You’ve been hired to bring security controls to QryptoTremolo’s AWS accounts. The startup, which develops next-generation financial services, chose to develop and operate in AWS. QryptoTremolo’s development teams have had unfettered access to the AWS accounts, and ad hoc development has evolved organically, increasing the risk for security breaches. It’s up to you to lower this risk so that the company doesn’t end up on the front-page news…for the wrong reasons. Using CloudFormation, stack sets, and the AWS CLI, you’ll set up AWS Config with rules to preemptively discover resources that aren’t configured according to security best practices.

Enter course descriptionA string of high-profile security breaches has been featured recently on the news, and QryptoTremolo doesn’t want to be the next headline. You’ve been hired by the startup, which is developing a set of next-generation financial services, to lower the risk of breaches and bring security controls to its AWS accounts. Leveraging pytest and Boto, you’ll develop and deploy a custom Config rule to look for peculiar misconfigurations or conditions that aren’t covered by AWS’s off-the-self managed rules.

You’ve been hired by QryptoTremolo, a startup that’s been developing a set of next-generation financial services, to lower the risk of security breaches. The company has chosen to develop and operate in AWS. Its development teams have had unrestricted access to the AWS accounts, and ad hoc development has evolved organically, increasing the risk for security breaches. To uplevel security in these accounts, you’ll deploy CloudFormation templates and develop a suite of automated pytest tests to verify their configuration. Next, you’ll build a CI/CD CodeBuild pipeline that triggers on infrastructure changes and deploys and tests the changes across the organization. This change control automation will enable you to respond quickly—and confidently—to changing business needs.

QryptoTremolo, a startup that’s developing a set of next-generation financial services, has hired you to help upgrade its security. The company has set up an organizational AWS CloudTrail, which deposits all the events of QryptoTremolo’s AWS control plane, as well as some data plane, in an S3 bucket within the security account. But the events are stored in a form that doesn’t lend itself well to forensic queries. QryptoTremolo has chosen AWS Athena as a query-friendly solution. Your task is to configure AWS Athena to allow for sending advanced forensic queries to an S3 bucket filled with organizational CloudTrail events. You’ll learn how to create forensic SQL queries and issue them in a performant way across all accounts in the organization.

QryptoTremolo, a startup that’s been developing a set of next-generation financial services, has already taken steps to provide visibility into its AWS accounts and set up AWS GuardDuty to detect intruders. But managers of the development teams have administrator access to these accounts, and despite being a dangerous anti-pattern, that’s not going to change anytime soon. Your task is to automate the configuration of organizational service control policies that restrict access of local administrators (and intruders) to any AWS Config and EventBridge resources located in the AWS accounts. You’ll write code to query the IAM (Identity and Access Management) policy simulator in order to gauge API calls’ ability to tamper with resources. You’ll also develop end-to-end tests that prove whether an SCP change will behave as expected, and build a pipeline to codify the change control process for the SCP.