AWS Trusted Advisor

Hands-On

Demo

  1. Introduction to AWS Trusted Advisor
  2. Navigate to AWS Trusted Advisor Dashboard
  3. Create Security Group Violation
  4. Create EBS Snapshot Violation
  5. Create S3 Bucket Permission Violation
  6. Wait for Trusted Advisor to Show Violations
  7. Clean Up and Remediation
    • Close Security Group Port
    • Delete EBS Snapshot
    • Delete EBS Volume
    • Delete S3 Bucket
  8. Verify All Remediated in Trusted Advisor Dashboard

Agenda

VPC

IAM Group

Violation 1 : Create Open Port 22 on default security group

Security Groups

Add Rule

Violation 2 : Create EBS Public Snapshot Violation

# Create an EBS volume
VOLUME_ID=$(aws ec2 create-volume \
    --volume-type gp3 \
    --size 1 \
    --availability-zone us-east-1a \
    --query 'VolumeId' \
    --output text)
# Create a snapshot
SNAPSHOT_ID=$(aws ec2 create-snapshot \
    --volume-id $VOLUME_ID \
    --description "Test public snapshot" \
    --query 'SnapshotId' \
    --output text)
# Make snapshot public (VIOLATION #2)
aws ec2 modify-snapshot-attribute \
    --snapshot-id $SNAPSHOT_ID \
    --attribute createVolumePermission \
    --operation-type add \
    --group-names all

Violation 3 : Create S3 Bucket Permission Violation

# Create a bucket
BUCKET_NAME="test-bucket-${RANDOM}"
aws s3api create-bucket \
    --bucket $BUCKET_NAME \
    --region us-east-1
# Make bucket public (VIOLATION #3)
aws s3api put-public-access-block \
    --bucket $BUCKET_NAME \
    --public-access-block-configuration \
    "BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false"

# Add public read policy
cat << EOF > bucket-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::$BUCKET_NAME/*"
        }
    ]
}
EOF
aws s3api put-bucket-policy \
    --bucket $BUCKET_NAME \
    --policy file://bucket-policy.json

Wait and Check for Violations in Trusted Advisor Console

Clean Up and Remediation

Close the Security Group Port

Delete the Snapshot

Delete the Volume

Delete the S3 Bucket

All Remediated

Trusted Advisor Recommendations

🙏

Thanks

for

Watching

AWS Trusted Advisor - Hands-On Demo

By Deepak Dubey

AWS Trusted Advisor - Hands-On Demo

AWS Trusted Advisor - Hands-On Demo

  • 31

More from Deepak Dubey