Lesson 05 — Enterprise Vulnerability & Compliance Project & Module Review

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 09 – Vulnerability & Compliance Management

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Build an enterprise vulnerability management programme.
Perform an organisation-wide compliance assessment.
Identify and prioritise security risks.
Implement automated remediation processes.
Produce executive security and compliance reports.
Demonstrate the day-to-day responsibilities of a Cloud Security Engineer.

📚 Lesson Information

Estimated Time: 5 Hours

Difficulty: Advanced

Prerequisites: Lessons 01–04

Hands-on Project: Yes

💼 Business Scenario

CloudNova Technologies is preparing for its annual external security audit.

The organisation operates:

60 AWS Accounts
1,500 Amazon EC2 Instances
500 Amazon ECR Repositories
800 AWS Lambda Functions
10,000 Amazon S3 Buckets
Hundreds of IAM Roles
Multi-Region AWS Infrastructure

The audit requires compliance with:

CIS AWS Foundations Benchmark
AWS Foundational Security Best Practices
PCI DSS
ISO 27001

Recent assessments reveal:

Critical EC2 vulnerabilities
Public Amazon S3 buckets
Sensitive customer data stored without proper classification
Excessive IAM permissions
Missing security patches
Non-compliant Security Groups
Configuration drift
Outdated container images

The CISO asks one final question before the audit begins.

“Can we prove that our AWS environment is continuously monitored, compliant and capable of responding quickly to newly discovered vulnerabilities?”

As the Cloud Security Engineer, your task is to perform a complete enterprise vulnerability assessment, prioritise risks, implement remediation and produce executive-level compliance reports.

🏗 Project Overview

Throughout this capstone project you will implement:

Amazon Inspector
AWS Systems Manager Patch Manager
IAM Access Analyzer
Amazon Macie
AWS Config
AWS Config Rules
Conformance Packs
AWS Security Hub

This project combines everything learned throughout Module 09.

Enterprise Security Architecture

                     AWS Organizations
                            │
      ┌─────────────────────┼─────────────────────┐
      │                     │                     │
 Production          Development         Shared Services
      │                     │                     │
 Amazon Inspector     Inspector         Inspector
      │                     │                     │
 AWS Systems Manager Patch Manager
      │
 IAM Access Analyzer
      │
 Amazon Macie
      │
 AWS Config
      │
 Security Hub
      │
 CloudWatch / EventBridge
      │
 SOC Team
      │
 Executive Dashboard

Phase 01 — Enterprise Asset Discovery

Create an inventory of:

Amazon EC2
Amazon EBS
Amazon RDS
Amazon S3
Amazon ECR
AWS Lambda
IAM Roles
VPC Resources

Classify assets according to:

Business Criticality
Internet Exposure
Data Classification
Compliance Requirements

Deliverable:

Enterprise Asset Inventory.

Phase 02 — Vulnerability Assessment

Enable Amazon Inspector.

Review:

EC2 Findings
Container Image Findings
Lambda Findings
Critical CVEs
High-Risk Packages

Prioritise findings based on:

CVSS Score
Business Impact
Internet Exposure
Exploit Availability

Deliverable:

Enterprise Vulnerability Report.

Phase 03 — Patch Management

Configure AWS Systems Manager Patch Manager.

Create:

Patch Baselines
Maintenance Windows
Patch Groups

Validate:

Patch Compliance
Missing Updates
Successful Patch Installation

Deliverable:

Patch Management Plan.

Phase 04 — Identity & Data Security Review

Review IAM Access Analyzer findings.

Investigate:

Public Resources
Cross-Account Access
External Principals
Broad IAM Policies

Enable Amazon Macie.

Review:

Sensitive Data Discovery
PII Findings
Public Buckets
Missing Encryption

Deliverable:

Identity & Data Security Assessment.

Phase 05 — Compliance Assessment

Enable AWS Config.

