Skip to content

Commit 5876add

Browse files
mwunderlmwunderl
committed
Add security tutorials (batch 11)
1 parent 49f07d9 commit 5876add

13 files changed

Lines changed: 1027 additions & 0 deletions

File tree

‎tuts/092-aws-kms-gs/README.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# KMS: Create a key and encrypt data
2+
3+
Create a customer managed KMS key, encrypt and decrypt data, and generate a data key using the AWS CLI.
4+
5+
## Source
6+
7+
https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
8+
9+
## Use case
10+
11+
- ID: kms/getting-started
12+
- Phase: create
13+
- Complexity: beginner
14+
- Core actions: kms:CreateKey, kms:Encrypt, kms:Decrypt
15+
16+
## What it does
17+
18+
1. Creates a customer managed KMS key
19+
2. Creates an alias for the key
20+
3. Describes the key metadata
21+
4. Encrypts data using fileb://
22+
5. Decrypts the ciphertext
23+
6. Generates a data key for client-side encryption
24+
7. Lists KMS keys and aliases
25+
26+
## Running
27+
28+
```bash
29+
bash aws-kms-gs.sh
30+
```
31+
32+
## Resources created
33+
34+
- KMS customer managed key (with alias)
35+
36+
The key costs $1/month until deleted. The script prompts you to clean up when it finishes. Cleanup schedules the key for deletion with a 7-day waiting period.
37+
38+
## Estimated time
39+
40+
- Run: ~7 seconds
41+
42+
## Cost
43+
44+
$1/month for the customer managed key. Delete the key promptly to avoid charges.
45+
46+
## Related docs
47+
48+
- [Getting started with AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html)
49+
- [Creating keys](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)
50+
- [Encrypting and decrypting data](https://docs.aws.amazon.com/kms/latest/developerguide/programming-encryption.html)
51+
- [Data keys](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#data-keys)
52+
- [Deleting KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html)
53+
54+
---
55+
56+
## Appendix: Generation details
57+
58+
| Field | Value |
59+
|-------|-------|
60+
| Generation date | 2026-04-14 |
61+
| Source script | New, 88 lines |
62+
| Script test result | EXIT 0, 7s, 7 steps, no issues |
63+
| Issues encountered | None |
64+
| Iterations | v1 (direct to publish) |

‎tuts/092-aws-kms-gs/aws-kms-gs.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
# Create a key and encrypt data with AWS KMS
2+
3+
This tutorial shows you how to create a customer managed KMS key, assign it an alias, encrypt and decrypt data, and generate a data key for client-side encryption.
4+
5+
## Prerequisites
6+
7+
- AWS CLI configured with credentials and a default region
8+
- Permissions for `kms:CreateKey`, `kms:CreateAlias`, `kms:DescribeKey`, `kms:Encrypt`, `kms:Decrypt`, `kms:GenerateDataKey`, `kms:ListAliases`, `kms:ScheduleKeyDeletion`, `kms:DeleteAlias`
9+
10+
## Step 1: Create a customer managed key
11+
12+
```bash
13+
KEY_ID=$(aws kms create-key --description "Tutorial key" \
14+
--query 'KeyMetadata.KeyId' --output text)
15+
echo "Key ID: $KEY_ID"
16+
```
17+
18+
KMS returns the key metadata including the key ID, ARN, and state. The key is enabled immediately.
19+
20+
## Step 2: Create an alias
21+
22+
An alias is a friendly name for your key. Alias names must start with `alias/`.
23+
24+
```bash
25+
aws kms create-alias --alias-name "alias/tutorial-key" --target-key-id "$KEY_ID"
26+
```
27+
28+
## Step 3: Describe the key
29+
30+
```bash
31+
aws kms describe-key --key-id "$KEY_ID" \
32+
--query 'KeyMetadata.{KeyId:KeyId,State:KeyState,Created:CreationDate,Description:Description}' \
33+
--output table
34+
```
35+
36+
## Step 4: Encrypt data
37+
38+
Write plaintext to a file and encrypt it using `fileb://` to pass raw bytes:
39+
40+
```bash
41+
echo "Hello from the KMS tutorial" > plaintext.txt
42+
aws kms encrypt --key-id "$KEY_ID" \
43+
--plaintext "fileb://plaintext.txt" \
44+
--output text --query 'CiphertextBlob' > ciphertext.b64
45+
```
46+
47+
The `fileb://` prefix tells the CLI to read the file as raw binary. The output is base64-encoded ciphertext.
48+
49+
## Step 5: Decrypt data
50+
51+
Decode the base64 ciphertext to binary, then decrypt:
52+
53+
```bash
54+
base64 --decode ciphertext.b64 > ciphertext.bin
55+
aws kms decrypt --ciphertext-blob "fileb://ciphertext.bin" \
56+
--output text --query 'Plaintext' | base64 --decode
57+
```
58+
59+
KMS identifies the correct key from metadata embedded in the ciphertext.
60+
61+
## Step 6: Generate a data key
62+
63+
A data key lets you encrypt data locally. KMS returns both a plaintext key (for immediate use) and an encrypted copy (to store alongside your data).
64+
65+
```bash
66+
aws kms generate-data-key --key-id "$KEY_ID" --key-spec AES_256 \
67+
--query '{KeyId:KeyId}' --output table
68+
```
69+
70+
## Step 7: List keys
71+
72+
```bash
73+
aws kms list-aliases \
74+
--query 'Aliases[?starts_with(AliasName, `alias/tutorial`)].{Alias:AliasName,KeyId:TargetKeyId}' \
75+
--output table
76+
```
77+
78+
## Cleanup
79+
80+
Schedule the key for deletion (minimum 7-day waiting period) and delete the alias:
81+
82+
```bash
83+
aws kms schedule-key-deletion --key-id "$KEY_ID" --pending-window-in-days 7
84+
aws kms delete-alias --alias-name "alias/tutorial-key"
85+
```
86+
87+
The key incurs $1/month until the scheduled deletion completes. The script automates all steps including cleanup:
88+
89+
```bash
90+
bash aws-kms-gs.sh
91+
```

