Lion Cipher Lab

Audit compliance with AWS Config (your own account: rules, noncompliant findings, remediation)

• Cloud Security
• Beginner
• ~50 min
• Free · no account required

Why it matters

In security, getting a setting right once is not the job -- keeping it right forever is. A bucket you made private in January can be flipped public by a teammate in March; a firewall you locked down can be widened by a script next week. That silent slide of a resource out of its intended, approved state is called config DRIFT, and it is where a huge share of real cloud breaches actually begin: not a clever exploit, but a control that quietly stopped being true and nobody noticed. COMPLIANCE is the discipline of continuously checking that your resources still match the rules you decided they…

What you'll learn

• what compliance means in the cloud: continuously checking that resources stay configured the way a policy says they should be, not just once but forever
• what AWS Config is -- a service that records the configuration of your resources and evaluates it against rules -- and what a configuration item and the configuration recorder are
• what a managed rule is: a ready-made check AWS ships (like s3-bucket-public-read-prohibited or restricted-ssh) that you switch on instead of writing
• reading an evaluation result: COMPLIANT means the resource meets the rule, NONCOMPLIANT means it breaks the rule and needs attention
• what config drift is -- a resource silently changing out of its intended, policy-approved state -- and how a rule catches it automatically
• deliberately creating a NONCOMPLIANT resource (a publicly readable S3 bucket, a security group with SSH open to the world) and watching Config flag it
• what remediation is: fixing the finding by correcting the resource, then re-evaluating the rule and seeing it flip back to COMPLIANT
• the honest cost of AWS Config (small per-configuration-item and per-evaluation charges, no free tier) and how to turn everything off so it stops billing, on an account you own

Steps in this lab

1. Read this first: your own account, a small REAL cost, turn it all off when done
2. What compliance, a config rule, compliant/noncompliant, and drift mean
3. Sign in to your AWS account (and secure the root login)
4. Understand the Region and the cost meter before you enable anything
5. Turn on AWS Config (set up the recorder and delivery)
6. Switch on two managed rules
7. Create two resources that break the rules -- and watch them go NONCOMPLIANT
8. Read a noncompliant finding
9. Remediate one finding, then re-evaluate and watch it flip to COMPLIANT
10. Clean up: delete the rules, STOP the recorder, and remove everything
11. Why this loop makes you a cloud compliance defender

Open the full interactive lab →