Lion Cipher Lab
Restrict access with AWS security groups (your own free-tier EC2 instance)
- Cloud Security
- Beginner
- ~50 min
- Free · no account required
Why it matters
The moment you put a computer on the internet, the whole internet can try to reach it -- and in the cloud, standing up a server that faces the internet is a few clicks. What stops the world from walking straight into that server is a firewall: a rule set that decides which network traffic is allowed to reach it and which is dropped. In AWS the firewall wrapped around each instance is called a SECURITY GROUP, and misconfiguring it is one of the most common and most exploited mistakes in all of cloud security. The signature version is 'SSH open to the world': the remote-login port left…
What you'll learn
- what a cloud server is: an EC2 instance is a virtual computer AWS runs for you in a data center, rented by the hour
- what a security group is -- the virtual firewall wrapped around an instance that decides which network traffic is allowed in and out
- reading a security group rule: protocol, port, and source -- and what a port (like 22 for SSH) actually is
- understanding CIDR notation and the address 0.0.0.0/0 -- the way a rule says 'the entire internet, every IP address that exists'
- seeing the classic 'SSH open to the world' mistake in a real console and understanding exactly why it is dangerous
- finding your own public IP address and writing it as a /32 so a rule allows only you
- applying least privilege to a firewall: allow only the source that needs access, only on the port that is needed, and nothing else
- verifying a lockdown worked, and cleaning up safely by terminating the instance and deleting the key pair so no charges accrue, on an account you own
Steps in this lab
- Read this first: your own account, free-tier only, terminate when done
- What EC2, an instance, and a security group are
- What a port, a protocol, CIDR, and 0.0.0.0/0 mean
- Sign in to a free-tier AWS account (and secure the root login)
- Find your own public IP address (you will need it to lock down)
- Launch one tiny free-tier EC2 instance
- Look at the over-permissive rule -- SSH open to the world
- Lock it down: allow SSH only from your own IP
- Verify the lockdown worked
- Clean up: terminate the instance and delete the key
- Why this one habit makes you a cloud network defender