‎tuts/092-aws-kms-gs/aws-kms-gs.sh‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash
2+
# Tutorial: Create a KMS key and encrypt data
3+
# Source: https://docs.aws.amazon.com/kms/latest/developerguide/getting-started.html
4+
5+
WORK_DIR=$(mktemp -d)
6+
LOG_FILE="$WORK_DIR/kms-$(date +%Y%m%d-%H%M%S).log"
7+
exec > >(tee -a "$LOG_FILE") 2>&1
8+
9+
REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null)}}
10+
if [ -z "$REGION" ]; then
11+
echo "ERROR: No AWS region configured. Set one with: export AWS_DEFAULT_REGION=us-east-1"
12+
exit 1
13+
fi
14+
export AWS_DEFAULT_REGION="$REGION"
15+
echo "Region: $REGION"
16+
17+
RANDOM_ID=$(openssl rand -hex 4)
18+
ALIAS_NAME="alias/tutorial-key-${RANDOM_ID}"
19+
20+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }
21+
trap 'handle_error $LINENO' ERR
22+
23+
cleanup() {
24+
echo ""
25+
echo "Cleaning up resources..."
26+
if [ -n "$KEY_ID" ]; then
27+
aws kms schedule-key-deletion --key-id "$KEY_ID" --pending-window-in-days 7 > /dev/null 2>&1 && \
28+
echo " Scheduled key $KEY_ID for deletion in 7 days"
29+
fi
30+
aws kms delete-alias --alias-name "$ALIAS_NAME" 2>/dev/null && echo " Deleted alias $ALIAS_NAME"
31+
rm -rf "$WORK_DIR"
32+
echo "Cleanup complete."
33+
}
34+
35+
# Step 1: Create a customer managed key
36+
echo "Step 1: Creating a customer managed KMS key"
37+
KEY_ID=$(aws kms create-key --description "Tutorial key ${RANDOM_ID}" \
38+
--query 'KeyMetadata.KeyId' --output text)
39+
echo " Key ID: $KEY_ID"
40+
41+
# Step 2: Create an alias
42+
echo "Step 2: Creating alias: $ALIAS_NAME"
43+
aws kms create-alias --alias-name "$ALIAS_NAME" --target-key-id "$KEY_ID"
44+
echo " Alias created"
45+
46+
# Step 3: Describe the key
47+
echo "Step 3: Describing the key"
48+
aws kms describe-key --key-id "$KEY_ID" \
49+
--query 'KeyMetadata.{KeyId:KeyId,State:KeyState,Created:CreationDate,Description:Description}' --output table
50+
51+
# Step 4: Encrypt data
52+
echo "Step 4: Encrypting data"
53+
echo "Hello from the KMS tutorial" > "$WORK_DIR/plaintext.txt"
54+
aws kms encrypt --key-id "$KEY_ID" \
55+
--plaintext "fileb://$WORK_DIR/plaintext.txt" \
56+
--output text --query 'CiphertextBlob' > "$WORK_DIR/ciphertext.b64"
57+
echo " Plaintext: $(cat "$WORK_DIR/plaintext.txt")"
58+
echo " Ciphertext (base64, first 40 chars): $(head -c 40 "$WORK_DIR/ciphertext.b64")..."
59+
60+
# Step 5: Decrypt data
61+
echo "Step 5: Decrypting data"
62+
cat "$WORK_DIR/ciphertext.b64" | base64 --decode > "$WORK_DIR/ciphertext.bin"
63+
aws kms decrypt --ciphertext-blob "fileb://$WORK_DIR/ciphertext.bin" \
64+
--output text --query 'Plaintext' | base64 --decode > "$WORK_DIR/decrypted.txt"
65+
echo " Decrypted: $(cat "$WORK_DIR/decrypted.txt")"
66+
67+
# Step 6: Generate a data key
68+
echo "Step 6: Generating a data key"
69+
aws kms generate-data-key --key-id "$KEY_ID" --key-spec AES_256 \
70+
--query '{KeyId:KeyId}' --output table
71+
echo " Data key generated (plaintext + encrypted copy returned)"
72+
73+
# Step 7: List keys
74+
echo "Step 7: Listing KMS keys (first 5)"
75+
aws kms list-aliases --query 'Aliases[?starts_with(AliasName, `alias/tutorial`)].{Alias:AliasName,KeyId:TargetKeyId}' --output table
76+
77+
echo ""
78+
echo "Tutorial complete."
79+
echo "Do you want to clean up all resources? (y/n): "
80+
read -r CHOICE
81+
if [[ "$CHOICE" =~ ^[Yy]$ ]]; then
82+
cleanup
83+
else
84+
echo "Resources left running. The key will incur $1/month until deleted."
85+
echo "Manual cleanup:"
86+
echo " aws kms schedule-key-deletion --key-id $KEY_ID --pending-window-in-days 7"
87+
echo " aws kms delete-alias --alias-name $ALIAS_NAME"
88+
fi

