Runbook 02 Enterprise AWS Network Security Assessment

Module: 04 – Amazon VPC & Network Security

Enterprise Lab: 02

Estimated Time: 3–4 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: Free Tier (No additional AWS charges)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, you have been assigned to perform a comprehensive security assessment of an existing AWS network.

By completing this runbook, you will learn how to:

Review Amazon VPC architecture
Assess subnet design
Evaluate route tables
Review Internet connectivity
Assess NAT Gateway configuration
Review Security Groups
Review Network ACLs
Assess Bastion Host security
Review VPC Flow Logs
Identify network security risks
Recommend remediation actions
Produce an executive network security assessment report

🏢 Business Scenario

CloudNova Technologies has migrated several applications to AWS over the last four years.

Different project teams have independently created VPCs, subnets, route tables, and security groups.

Management believes the environment is secure, but no formal network security review has ever been completed.

As the Cloud Security Engineer, you have been asked to conduct a comprehensive network security assessment before the company’s annual compliance audit.

📋 Prerequisites

Complete:

Enterprise Runbook 01 — Build a Secure Enterprise AWS Network

Required:

AWS Account
Administrator Access
AWS CLI Installed
Visual Studio Code

🏗 Existing Enterprise Environment

CloudNova AWS Environment

Production VPC
│
├── Public Subnet
│      ├── Bastion Host
│      ├── Load Balancer
│
├── Private Application Subnet
│      ├── EC2 Instances
│
├── Private Database Subnet
│      ├── Amazon RDS
│
├── Route Tables
├── Security Groups
├── Network ACLs
├── Internet Gateway
├── NAT Gateway
└── VPC Flow Logs

Your objective is to determine whether this architecture follows AWS networking and security best practices.

Step 1 — Review Amazon VPC

Navigate to:

AWS Console

↓

VPC

↓

Your VPCs

Review:

VPC Name
IPv4 CIDR Block
DNS Resolution
DNS Hostnames
Number of Subnets

Questions:

Is the CIDR block appropriate?
Is the VPC dedicated to a specific workload?
Are naming standards followed?

AWS CLI

aws ec2 describe-vpcs

Step 2 — Review Subnets

Navigate to:

VPC

↓

Subnets

Review:

Public Subnets
Private Application Subnets
Private Database Subnets

Questions:

Are databases deployed only in private subnets?
Are workloads properly segmented?
Are Availability Zones used effectively?

AWS CLI

aws ec2 describe-subnets

Step 3 — Review Route Tables

Navigate to:

VPC

↓

Route Tables

Review:

Public Route Tables
Private Route Tables
Associations

Verify:

Public subnets route Internet traffic through the Internet Gateway.
Private subnets route outbound traffic through the NAT Gateway.
Database subnets do not have direct Internet routes.

AWS CLI

aws ec2 describe-route-tables

Step 4 — Review Internet Gateway

Navigate to:

VPC

↓

Internet Gateways

Verify:

Internet Gateway attached correctly
Only public subnets use Internet access

Questions:

Are unnecessary public resources exposed?

AWS CLI

aws ec2 describe-internet-gateways

Step 5 — Review NAT Gateway

Navigate to:

VPC

↓

NAT Gateways

Review:

Status
Elastic IP
Public Subnet Placement

Questions:

Is the NAT Gateway deployed in a public subnet?
Are private workloads using the NAT Gateway correctly?

AWS CLI

aws ec2 describe-nat-gateways

Step 6 — Review Security Groups

Navigate to:

VPC

↓

Security Groups

Review every Security Group.

Check for:

Open SSH (0.0.0.0/0)
Open RDP (0.0.0.0/0)
Open Database Ports
Unused Security Groups
Overly permissive inbound rules
Unnecessary outbound access

Questions:

Is least privilege applied?
Are application tiers isolated?

AWS CLI

aws ec2 describe-security-groups

Step 7 — Review Network ACLs

Navigate to:

VPC

↓

Network ACLs

Review:

Inbound Rules
Outbound Rules
Rule Ordering
Associated Subnets

Questions:

Are public and private subnets protected differently?
Are unnecessary ports allowed?

