AWS Builder Center

Builder Center

Building a Secure Cloud Security Monitoring System on AWS

Learn how to build a cloud security monitoring system using AWS IAM, CloudTrail, CloudWatch, S3, and Amazon GuardDuty. This project demonstrates how to detect suspicious activity, protect cloud resources, and apply important security best practices.

Cloud platforms allow organizations to deploy applications quickly, store data, and scale infrastructure whenever needed. However, cloud environments can become vulnerable if access permissions, network settings, and monitoring systems are not configured correctly.
In this project, we will build a basic cloud security monitoring system on AWS. The system will monitor account activity, detect suspicious behavior, protect sensitive data, and alert administrators when security-related events occur.
This project is suitable for students, beginner cloud engineers, and DevOps learners who want practical experience with AWS security services.

Project Objectives

The main objectives of this project are to:
  • Create secure IAM users and roles.
  • Apply the principle of least privilege.
  • Enable multi-factor authentication.
  • Record AWS API activity using AWS CloudTrail.
  • Store security logs securely in Amazon S3.
  • Create monitoring alerts using Amazon CloudWatch.
  • Detect suspicious activity using Amazon GuardDuty.
  • Protect cloud resources from unauthorized access.
  • Understand how different AWS security services work together.

Technologies Used

  • AWS Identity and Access Management
  • AWS CloudTrail
  • Amazon CloudWatch
  • Amazon S3
  • Amazon GuardDuty
  • AWS Key Management Service
  • AWS Lambda
  • Amazon SNS
  • AWS Management Console
  • AWS CLI

System Architecture

The project uses the following architecture:
  1. An AWS user or service performs an action.
  2. IAM verifies the identity and permissions.
  3. AWS CloudTrail records the activity.
  4. CloudTrail sends logs to an encrypted S3 bucket.
  5. CloudWatch monitors selected events and metrics.
  6. GuardDuty analyzes activity for possible threats.
  7. Amazon SNS sends an email notification when a security alert is triggered.
  8. An administrator investigates the event and takes corrective action.
This architecture provides visibility into AWS activity and helps identify suspicious behavior.

Step 1: Configure IAM

IAM controls access to AWS resources. Start by securing the AWS account.

Recommended IAM configuration

  • Enable MFA for the root user.
  • Avoid using the root user for daily operations.
  • Create a separate administrative identity.
  • Create individual IAM users instead of sharing accounts.
  • Use groups to assign common permissions.
  • Use IAM roles for AWS services.
  • Grant only the permissions required for each task.
  • Remove unused users and access keys.
For example, a developer who only needs to upload files should not receive permission to delete databases or change IAM policies.

Example least-privilege policy

The following policy allows an application to list and read objects from one S3 bucket:
json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::secure-project-logs"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "arn:aws:s3:::secure-project-logs/*"
}
]
}
This policy does not allow the application to delete or modify objects.

Step 2: Create a Secure S3 Log Bucket

Create an S3 bucket to store CloudTrail logs.
Configure the bucket with:
  • Block Public Access enabled.
  • Server-side encryption enabled.
  • Versioning enabled.
  • Restricted bucket policies.
  • Lifecycle rules for older logs.
  • Logging and monitoring enabled.
The bucket should never be publicly accessible because CloudTrail logs may contain sensitive account and activity information.
You can also use AWS Key Management Service to manage encryption keys for the bucket.

Step 3: Enable AWS CloudTrail

AWS CloudTrail records API calls and account activity. It helps answer important security questions such as:
  • Who created a resource?
  • Who changed an IAM policy?
  • Which user deleted a resource?
  • When was a security group modified?
  • From which IP address did an action occur?
Create a CloudTrail trail and configure it to:
  1. Record management events.
  2. Send logs to the secure S3 bucket.
  3. Enable log file validation.
  4. Encrypt logs.
  5. Record activity in all important AWS Regions.
  6. Send selected events to CloudWatch.
CloudTrail logs are useful for security investigation, auditing, and troubleshooting.

Step 4: Create CloudWatch Monitoring

CloudWatch can monitor AWS activity and create alerts when specific events occur.
Useful events to monitor include:
  • Root-user login.
  • Failed console login attempts.
  • Creation of access keys.
  • Changes to IAM policies.
  • Deletion of CloudTrail trails.
  • Public access changes to S3 buckets.
  • Security group changes.
  • Unauthorized API calls.
Create a CloudWatch alarm for suspicious events. The alarm can send a notification through Amazon SNS.

