Runbook 01 Secure a New AWS Account

Module: 01 AWS Security Foundations

Enterprise Lab: 01 – AWS Security Baseline

Estimated Time: 90–120 Minutes

Difficulty: ⭐⭐☆☆☆

Estimated Cost: AWS Free Tier (Minimal cost if resources are cleaned up correctly)

🎯 Objective

As a newly hired Cloud Security Engineer at CloudNova Technologies, your first responsibility is to secure a newly provisioned AWS account before it is handed over to development teams.

By completing this runbook, you will:

Secure the AWS Root Account
Enable Multi-Factor Authentication (MFA)
Create an IAM Administrator
Configure a strong password policy
Enable CloudTrail
Enable AWS Config
Enable Security Hub
Enable GuardDuty
Configure Billing Alerts
Validate the security baseline
Verify AWS costs

🏢 Business Scenario

CloudNova Technologies has created a new AWS account for a project called Project Aurora.

Before developers receive access, the Cloud Security team must establish the company’s AWS Security Baseline.

You have been assigned this task.

📋 Prerequisites

Before starting, ensure you have:

AWS Account
MFA Application
AWS CLI v2 Installed
Visual Studio Code
Internet Connection
Administrator access to the AWS account

🏗️ Target Architecture

AWS Account
│
├── Root Account (Protected)
├── IAM Administrator
├── CloudTrail
├── AWS Config
├── Security Hub
├── GuardDuty
├── SNS Topic
├── CloudWatch Billing Alarm
└── Secure Baseline

Step 1 — Verify AWS CLI

Verify AWS CLI installation.

aws --version

Expected Output

aws-cli/2.x.x

If AWS CLI is not installed, download and install it before continuing.

Step 2 — Configure AWS CLI

Run:

aws configure

Enter:

AWS Access Key ID

AWS Secret Access Key

Default Region

Default Output Format (json)

Verify configuration:

aws sts get-caller-identity

Expected Output

{
  "Account": "123456789012",
  "Arn": "arn:aws:iam::123456789012:user/ghc-admin"
}

Step 3 — Secure the Root Account

Perform the following:

Enable MFA
Verify recovery email
Configure alternate contacts
Remove any Root Access Keys
Never use the Root account for daily administration

Validation

Root MFA Enabled
No Root Access Keys

Step 4 — Create an IAM Administrator

Navigate to:

IAM → Users

Create:

User Name

ghc-admin

Enable:

Console Access
Programmatic Access (Lab Only)

Attach Policy:

AdministratorAccess

Note

AdministratorAccess is used only during initial setup. Future modules will replace this with Least Privilege.

Enable MFA for the Administrator account.

Step 5 — Configure Password Policy

Navigate to:

IAM → Account Settings

Configure:

Minimum Password Length: 14

Uppercase Required

Lowercase Required

Numbers Required

Symbols Required

Password Expiry: 90 Days

Prevent Password Reuse: 24 Passwords

Save the policy.

Step 6 — Enable CloudTrail

Navigate to:

CloudTrail → Create Trail

Configure:

Trail Name

ghc-cloudtrail

Enable:

Multi-Region Trail
Log File Validation

Create a new S3 Bucket for logs.

Verify

aws cloudtrail describe-trails

Step 7 — Enable AWS Config

Navigate to:

AWS Config

Choose:

Record All Resources

Create New Recorder

Create New S3 Bucket

Save the configuration.

Verify

aws configservice describe-configuration-recorders

Step 8 — Enable Security Hub

Navigate to:

Security Hub

Select:

Enable Security Hub

Verify

aws securityhub describe-hub

Step 9 — Enable GuardDuty

Navigate to:

GuardDuty

Select:

Enable

Verify

aws guardduty list-detectors

Step 10 — Configure Billing Alerts

Navigate to:

Billing

Enable:

Billing Alerts

Create:

CloudWatch Alarm

Threshold:

£5 Estimated Monthly Cost

Create:

SNS Topic

Subscribe your email address.

Confirm the subscription.

Step 11 — Validate the Environment

Verify the following:

Root MFA Enabled
IAM Administrator Created
Administrator MFA Enabled
Password Policy Configured
CloudTrail Enabled
AWS Config Enabled
Security Hub Enabled
GuardDuty Enabled
Billing Alarm Configured

🧪 Enterprise Challenge

Your manager asks:

“Every engineer currently has AdministratorAccess. How would you redesign IAM following the Principle of Least Privilege?”

Prepare:

Risk Assessment
Recommended IAM Groups
Recommended IAM Roles
Future Access Model

📄 Deliverables

Capture screenshots of:

IAM Dashboard
IAM User
MFA Configuration
CloudTrail Dashboard
AWS Config Dashboard
Security Hub Dashboard
GuardDuty Dashboard
Billing Alarm
Cost Explorer

💷 Cost Verification

Open:

Billing → Cost Explorer

Verify the following resources are NOT running.

EC2 Instances

Elastic IP Addresses

NAT Gateways

Application Load Balancers

Classic Load Balancers

RDS Databases

EKS Clusters

ECS Services

Unused EBS Volumes

Large S3 Buckets

Snapshots

Review AWS Billing Dashboard.

Expected Cost:

Free Tier

or

Minimal Charges

🧹 Cleanup

Do NOT delete the following resources.

They become the secure baseline for future AWS labs.

Keep:

IAM Administrator
Password Policy
Root MFA
CloudTrail
AWS Config
Security Hub
GuardDuty
Billing Alarm

Delete only:

Temporary IAM Users
Test IAM Policies
Test IAM Groups
Temporary Access Keys
Experimental Resources

✅ Runbook Checklist

💡 Lessons Learned

Document the following:

What did you learn?

What security risks were identified?

What challenges did you face?

How would you improve this environment?

🚀 Next Module

02 Identity & Access Management (IAM)

In the next module, you will replace broad administrator permissions with a secure, enterprise-grade IAM design following the Principle of Least Privilege.