Deploy:

AWS Config Rules
Conformance Packs

Review:

Configuration Drift
Non-Compliant Resources
Failed Controls

Enable AWS Security Hub.

Review:

Compliance Standards
Security Findings
Risk Dashboard

Deliverable:

Compliance Assessment Report.

Enterprise Compliance Validation

Validate the following controls.

Security Control	Status
Amazon Inspector Enabled	☐
Patch Manager Configured	☐
Patch Baselines Created	☐
Maintenance Windows Configured	☐
IAM Access Analyzer Enabled	☐
Amazon Macie Enabled	☐
AWS Config Enabled	☐
Config Rules Deployed	☐
Conformance Packs Applied	☐
Security Hub Enabled	☐
Compliance Standards Enabled	☐

Enterprise Security Findings

During the project, CloudNova identifies the following findings.

Finding 1

Critical CVE

Resource:

Production EC2

Expected Action

✅ Prioritise remediation.

✅ Patch immediately.

Finding 2

Public Amazon S3 Bucket

Expected Action

✅ Remove public access.

✅ Enable S3 Block Public Access.

Finding 3

IAM Role with AdministratorAccess

Expected Action

✅ Replace with least-privilege policy.

Finding 4

Customer PII Found

Detected by:

Amazon Macie

Expected Action

✅ Restrict access.

✅ Enable encryption.

Finding 5

Unencrypted EBS Volume

Expected Action

✅ Create encrypted replacement volume.

Finding 6

Security Group Allows 0.0.0.0/0 on Port 22

Expected Action

✅ Restrict SSH access.

Investigation Tasks

For every finding determine:

Severity
Business Impact
Root Cause
Recommended Fix
Responsible Team
Expected Completion Date
Validation Method

Document your investigation.

Deliverables

Prepare the following enterprise documentation.

Executive Vulnerability Assessment

Include:

Critical Findings
High Findings
Medium Findings
Risk Ratings
Recommended Actions

Compliance Report

Summarise:

Overall Compliance Score
Failed Controls
Security Standards
Audit Readiness

Patch Management Report

Include:

Missing Patches
Patch Success Rate
Maintenance Schedule
Outstanding Issues

Identity Security Review

Document:

Excessive IAM Permissions
Cross-Account Access
Public Resources
Access Review Results

Data Protection Assessment

Include:

Sensitive Data Locations
Macie Findings
Encryption Status
Data Classification

Executive Dashboard

Present:

Total Findings
Critical Findings
Compliance Percentage
Patch Compliance
High-Risk Assets
MTTR (Mean Time to Remediate)
Risk Trend

🛠 Capstone Lab

Task 1

Enable:

Amazon Inspector
Patch Manager

Review:

Vulnerabilities
Patch Compliance

Task 2

Enable:

IAM Access Analyzer

Review:

Public Resources
External Access
IAM Roles

Task 3

Enable:

Amazon Macie

Review:

Sensitive Data Discovery
PII Findings
Bucket Classification

Task 4

Deploy:

AWS Config
Config Rules
Conformance Packs

Review compliance.

Task 5

Enable:

AWS Security Hub

Review:

Overall Security Score
Compliance Dashboard
Critical Findings

Task 6

Prepare an Executive Security Report including:

Current Risk Level
Compliance Status
Priority Vulnerabilities
Remediation Plan
Executive Recommendations

💻 AWS CLI Challenge

List Amazon Inspector Findings

aws inspector2 list-findings

List Patch Baselines

aws ssm describe-patch-baselines

List Maintenance Windows

aws ssm describe-maintenance-windows

List Access Analyzer Findings

aws accessanalyzer list-findings \
    --analyzer-name CloudNovaAnalyzer

List Macie Findings

aws macie2 list-findings

View Config Rules

aws configservice describe-config-rules

View Security Hub Findings

aws securityhub get-findings

🏢 Enterprise Best Practices

CloudNova standards include:

Maintain an accurate enterprise asset inventory.
Continuously scan workloads for vulnerabilities.
Prioritise remediation using business risk.
Test patches before production deployment.
Apply least-privilege principles.
Protect sensitive data using encryption and classification.
Continuously monitor configuration compliance.
Automate security reporting.
Review executive security dashboards weekly.
Integrate vulnerability management into CI/CD pipelines.

