Lesson 11 — Enterprise Build Project

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Project Objective

Welcome to the capstone project for Module 05 – Amazon EC2 Security.

In this project, you will build a secure enterprise-grade EC2 environment for CloudNova Technologies.

This project combines everything learned throughout the module into a single deployment that closely resembles how cloud engineers build secure production workloads in real organisations.

By the end of this project, you will be able to:

Design a secure EC2 deployment.
Deploy application servers using enterprise standards.
Secure compute resources using IAM Roles.
Configure encrypted storage.
Enable Systems Manager administration.
Implement monitoring and backup.
Validate the deployment using enterprise security checklists.

💼 Business Scenario

CloudNova Technologies is launching a brand-new Learning Management System (LMS).

The company expects:

Thousands of concurrent users
Student assessments
Course streaming
AI-powered learning features
24×7 availability

As the Cloud Security Engineer, you are responsible for deploying the first secure production environment.

Your deployment must follow CloudNova’s enterprise security standards.

🏢 Enterprise Architecture

                           Internet
                               │
                    AWS Shield Standard
                               │
                        AWS WAF
                               │
                 Application Load Balancer
                               │
                 Public Subnets (Multi-AZ)
                               │
               Auto Scaling Group (EC2)
        ┌──────────────────┴──────────────────┐
        │                                     │
   Private App Subnet A                 Private App Subnet B
        │                                     │
   EC2 App Server 01                    EC2 App Server 02
        │                                     │
        └──────────────┬──────────────────────┘
                       │
                 Amazon RDS (Private)
                       │
             Amazon S3 (Application Files)
                       │
────────────────────────────────────────────────────────────

Supporting Services

IAM Roles

AWS Systems Manager

CloudWatch

CloudTrail

AWS Backup

AWS KMS

Amazon EBS Encryption

🏗 Project Requirements

Your environment must include:

Component	Required
Amazon Linux 2023	✅
Amazon VPC	✅
Private Subnets	✅
Security Groups	✅
IAM Role	✅
Systems Manager	✅
CloudWatch Agent	✅
Encrypted EBS	✅
Auto Scaling	✅
Application Load Balancer	✅
AWS Backup	✅
CloudTrail	✅

📋 Phase 1 — Prepare the Environment

Verify the following already exist:

CloudNova-Prod-VPC
Public Subnets
Private Application Subnets
Internet Gateway
NAT Gateway
Route Tables
Security Groups

Review the networking configuration before launching compute resources.

📋 Phase 2 — Deploy the EC2 Infrastructure

Create a Launch Template.

Configuration:

Setting	Value
Name	CloudNova-Web-Template
AMI	Amazon Linux 2023 or CloudNova-Secure-AMI-v1
Instance Type	t3.micro
IAM Role	CloudNova-EC2-Role
Root Volume	20 GiB gp3
Encryption	Enabled

Launch the EC2 instances into the Private Application Subnets.

📋 Phase 3 — Configure IAM

Verify the EC2 instances use:

CloudNova-EC2-Role

Required permissions:

AmazonSSMManagedInstanceCore
CloudWatchAgentServerPolicy
Read-only access to required Amazon S3 resources (or a custom least-privilege policy)

Verify:

aws sts get-caller-identity

📋 Phase 4 — Configure Systems Manager

Confirm:

Managed Node is online.
Session Manager works.
Run Command executes successfully.

Execute:

hostname

df -h

uptime

📋 Phase 5 — Secure Storage

Verify:

Encrypted EBS
AWS KMS
Snapshot capability

Create:

CloudNova-Production-Backup

Verify encryption remains enabled.

📋 Phase 6 — Configure Monitoring

Install the CloudWatch Agent.

Verify:

CPU
Memory
Disk
Network

Create CloudWatch Alarms:

Metric	Threshold
CPU	>80%
Disk	>90%
Status Checks	Failed

📋 Phase 7 — Configure Logging

Review CloudTrail.

Verify:

RunInstances
StopInstances
CreateSnapshot
ModifyInstanceAttribute

Record:

Event Time
User
Resource

📋 Phase 8 — Configure Backup

Create:

Daily Backup Plan

02:00 AM

Retention:

30 Days

Assign:

EC2 Instance
EBS Volumes

📋 Phase 9 — Configure Auto Scaling

Create:

Setting	Value
Minimum	2
Desired	2
Maximum	6

Scaling Policy:

CPU >70%

↓

Launch New Instance

Scale-In Policy:

CPU <30%

↓

Remove Instance

📋 Phase 10 — Validate Security

Verify every server has:

✅ Private IP

✅ No Public IP

✅ IAM Role

✅ Session Manager

✅ Encrypted Storage

✅ CloudWatch Agent

✅ Backup Enabled

✅ Correct Security Group

🛠 Project Tasks

Complete the following tasks.

Task 1 — Launch Secure EC2 Instances

Deploy:

CloudNova-App-Server-01

CloudNova-App-Server-02

Requirements:

Amazon Linux 2023
Private Subnet
IAM Role
Encrypted Storage
Enterprise Tags

Task 2 — Verify IAM

Run:

aws sts get-caller-identity

Confirm:

Assumed Role

is displayed.

