Projects & Experience
Six AWS security projects, each fully deployed with Terraform and unit-tested with pytest + moto. No live AWS account required to run the test suite.
GuardDuty Threat Detection & Auto-Remediation
Event-driven pipeline that takes a GuardDuty finding from detection to containment without human intervention. EventBridge routes findings to a Lambda that isolates compromised EC2 instances, revokes IAM credentials, creates forensic EBS snapshots, and fires dual-channel alerts — all in seconds.
- EC2 quarantine: all security groups replaced with a zero-ingress/egress SG
- IAM revocation: access key disabled + deny-all inline policy attached
- Forensic snapshots of all EBS volumes before containment
- Severity threshold + per-action feature flags (independently togglable)
- SNS + Slack dual-channel notification with structured finding detail
AWS Secure VPC
Production-hardened multi-AZ VPC with layered network controls and real-time threat monitoring. The foundational network that all other projects deploy into.
- Dual-layer firewall: stateless NACLs + stateful Security Group referencing
- VPC Flow Logs split into accepted / rejected streams for faster queries
- CloudWatch metric filters detecting SSH brute-force and port-scan patterns
- Bastion host with SSH agent forwarding — private key never leaves the engineer
AWS WAF — Web Application Firewall
WAFv2 protecting an API Gateway HTTP API with five managed rule groups. Chose API Gateway over ALB to save ~$18/month — same WAF capability, fraction of the cost.
- OWASP Core, SQLi, and Known Bad Inputs (Log4Shell / SSRF) rule groups
- Per-IP rate limiting: 2,000 req / 5-minute window
- Custom IP blocklist — operator-managed, zero-downtime updates
- CloudWatch WAF logging (vs Kinesis Firehose — saves ~$10/mo at demo volumes)
AWS Inspector v2 — CVE Scanning
Continuous EC2 vulnerability scanning via SSM Agent — no open ports, no manual installs. HIGH and CRITICAL findings route to Lambda for automated tagging and alerting.
- Inspector v2 communicates via SSM Agent (agentless from the operator's perspective)
- Tags affected instances: severity, CVE ID, finding type, last-scanned timestamp
- Severity label mapping across all 5 bands (CRITICAL → INFORMATIONAL)
- Max CVSS score extracted from multiple scoring vectors per finding
AWS Macie + KMS — PII Classification
Automated PII discovery and quarantine for S3 data. Macie runs weekly classification jobs; Lambda quarantines flagged objects by copying to an isolated bucket and deleting the original.
- Weekly scheduled scans (not continuous — ~10× cheaper at scale)
- Custom identifiers: AWS account numbers, internal employee IDs
- Quarantine: copy to isolated bucket → delete original → tag with finding metadata
- Single rotating KMS CMK shared across all S3 buckets ($1/mo vs $4/mo)
AWS IAM Security Lab
Multi-account IAM security controls co-authored with SamsonIdowu at Innopolis University. Covers permission boundaries, Service Control Policies, IAM roles, and least-privilege policy design across AWS Organizations.
- SCPs enforced at Organizations level — denials no account-level policy can override
- Permission boundaries limit the maximum permissions any role can self-assign
- Least-privilege policies scoped to specific resources, regions, and principal tags
- CloudTrail + CloudWatch alarms for unauthorized API call detection and audit