AWS CLI

aws ec2 describe-network-acls

Step 8 — Review Bastion Host

Review:

Public IP Address
Security Group
SSH Access
Instance Type
Patch Status

Questions:

Is SSH restricted to trusted IP addresses?
Is Session Manager a better alternative?

AWS CLI

aws ec2 describe-instances

Step 9 — Review VPC Flow Logs

Navigate to:

VPC

↓

Flow Logs

Verify:

Enabled
Destination
CloudWatch Logs
Amazon S3

Review:

Accepted Traffic
Rejected Traffic
Suspicious Connections

Questions:

Are flow logs enabled for all VPCs?
Are logs retained appropriately?

Step 10 — Review VPC Endpoints

Navigate to:

VPC

↓

Endpoints

Review:

Amazon S3 Endpoint
DynamoDB Endpoint
Interface Endpoints

Questions:

Can Internet traffic be reduced using VPC Endpoints?
Are PrivateLink services used appropriately?

Step 11 — Identify Security Findings

Document findings.

Finding	Risk	Severity	Recommendation
SSH open to 0.0.0.0/0	High	Critical	Restrict SSH to trusted IP addresses
Database in Public Subnet	High	Critical	Move database to Private Subnet
Missing Flow Logs	Medium	High	Enable VPC Flow Logs
Unused Security Groups	Low	Medium	Remove unused Security Groups
Overly Permissive NACL	Medium	High	Apply least privilege rules

Step 12 — Prepare Remediation Plan

Immediate (Within 24 Hours)

Close unnecessary public ports
Remove public database access
Enable Flow Logs
Remove unused Security Groups

Short Term (30 Days)

Review Security Groups
Review Network ACLs
Implement VPC Endpoints
Harden Bastion Host

Long Term (90 Days)

Multi-AZ Design
Transit Gateway
Centralised Network Monitoring
AWS Network Firewall
Automated Compliance Checks

Step 13 — Validation

Verify:

VPC Architecture Reviewed
Subnets Reviewed
Route Tables Reviewed
Internet Gateway Reviewed
NAT Gateway Reviewed
Security Groups Reviewed
Network ACLs Reviewed
Bastion Host Reviewed
VPC Flow Logs Reviewed
Risks Documented
Recommendations Completed

🧪 Enterprise Challenge

CloudNova Technologies is preparing to host a new online banking platform.

Design a secure network architecture that includes:

Public Load Balancer
Private Application Tier
Private Database Tier
High Availability across two Availability Zones
Secure Administrator Access
VPC Flow Logs
AWS Network Firewall
VPC Endpoints
Centralised Monitoring

Prepare a presentation for the Chief Information Security Officer (CISO) explaining why your design meets enterprise security requirements.

📄 Deliverables

Capture screenshots of:

Amazon VPC
Subnets
Route Tables
Internet Gateway
NAT Gateway
Security Groups
Network ACLs
Bastion Host
VPC Flow Logs
VPC Endpoints

Submit:

Network Security Assessment Report
Risk Register
Remediation Roadmap
Updated Network Architecture Diagram
Executive Summary

🧹 Cleanup

This is primarily an assessment runbook.

Do NOT delete:

Amazon VPC
Subnets
Route Tables
Security Groups
Network ACLs
Internet Gateway
NAT Gateway
VPC Flow Logs

Delete only:

Temporary EC2 instances
Test Security Groups
Temporary Network ACLs
Experimental networking resources

✅ Runbook Checklist

💡 Lessons Learned

What network security risks were identified?

Why should production workloads remain in private subnets?

How do Security Groups and Network ACLs work together?

How do VPC Flow Logs support incident response?

How would you improve this network architecture?

🚀 Next Module

05 — Amazon EC2 Security

In the next module, you will learn how to secure Amazon EC2 instances using secure provisioning, IAM roles, patch management, encryption, Systems Manager (SSM), Amazon Inspector, monitoring, logging, and enterprise hardening techniques.