Preparation: the runbook that exists before the incident - SkilBrill

Skip to content

Home
Courses
About
Contact
Blog
- Freshers

Search for:

Home - Lessons - AWS Cloud Security - M7 — Incident Response on AWS - Preparation: the runbook that exists before the incident

AWS Cloud Security Preparation: the runbook that exists before the incident

AWS Cloud Security

0% Completed

M1 — Security Model and Shared Responsibility

Shared responsibility: what AWS secures and what you must

Security of versus security in the cloud

Identity as the real perimeter in cloud environments

Threat modelling a cloud workload

The control types: preventive, detective and corrective

Where cloud security programmes usually fail

M2 — Identity Boundaries and Access Patterns

IAM users, groups and why long-lived keys are the problem

Roles, trust policies and the assume-role pattern

Permission boundaries and scoping a delegated admin

Organizations-wide policy with SCPs

Cross-account access without privilege creep

Access reviews, credential rotation and removing what is unused

M3 — Detective Controls and Logging

CloudTrail: what it records and what it does not

Organisation-wide trail, log file integrity and retention

GuardDuty threat findings and their real meaning

Security Hub and cross-account finding aggregation

Config for configuration conformance over time

Turning findings into a prioritised, owned fix queue

M4 — Data Protection and Key Management

Encryption at rest and in transit without the buzzwords

KMS keys, grants and the key policy boundary

Envelope encryption and why it exists

Key rotation, expiry and separation of duties

S3 bucket policy, Block Public Access and access points

Secrets Manager versus Parameter Store and when each fits

M5 — Network Security Controls

Security groups as stateful allow lists

Network ACLs and the subnet-level decision

VPC endpoints so traffic stays off the public internet

WAF rules, managed rule groups and false positives

Shield and DDoS posture for a public workload

Flow logs as forensic evidence

M6 — Workload and Vulnerability Management

Inspector for EC2, ECR and Lambda findings

Severity, exploitability and what to fix first

Patch management as a risk process, not a schedule

Container and image supply chain security

Infrastructure drift that re-opens a closed hole

Measuring mean time to remediate and making it move

M7 — Incident Response on AWS

Preparation: the runbook that exists before the incident

Triage and containment in a cloud account

Using CloudTrail and VPC flow logs to establish scope

Key compromise: rotation and blast-radius reduction

Evolving an instance rather than preserving it perfectly

Post-incident review and control improvement

M8 — Capstone: A Hardened, Evidence-Ready Account

Baseline an account and record every finding

Rebuild the identity model with least privilege and no long-lived keys

Enable detective controls and a triage workflow

Encrypt data with a key policy you can defend

Respond to a simulated incident with a written timeline

Produce the evidence pack an auditor would accept

Announcements Course Info

Global Trusted Software Training Partner Since 2022

SkilBrill Training Institute delivers industry-focused technology education that bridges the gap between academic learning and real-world demands. Our structured programs combine foundational theory with practical application, ensuring every graduate is confident and job-ready from day one.

Learn More About Us

© 2026 SkilBrill Training Institute. All Rights Reserved. Privacy Policy Terms Refunds Outcomes

📞 Enroll Now

Start Your Journey

Fill in your details and our team will get back to you within 24 hours

Please enable JavaScript in your browser to complete this form.

Full Name *

Email *

Course Interested In *

Mode of Course *