🚫 Common Mistakes

❌ Treating vulnerability scanning as a quarterly activity.

❌ Delaying remediation of Internet-facing systems.

❌ Ignoring excessive IAM permissions.

❌ Storing confidential information without encryption.

❌ Deploying infrastructure without Config Rules.

❌ Ignoring Security Hub findings.

❌ Performing compliance reviews only before audits.

🧪 Final Enterprise Challenge

CloudNova is preparing for an international audit covering ISO 27001, PCI DSS and SOC 2.

Design a complete enterprise vulnerability and compliance programme that:

Continuously scans EC2, ECR and Lambda workloads.
Automates operating system patching.
Detects public and cross-account resource exposure.
Discovers sensitive customer information.
Continuously monitors AWS resource compliance.
Produces executive dashboards for leadership.
Integrates all findings into Security Hub.
Supports future growth across multiple AWS Regions and AWS Organizations.

Prepare the following documents:

Enterprise Security Architecture
Asset Inventory
Vulnerability Assessment Report
Patch Management Plan
Identity & Access Review
Data Classification Report
Compliance Dashboard
Executive Risk Report
Remediation Roadmap

📊 Module Review

Congratulations!

You have completed Module 09 – Vulnerability & Compliance Management.

You can now:

✅ Build enterprise vulnerability management programmes

✅ Perform continuous EC2, Lambda and container vulnerability assessments

✅ Automate patch management

✅ Identify excessive IAM permissions

✅ Discover sensitive information stored in Amazon S3

✅ Continuously monitor AWS compliance

✅ Build executive security dashboards

✅ Prepare organisations for enterprise security audits

📚 Knowledge Check

What is the purpose of Amazon Inspector?
How does Patch Manager improve enterprise security?
What does IAM Access Analyzer detect?
What type of information can Amazon Macie discover?
Why is AWS Config important for compliance?
What is configuration drift?
How does AWS Security Hub improve visibility?
Why should organisations prioritise vulnerabilities based on business impact?
How do these AWS services work together to improve security posture?
Why is continuous compliance monitoring more effective than periodic security assessments?

💡 Key Takeaways

After completing this module, you should understand:

Vulnerability management is an ongoing process that combines continuous discovery, risk assessment, remediation and validation.
Amazon Inspector and AWS Systems Manager Patch Manager help identify and remediate software vulnerabilities across EC2 instances, container images and Lambda functions.
IAM Access Analyzer and Amazon Macie strengthen identity governance and data protection by detecting unintended access and sensitive data exposure.
AWS Config and AWS Security Hub provide continuous compliance monitoring and a centralised view of security findings across AWS accounts.
Enterprise Cloud Security Engineers must not only secure cloud infrastructure but also demonstrate compliance, reduce organisational risk and communicate security posture effectively to technical teams, auditors and executive leadership.

🎓 Module Complete

Excellent work!

You have successfully completed Module 09 – Vulnerability & Compliance Management.

You now have the knowledge and practical skills to assess, prioritise, remediate and continuously monitor security risks across enterprise AWS environments using AWS-native security services.

🚀 Next Module

➡️ Module 10 — Backup, Disaster Recovery & Business Continuity

In the next module, you will learn how to:

Design resilient backup strategies using AWS Backup
Protect workloads against accidental deletion and ransomware
Implement cross-Region and cross-account backups
Design Disaster Recovery (DR) architectures
Calculate RPO (Recovery Point Objective) and RTO (Recovery Time Objective)
Build Business Continuity Plans (BCP)
Test backup restoration and disaster recovery procedures

You will move from protecting and monitoring cloud workloads to ensuring business resilience and rapid recovery, a critical responsibility for every Cloud Security Engineer.