Example alert workflow

text
IAM policy changed
↓
CloudTrail records the event
↓
CloudWatch detects the event
↓
SNS sends an email alert
↓
Administrator investigates the activity

Step 5: Enable Amazon GuardDuty

Amazon GuardDuty is a threat-detection service that analyzes AWS activity and identifies possible security threats.
It can help detect:
  • Suspicious API calls.
  • Compromised credentials.
  • Unusual network behavior.
  • Malware-related activity.
  • Communication with known malicious IP addresses.
  • Unauthorized access attempts.
After enabling GuardDuty, review findings in the AWS console. Each finding normally includes information about the affected resource, the possible threat, and the recommended response.

Step 6: Create Security Notifications

Amazon SNS can send notifications to an administrator when an alert is triggered.
The process is:
  1. Create an SNS topic.
  2. Add an administrator email subscription.
  3. Confirm the email subscription.
  4. Connect the SNS topic to a CloudWatch alarm.
  5. Test the notification.
A notification may contain:
  • Alert type.
  • Affected AWS resource.
  • Time of the event.
  • User or role responsible.
  • Recommended action.
Administrators should not ignore alerts. Each alert should be reviewed to determine whether it is a legitimate action or a possible security incident.

Step 7: Test the Project

After configuring the system, perform controlled tests.

Test 1: IAM policy change

Modify a test IAM policy and check whether:
  • CloudTrail records the change.
  • CloudWatch detects it.
  • SNS sends an email notification.

Test 2: Failed login

Perform unsuccessful login attempts in a controlled environment and check whether the event appears in the monitoring logs.

Test 3: S3 security

Verify that:
  • Public access is blocked.
  • Unauthenticated users cannot access objects.
  • Encryption is enabled.
  • Access activity is recorded.

Test 4: GuardDuty findings

Use the official GuardDuty sample findings feature to generate test findings without performing a real attack.

Security Best Practices

Follow these practices while building the project:
  • Never store AWS access keys in source code.
  • Never upload credentials to GitHub.
  • Use IAM roles instead of long-term access keys.
  • Enable MFA for important accounts.
  • Use separate development and production accounts when possible.
  • Keep databases in private subnets.
  • Restrict security group rules.
  • Encrypt sensitive data.
  • Enable logging before deploying applications.
  • Review IAM permissions regularly.
  • Delete unused resources and credentials.
  • Test backups and recovery procedures.
  • Keep operating systems and dependencies updated.

Expected Results

After completing the project, the system should be able to:
  • Record AWS account activity.
  • Store logs securely.
  • Detect selected suspicious actions.
  • Send email notifications.
  • Identify possible threats using GuardDuty.
  • Restrict users according to their responsibilities.
  • Prevent public access to sensitive storage.
  • Provide evidence for security investigation.

Project Benefits

This project provides practical experience with:
  • AWS IAM and access control.
  • CloudTrail auditing.
  • CloudWatch monitoring.
  • S3 security.
  • Encryption.
  • Threat detection.
  • Incident response.
  • DevSecOps principles.
  • Cloud security architecture.
It is also a useful portfolio project because it demonstrates that you understand more than simply deploying an application. It shows that you can monitor, protect, and manage cloud infrastructure responsibly.

Future Improvements

The project can be extended by adding:
  • Automated remediation with AWS Lambda.
  • Security dashboards using CloudWatch.
  • AWS Security Hub integration.
  • AWS Config compliance rules.
  • Automated access reviews.
  • Slack or Microsoft Teams notifications.
  • Centralized logs from multiple AWS accounts.
  • Infrastructure as Code using Terraform or AWS CloudFormation.
  • A web dashboard showing security events.
  • Automated blocking of suspicious IP addresses.

Conclusion

In this project, we built a basic cloud security monitoring system using AWS IAM, CloudTrail, CloudWatch, S3, GuardDuty, and SNS. IAM controls access, CloudTrail records activity, CloudWatch monitors events, GuardDuty detects threats, and SNS delivers notifications.
Cloud security is most effective when multiple services work together. By applying least privilege, enabling MFA, encrypting data, monitoring activity, and responding to alerts, organizations can significantly improve the security of their AWS environments.
This project is a strong starting point for students and beginners who want to develop practical cloud security and DevOps skills.

Project Metadata

Category: Cloud Security, AWS, DevSecOps
Difficulty: Beginner to Intermediate
Estimated Time: 3–5 hours
AWS Services: IAM, S3, CloudTrail, CloudWatch, GuardDuty, SNS, KMS
Learning Outcome: Build and monitor a secure AWS environment using identity management, auditing, threat detection, and automated notifications.
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article