Runbook 01 Build & Secure Enterprise EC2 Infrastructure

Module: 05 – Amazon EC2 Security

Enterprise Lab: 01

Estimated Time: 3–4 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: AWS Free Tier (Some EC2 instance types and storage options may incur charges. Always monitor AWS Cost Explorer.)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, your responsibility is to deploy and harden Amazon EC2 instances that meet enterprise security standards before they are handed over to application teams.

By completing this runbook, you will learn how to:

Launch secure EC2 instances
Select secure Amazon Machine Images (AMIs)
Configure IAM Roles
Configure Security Groups
Encrypt EBS Volumes
Enforce Instance Metadata Service Version 2 (IMDSv2)
Configure AWS Systems Manager (SSM)
Configure Amazon CloudWatch
Enable Amazon Inspector
Implement patch management
Validate a hardened EC2 environment

🏢 Business Scenario

CloudNova Technologies is deploying a new customer-facing application.

The application team requires a secure Linux server that follows enterprise security standards before deploying their application.

As the Cloud Security Engineer, your responsibility is to build and secure the EC2 infrastructure.

📋 Prerequisites

Complete:

Module 01 – AWS Security Foundations
Module 02 – Identity & Access Management
Module 03 – AWS Organizations
Module 04 – Amazon VPC & Network Security

Required:

AWS Account
Administrator Access
Existing VPC
Public and Private Subnets
AWS CLI Installed
Visual Studio Code

🏗 Enterprise Architecture

                    Internet
                        │
                        ▼
               Application Load Balancer
                        │
             Private Application Subnet
                        │
                 Amazon EC2 Instance
                        │
        IAM Role (No Access Keys Stored)
                        │
          Encrypted Amazon EBS Volume
                        │
          AWS Systems Manager (SSM)
                        │
        Amazon CloudWatch Monitoring
                        │
           Amazon Inspector Scanning

Step 1 — Review Existing Infrastructure

Navigate to:

AWS Console

↓

EC2 Dashboard

Verify:

VPC exists
Private Subnet exists
Security Groups exist
IAM Role available

AWS CLI

aws ec2 describe-vpcs

aws ec2 describe-subnets

Step 2 — Launch EC2 Instance

Navigate to:

EC2

↓

Launch Instance

Configuration

Name

CloudNova-App01

AMI

Amazon Linux 2023

Instance Type

t2.micro

Network

Production VPC

Subnet

Private Application Subnet

Public IP

Disabled

AWS CLI

aws ec2 run-instances \
--image-id ami-xxxxxxxx \
--instance-type t2.micro \
--subnet-id subnet-xxxxxxxx \
--security-group-ids sg-xxxxxxxx \
--iam-instance-profile Name=CloudNova-EC2-Role \
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=CloudNova-App01}]'

Step 3 — Attach IAM Role

Navigate to:

EC2

↓

Instance

↓

Security

↓

Modify IAM Role

Attach:

CloudNova-EC2-Role

Permissions should include:

AmazonSSMManagedInstanceCore
CloudWatchAgentServerPolicy

Discuss:

Why IAM Roles are preferred over Access Keys.
Risks of storing credentials on EC2 instances.

Step 4 — Configure Security Groups

Review inbound rules.

Allow only:

SSH (22)

Source:

Bastion Host Security Group

No SSH

Use Systems Manager Session Manager

Application Ports

HTTP (80)

HTTPS (443)

Source:

Application Load Balancer

Review outbound rules.

Remove unnecessary outbound access if required.

Step 5 — Encrypt Amazon EBS Volume

Review attached storage.

Verify:

EBS Encryption Enabled
AWS KMS Key Used

Console

EC2

↓

Volumes

CLI

aws ec2 describe-volumes

Discuss:

Data-at-rest protection
Customer-managed keys
Compliance requirements

Step 6 — Enforce IMDSv2

Review Instance Metadata configuration.

Console

EC2

↓

Instance

↓

Metadata Options

Verify:

IMDSv2 Required

CLI

aws ec2 describe-instances

Review:

MetadataOptions

Discuss:

SSRF attacks
Credential theft
Why IMDSv2 is required

Step 7 — Configure AWS Systems Manager

Verify the EC2 instance appears in:

Systems Manager

↓

Managed Instances

CLI

aws ssm describe-instance-information

Validate:

Managed Instance
Ping Status Online

Discuss:

Session Manager
Remote administration
Patch management

Step 8 — Install CloudWatch Agent

Install CloudWatch Agent.

Verify:

CPU Monitoring
Memory Monitoring
Disk Monitoring

CLI

sudo yum install amazon-cloudwatch-agent -y

Start the agent.

Verify metrics appear in CloudWatch.

Step 9 — Enable Amazon Inspector

Navigate to:

Amazon Inspector

Enable:

EC2 Scanning

Review:

Vulnerability Findings
CVEs
Package Risks

CLI

aws inspector2 list-findings

Step 10 — Patch Management

Navigate to:

Systems Manager

↓

Patch Manager

Review:

Missing Updates
Installed Updates
Patch Compliance

Discuss:

Critical Updates
Security Updates
Maintenance Windows

Step 11 — Configure Monitoring

Create CloudWatch alarms for:

CPU Utilization
Disk Utilization
Status Check Failed
Memory Usage

Discuss:

Operational Monitoring
Security Monitoring
Incident Detection

Step 12 — Validate the Environment

Verify:

EC2 running
IAM Role attached
IMDSv2 enabled
Security Groups configured
EBS encrypted
Systems Manager working
CloudWatch Agent reporting
Amazon Inspector enabled
Patch Manager configured

CLI

aws ec2 describe-instances

🧪 Enterprise Challenge

CloudNova Technologies is preparing to host a payment processing application.

Design a hardened EC2 deployment that meets enterprise security requirements.

Your design should include:

Private EC2 deployment
IAM Role
Session Manager access
Encrypted storage
CloudWatch monitoring
Amazon Inspector
Systems Manager
Secure Security Groups
High Availability

Explain how each security control reduces risk.

📄 Deliverables

Capture screenshots of:

EC2 Dashboard
Instance Details
IAM Role
Security Group
EBS Encryption
Systems Manager
CloudWatch Metrics
Amazon Inspector Findings
Patch Manager Compliance

Submit:

EC2 Hardening Checklist
Architecture Diagram
Security Configuration Report
Validation Report

🧹 Cleanup

Delete:

Test EC2 Instance
Test Security Groups
Temporary EBS Volumes
Temporary CloudWatch Alarms

Keep:

IAM Role
Systems Manager Configuration
Security Documentation
Hardening Checklist

Review AWS Cost Explorer to ensure no unnecessary compute or storage resources remain.

✅ Runbook Checklist

💡 Lessons Learned

What did you learn?

Why are IAM Roles preferred over Access Keys?

Why should EC2 instances use Systems Manager instead of SSH where possible?

How does Amazon Inspector improve the security posture of EC2 instances?

How would you further harden this EC2 deployment for a production environment?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise EC2 Security Assessment

In the next runbook, you will assess an existing Amazon EC2 environment, identify security weaknesses, review IAM roles, Security Groups, EBS encryption, IMDS configuration, Systems Manager, Amazon Inspector findings, and produce an enterprise EC2 security assessment report.