Task 3 — Verify Systems Manager

Connect using:

Session Manager

Run:

hostname

whoami

uptime

Task 4 — Verify Storage

Review:

Encrypted EBS
Snapshots
AWS KMS Key

Task 5 — Verify Monitoring

Confirm:

CloudWatch Dashboard displays:

CPU
Memory
Disk
Network

Task 6 — Verify Logging

Review CloudTrail events for:

EC2 Launch
Snapshot Creation
IAM Role Association

Task 7 — Verify Backup

Review:

AWS Backup

↓

Protected Resources

Confirm successful backup jobs.

Task 8 — Verify Auto Scaling

Terminate one EC2 instance from the Auto Scaling Group.

Observe:

Health Check Failure
Automatic Replacement
New Instance Registration
Load Balancer Health

💻 AWS CLI Lab

Describe EC2 Instances

aws ec2 describe-instances

Describe Volumes

aws ec2 describe-volumes

Describe IAM Identity

aws sts get-caller-identity

Describe Managed Nodes

aws ssm describe-instance-information

Describe CloudWatch Alarms

aws cloudwatch describe-alarms

Describe Auto Scaling Groups

aws autoscaling describe-auto-scaling-groups

Describe Backup Jobs

aws backup list-backup-jobs

Describe CloudTrail Events

aws cloudtrail lookup-events

📊 Project Deliverables

Document the following evidence.

Evidence	Required
VPC Architecture	✅
EC2 Dashboard	✅
Security Groups	✅
IAM Role	✅
Session Manager	✅
CloudWatch Dashboard	✅
CloudTrail Events	✅
AWS Backup	✅
Auto Scaling Group	✅
Application Load Balancer	✅
Encrypted EBS	✅
Snapshots	✅
AWS CLI Output	✅

📁 Suggested Project Folder Structure

Enterprise-EC2-Build-Project/

├── README.md
├── Architecture/
│   ├── Architecture-Diagram.png
│   ├── Network-Diagram.png
│   └── Security-Architecture.png
│
├── Screenshots/
│   ├── EC2.png
│   ├── IAM-Role.png
│   ├── Session-Manager.png
│   ├── CloudWatch.png
│   ├── CloudTrail.png
│   ├── Backup.png
│   ├── AutoScaling.png
│   └── LoadBalancer.png
│
├── Evidence/
│   ├── CLI-Commands.md
│   ├── Validation-Checklist.md
│   └── Security-Review.md
│
└── Lessons-Learned.md

✅ Project Validation Checklist

Validation Item	Status
Private Subnets Used	☐
No Public IPs	☐
IAM Role Attached	☐
Session Manager Operational	☐
EBS Encryption Enabled	☐
CloudWatch Agent Installed	☐
CloudWatch Alarms Configured	☐
CloudTrail Enabled	☐
AWS Backup Configured	☐
Auto Scaling Operational	☐
Load Balancer Healthy	☐
Security Groups Reviewed	☐
EC2 Instances Patched	☐

🏆 Project Success Criteria

Your project is complete when:

Two secure EC2 instances are deployed.
All instances use IAM Roles.
Storage is encrypted.
Session Manager replaces SSH for administration.
Monitoring and logging are operational.
Automated backups are configured.
Auto Scaling is functional.
The Application Load Balancer distributes traffic successfully.
The environment complies with CloudNova’s enterprise security standards.

🌟 Bonus Challenges

Challenge 1 — Blue/Green Deployment

Create a second Launch Template using an updated AMI and perform a blue/green deployment with minimal downtime.

Challenge 2 — Harden the Security Groups

Review all Security Groups and remove any unnecessary inbound or outbound rules while ensuring application functionality.

Challenge 3 — Create a Custom CloudWatch Dashboard

Build a dashboard displaying:

CPU Utilisation
Memory Usage
Disk Usage
Network Traffic
Auto Scaling Activity
EC2 Health Checks

Challenge 4 — Simulate Disaster Recovery

Create a manual EBS Snapshot.
Simulate the loss of an application server.
Restore the snapshot.
Launch a replacement EC2 instance.
Verify the application can be recovered successfully.

💡 What You’ve Learned

Congratulations!

By completing this project, you have applied the complete EC2 security lifecycle used in enterprise environments.

You have successfully demonstrated practical experience with:

Secure EC2 deployment
IAM Roles and least privilege
Amazon EBS encryption and AWS KMS
AWS Systems Manager and Session Manager
EC2 hardening and patch management
Amazon CloudWatch monitoring
AWS CloudTrail auditing
AWS Backup and disaster recovery
Auto Scaling Groups
Application Load Balancers
Enterprise security validation

These are the same core skills expected of Cloud Engineers, Cloud Security Engineers and DevSecOps professionals working with production AWS environments.

🚀 Next Lesson

➡️ Lesson 12 — Module Review