent you from completing the lab scenario (it shouldn’t), it is not an issue :). If it did prevent you from completing the scenario, let me know at which step and we’ll take a look!

  3. panky1997 August 11, 2024

    Hi team, while doing the lab, i got below error message:-
    User: arn:aws:iam::872863893867:user/create-a-vpc-with-public-and-private-subnet-LabUser-ok3lusrBCFlG is not authorized to perform: route53resolver:ListFirewallRuleGroupAssociations on resource: arn:aws:route53resolver:us-east-1:872863893867:firewall-rule-group-association/ because no identity-based policy allows the route53resolver:ListFirewallRuleGroupAssociations action
    Please check and do the needful.

    1. Christophe August 11, 2024

      Hi, there is a similar comment above. I’m not sure on which step/page you are seeing that error, but it won’t prevent you from completing the lab. Seeing some errors in our labs is perfectly normal, as they provide least privilege but the console oftentimes tries to load a bunch of stuff you may not have access to. If it’s preventing you from completing the steps in the lab’s scenario, please let me know at which step and I will provide hints. But the lab environment is correctly configured 🙂

  4. bad_bunny January 9, 2025

    Enjoyable.
    where i should do CIDR /16 or CIDR /24
    theres only one place to set it up that i can see and it’s where we did /24 in the last lesson.
    is there another place where i should do /16?

Report

Harassment or bullying behavior
Contains mature or sensitive content
Contains misleading or false information
Contains abusive or derogatory content
Contains spam, fake content or potential malware

Block Member?

Please confirm you want to block this member.

You will no longer be able to:

  • See blocked member's posts
  • Mention this member in posts

Please allow a few minutes for this process to complete.

Report

You have already reported this .