Week 5 Worklog

Week 5 Objectives:

  • Build a foundation in resource governance with AWS Tags and Resource Groups for organizing, querying, and automating actions across many resources.
  • Strengthen IAM least privilege with tag-based access control for EC2 and Permission Boundaries that cap the maximum permissions of users.
  • Practice encryption at rest for Amazon S3 using AWS KMS, combined with AWS CloudTrail and Amazon Athena to audit key usage.
  • Get started with AWS Security Hub to centralize security findings and run continuous compliance checks against AWS best practices.
  • Optimize operations and cost with Lambda-based EC2 start/stop automation and Grafana monitoring dashboards on EC2.

Tasks to be carried out this week:

DayTaskStart DateCompletion DateReference Material
2- Practice Tags & Resource Groups:
  + Apply tags to EC2/S3 and other resources
  + Create a tag-based Resource Group
  + Use the group to manage and automate actions
  + Clean up resources		18/05/202618/05/2026Tags & Resource Groups
3- Practice IAM tag-based access control for EC2:
  + Create IAM policy with Condition on resource tags
  + Create IAM role for an EC2 Administrator persona
  + Validate least-privilege behavior
- Practice IAM Permission Boundary:
  + Create restriction policy as a boundary
  + Create a bounded IAM user
  + Verify the effective permissions and clean up		19/05/202619/05/2026IAM with Resource Tags
IAM Permission Boundary
4- Practice Encrypt at rest with AWS KMS:
  + Prepare IAM users/roles for the lab
  + Create a KMS Customer Managed Key (CMK)
  + Create an S3 bucket and enable SSE-KMS
  + Configure CloudTrail and query KMS events with Athena
  + Test sharing encrypted objects and clean up		20/05/202620/05/2026Encrypt at Rest with AWS KMS
5- Practice AWS Security Hub:
  + Review supported security standards
  + Enable Security Hub and integrations
  + Read the security score and findings by standard
  + Clean up resources		21/05/202621/05/2026AWS Security Hub
6- Practice Optimize EC2 cost with Lambda:
  + Tag instances by start/stop schedule
  + Create IAM role for Lambda
  + Author Lambda function and trigger via EventBridge
  + Verify start/stop and clean up
- Practice Grafana basics on EC2:
  + Provision a Linux EC2 instance
  + Install and configure Grafana
  + Add data source and build a dashboard to monitor resources
  + Clean up		22/05/202622/05/2026Optimize EC2 Cost with Lambda
Grafana Basic

Week 5 Achievements:

  • Understood the role of Tags as metadata for organizing AWS resources by purpose, owner, environment, or cost center, and applied a consistent tagging convention across EC2 and S3 resources.

  • Created a Resource Group based on tag query to manage many resources as a single logical unit and reviewed how Resource Groups support automation across services.

  • Applied the principle of least privilege in IAM by writing a policy with Condition blocks that grant EC2 actions only when the target resource carries a specific tag, and validated the behavior with an EC2 Administrator role.

  • Configured an IAM Permission Boundary to cap the maximum permissions of a user, observed how the effective permissions are the intersection of the identity policy and the boundary, and used the pattern to mitigate privilege escalation risks.

  • Created an AWS KMS Customer Managed Key (CMK) with appropriate key policies and used it to enable SSE-KMS encryption on an Amazon S3 bucket for data protection at rest.

  • Enabled AWS CloudTrail to capture KMS and S3 events and queried the trail logs with Amazon Athena to audit who used the key, when, and against which objects.

  • Practiced sharing encrypted S3 objects across IAM principals while keeping key access controlled through KMS grants and key policies, and completed full cleanup of KMS, S3, CloudTrail and Athena artifacts.

  • Enabled AWS Security Hub and reviewed supported standards (e.g., AWS Foundational Security Best Practices, CIS) to get a centralized view of high-priority findings across services.

  • Read the security score by standard, drilled into failed controls, and understood how Security Hub aggregates findings from sources such as GuardDuty, Inspector, and Macie into a single dashboard.

  • Built an EC2 cost optimization workflow with AWS Lambda: tagged instances with start/stop schedules, created a Lambda execution role with ec2:StartInstances and ec2:StopInstances, and authored a function to act on tagged instances.

  • Verified the start/stop logic by triggering the Lambda manually and on a schedule, confirming that only tagged instances were affected, and cleaned up the function, role, and policies after the lab.

  • Provisioned a Linux EC2 instance as a Grafana host, installed and configured Grafana server, and exposed the dashboard through the appropriate security group.

  • Connected Grafana to a metrics data source, built a basic monitoring dashboard for compute and infrastructure metrics, and removed the EC2 instance and supporting resources at the end of the lab.

  • Reinforced the cleanup discipline at the end of every workshop to keep AWS bills predictable and the practice account tidy.