45. Practice Exercises with Hints
45.5 Domains, S3, RDS and Project Checklist
DNS A/CNAME, HTTPS (Certbot), S3 Block Public Access, RDS not public, IAM role not long-lived keys – Part 6–8 revise.
| Exercise | Task | Hint |
|---|---|---|
| E1 | List DNS records needed for www + apex for a site on EIP |
A for apex (and/or www); CNAME www→apex common pattern – UI varies |
| E2 | S3: turn on Block Public Access; explain one risk if off | Accidental public object ACL / policy → data leak class |
| E3 | RDS: three checks before go-live | Not publicly accessible; SG from EC2 SG only; backups on |
| E4 | Project checklist: IAM role on EC2 vs access keys in PHP | Role + instance profile; no keys in code / git |
| E5 | Presigned URL idea in two lines (reels project) | Temporary access to private object; expiry matters |
| E6 | HTTPS: why HTTP login form is unacceptable | Credentials / cookies in clear on path – TLS required |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Scrapes open S3 buckets / guesses object names | BPA; private ACLs; CloudTrail / access logs; least privilege |
| Connects to public RDS from internet | PubliclyAccessible false; SG lockdown; rotate creds if exposed |
Ravindra Bagale's Tip
Students "bucket private aahe" mhantat pan object ACL public. Checklist: BPA + policy + object. Lakshat theva.
Lab
OWN account: create bucket sahyadri-lab-UNIQUE, enable BPA, upload a test object, confirm public URL fails. Delete bucket when done (empty first). Notes: 5 ticks checklist.
Real incident: Capital One (2019)
Public reporting described an attacker obtaining data from cloud storage after abusing a misconfigured WAF / SSRF-class path to reach instance metadata credentials, then listing and reading S3 data (as reported in court documents and major press). Weakness themes: SSRF to metadata + overly powerful role + broad bucket access. Defence for this drill: IMDSv2, least-privilege IAM, BPA, no unnecessary public. Source: US DOJ reporting and contemporaneous major coverage (verify; say "reported" for scale).