KMS, Secrets Manager, SSM parameters, WAF and security services

Service roles

KMS controls encryption keys and cryptographic operations. Secrets Manager stores/rotates secrets with service-specific integration. Parameter Store handles configuration and can hold SecureString values. WAF filters supported web requests; it does not patch a vulnerable PHP application. GuardDuty detects suspicious activity, Inspector evaluates supported vulnerability exposure, and Security Hub centralizes findings/posture.

Secret lab

1. Create a lab database credential secret in Secrets Manager without pasting it into source control.
2. Grant the application role GetSecretValue only for that secret; include KMS permission when a customer-managed key requires it.
3. Retrieve it server-side, cache it with a bounded refresh strategy, and never return it to the browser.
4. Change/rotate the credential in a controlled test and verify the application reconnects correctly.
5. Inspect CloudTrail for secret access metadata without printing the secret value into logs.

Encryption boundaries

Encryption at rest protects stored media against certain access paths; an authorized application can still decrypt it. TLS protects data in transit. KMS key policies and IAM policies jointly affect access. Scheduling deletion of a key can make encrypted data unrecoverable, so treat it as a data-destruction operation, not routine cleanup.

Web protection lab

Attach a WAF web ACL to a supported lab ALB/CloudFront resource. Start appropriate managed rules in count mode, observe false positives, then choose targeted blocking. Add a carefully scoped rate-based rule. Test only with low-volume requests you control. WAF is billed and should not be left attached accidentally after a short class.

OS and application hardening

Patch packages, limit inbound ports, require IMDSv2, restrict upload types/size, validate input, use prepared SQL and separate application users. Disable public diagnostic pages. Keep secrets outside the document root even if a web-server rule currently denies them; layered controls reduce single-mistake exposure.

Verification and interview

Attempt secret retrieval from an unauthorized role and expect denial. Explain why giving a browser an encrypted password still fails if the browser also has everything needed to decrypt it. Delete only disposable secrets after choosing recovery windows; do not schedule real key deletion as a lab exercise.

Official references

Secrets Manager guide KMS concepts AWS WAF

Interview and revision check

Does encryption at rest protect against an overprivileged application?

Not necessarily. An authorized application may read/decrypt data. Limit permissions and application access as well as enabling encryption.