| Day | Task | Start Date | Completion Date | Reference Material |
|---|---|---|---|---|
| 2 | - Practice Tags & Resource Groups: + Apply tags to EC2/S3 and other resources + Create a tag-based Resource Group + Use the group to manage and automate actions + Clean up resources | 25/05/2026 | 25/05/2026 | Tags & Resource Groups |
| 3 | - Practice IAM tag-based access control for EC2: + Create IAM policy with Condition on resource tags+ Create IAM role for an EC2 Administrator persona + Validate least-privilege behavior - Practice IAM Permission Boundary: + Create restriction policy as a boundary + Create a bounded IAM user + Verify the effective permissions and clean up | 26/05/2026 | 26/05/2026 | IAM with Resource Tags IAM Permission Boundary |
| 4 | - Practice Encrypt at rest with AWS KMS: + Prepare IAM users/roles for the lab + Create a KMS Customer Managed Key (CMK) + Create an S3 bucket and enable SSE-KMS + Configure CloudTrail and query KMS events with Athena + Test sharing encrypted objects and clean up | 27/05/2026 | 27/05/2026 | Encrypt at Rest with AWS KMS |
| 5 | - Practice AWS Security Hub: + Review supported security standards + Enable Security Hub and integrations + Read the security score and findings by standard + Clean up resources | 28/05/2026 | 28/05/2026 | AWS Security Hub |
| 6 | - Practice Optimize EC2 cost with Lambda: + Tag instances by start/stop schedule + Create IAM role for Lambda + Author Lambda function and trigger via EventBridge + Verify start/stop and clean up | 29/05/2026 | 29/05/2026 | Optimize EC2 Cost with Lambda |
Understood the role of Tags as metadata for organizing AWS resources by purpose, owner, environment, or cost center, and applied a consistent tagging convention across EC2 and S3 resources.
Created a Resource Group based on tag query to manage many resources as a single logical unit and reviewed how Resource Groups support automation across services.
Applied the principle of least privilege in IAM by writing a policy with Condition blocks that grant EC2 actions only when the target resource carries a specific tag, and validated the behavior with an EC2 Administrator role.
Configured an IAM Permission Boundary to cap the maximum permissions of a user, observed how the effective permissions are the intersection of the identity policy and the boundary, and used the pattern to mitigate privilege escalation risks.
Created an AWS KMS Customer Managed Key (CMK) with appropriate key policies and used it to enable SSE-KMS encryption on an Amazon S3 bucket for data protection at rest.
Enabled AWS CloudTrail to capture KMS and S3 events and queried the trail logs with Amazon Athena to audit who used the key, when, and against which objects.
Practiced sharing encrypted S3 objects across IAM principals while keeping key access controlled through KMS grants and key policies, and completed full cleanup of KMS, S3, CloudTrail and Athena artifacts.
Enabled AWS Security Hub and reviewed supported standards (e.g., AWS Foundational Security Best Practices, CIS) to get a centralized view of high-priority findings across services.
Read the security score by standard, drilled into failed controls, and understood how Security Hub aggregates findings from sources such as GuardDuty, Inspector, and Macie into a single dashboard.
Built an EC2 cost optimization workflow with AWS Lambda: tagged instances with start/stop schedules, created a Lambda execution role with ec2:StartInstances and ec2:StopInstances, and authored a function to act on tagged instances.
Verified the start/stop logic by triggering the Lambda manually and on a schedule via EventBridge, confirming that only tagged instances were affected, and cleaned up the function, role, and policies after the lab.
Reinforced the cleanup discipline at the end of every workshop to keep AWS bills predictable and the practice account tidy.