‎tuts/102-amazon-guardduty-gs/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# GuardDuty: Enable threat detection and review findings
2+
3+
## Source
4+
5+
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html
6+
7+
## Use case
8+
9+
- **ID**: guardduty/getting-started
10+
- **Level**: beginner
11+
- **Core actions**: `guardduty:CreateDetector`, `guardduty:ListFindings`, `guardduty:GetFindings`, `guardduty:CreateSampleFindings`
12+
13+
## Steps
14+
15+
1. Enable GuardDuty (handle pre-existing detector)
16+
2. Get detector details
17+
3. List findings
18+
4. Generate sample findings
19+
5. List findings again
20+
6. Get finding statistics
21+
22+
## Resources created
23+
24+
| Resource | Type |
25+
|----------|------|
26+
| GuardDuty detector | `AWS::GuardDuty::Detector` |
27+
28+
## Duration
29+
30+
~13 seconds
31+
32+
## Cost
33+
34+
GuardDuty offers a free 30-day trial for new accounts. After the trial, pricing is based on the volume of data analyzed (VPC flow logs, DNS logs, CloudTrail events). The detector is deleted during cleanup.
35+
36+
## Related docs
37+
38+
- [Setting up GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_settingup.html)
39+
- [Understanding GuardDuty findings](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html)
40+
- [Managing GuardDuty detectors](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_managing.html)
41+
- [Sample findings](https://docs.aws.amazon.com/guardduty/latest/ug/sample_findings.html)
42+
43+
---
44+
45+
## Appendix
46+
47+
| Field | Value |
48+
|-------|-------|
49+
| Date | 2026-04-14 |
50+
| Script lines | 97 |
51+
| Exit code | 0 |
52+
| Runtime | 13s |
53+
| Steps | 6 |
54+
| Issues | Handled pre-existing detector |
55+
| Version | v1 |

0 commit comments

Comments
 (0)