16. Live Project: Building a Reels App with EC2, S3 and RDS
16.13 Security Checklist: The Target You Will Secure
Ha app aata tumcha "practice target" aahe. Pudhchya parts madhe aapan yavar Nmap, Burp Suite aani sqlmap chalvun bagnar aahot – fakt tumchya swatahchya server var. Aadhi defender mhanun checklist puri kara.
| Area | Control in this project | Status |
|---|---|---|
| Network | web-sg: 22 from your IP only, 80/443 open; RDS private, 3306 from web-sg only |
☐ |
| Identity | IAM role scoped to s3:PutObject/GetObject on videos/*; IMDSv2 required; no access keys on disk |
☐ |
| S3 | Block Public Access ON, DenyInsecureTransport, versioning, default encryption, presigned URLs ≤ 20 min | ☐ |
| RDS | Encryption, TLS (db_ssl_ca), least-privilege reels_app, backups, deletion protection |
☐ |
| Transport | HTTPS with Certbot, HTTP→HTTPS redirect, HSTS, Secure cookies |
☐ |
| Auth | password_hash, generic login error, session regeneration, HttpOnly/SameSite cookies |
☐ |
| Input | Prepared statements, finfo MIME allow-list, size limits, colour allow-list |
☐ |
| Output | htmlspecialchars in PHP, textContent in JS, CSP, nosniff, X-Frame-Options |
☐ |
| Server | Web root = public/, config.php 640, server_tokens off, expose_php Off, hidden files denied |
☐ |
| Operations | yum update/apt upgrade regularly, composer audit, logs reviewed, RDS snapshots |
☐ |
Improvements for later chapters (good exercises once you learn the attacks): rate limiting on login.php (Nginx limit_req or fail2ban), account lockout alerts, deleting posts (with ownership checks to prevent IDOR), direct browser-to-S3 uploads with presigned PUT URLs, CloudFront in front of S3, video transcoding, and CloudWatch alarms.
Why this matters for security
A checklist turns "I think it is secure" into evidence. In real jobs, a cloud security review or a penetration test report is exactly this table with findings and fixes. Keep yours – in the Kali and OWASP parts you will attack each row and prove that the control works.
Ravindra Bagale's Tip
Project chalu zala ki students lagech LinkedIn var link share kartat – checklist purna na karta! Aadhi pratyek row tick kara, mag share kara. Aani GitHub var code push karnar asal tar config.php .gitignore madhe taka – password public repo madhe gela ki bots to khup lavkar shodhtat.
Lab
Go through the checklist on your live app and tick every row with proof (a command, a screenshot or a config line). Add config.php and vendor/ to .gitignore and push the project to a private GitHub repository.
Thodkyaat sangaycha tar
- Three tiers: EC2 (Nginx + PHP-FPM) → S3 for videos (private) and RDS for data (private); the browser plays videos from S3 through short presigned URLs.
- The EC2 IAM role replaces access keys; the S3 client is created with no credentials; IMDSv2 required.
- Only
public/is the web root;config.php,src/,vendor/stay outside it. - Upload: CSRF → size →
finfoMIME allow-list → random key →putObject→ prepared INSERT. - Feed: cursor pagination, selected fields only, presigned URL per video; UI with scroll-snap and IntersectionObserver.
- Check every file with
php -l, test configs withnginx -t, add HTTPS + HSTS + CSP, and finish the security checklist.
Samjla ka? Tumhi aata ek purna cloud app banavla aahe – he khup mothi goshta aahe, mitrano! Nasel samjla tar 16.1 cha diagram punha bagha. Aata pudhe jaauya – he sagla Kali Linux chya aadhi ka shikla, te samjuya.