16. Live Project: Building a Reels App with EC2, S3 and RDS
16.13 Security Checklist: The Target You Will Secure
Ha app aata tumcha "practice target" aahe. Pudhchya parts madhe aapan yavar Nmap, Burp Suite aani sqlmap chalvun bagnar aahot – fakt tumchya swatahchya server var. Aadhi defender mhanun checklist puri kara.
| Area | Control in this project | Status |
|---|---|---|
| Network | web-sg: 22 from your IP only, 80/443 open; RDS private, 3306 from web-sg only |
☐ |
| Identity | IAM role scoped to s3:PutObject/GetObject on videos/*; IMDSv2 required; no access keys on disk |
☐ |
| S3 | Block Public Access ON, DenyInsecureTransport, versioning, default encryption, presigned URLs ≤ 20 min | ☐ |
| RDS | Encryption, TLS (db_ssl_ca), least-privilege reels_app, backups, deletion protection |
☐ |
| Transport | HTTPS with Certbot, HTTP→HTTPS redirect, HSTS, Secure cookies |
☐ |
| Auth | password_hash, generic login error, session regeneration, HttpOnly/SameSite cookies |
☐ |
| Input | Prepared statements, finfo MIME allow-list, size limits, colour allow-list |
☐ |
| Output | htmlspecialchars in PHP, textContent in JS, CSP, nosniff, X-Frame-Options |
☐ |
| Server | Web root = public/, config.php 640, server_tokens off, expose_php Off, hidden files denied |
☐ |
| Operations | yum update/apt upgrade regularly, composer audit, logs reviewed, RDS snapshots |
☐ |
Improvements for later chapters (good exercises once you learn the attacks): rate limiting on login.php (Nginx limit_req or fail2ban), account lockout alerts, deleting posts (with ownership checks to prevent IDOR), direct browser-to-S3 uploads with presigned PUT URLs, CloudFront in front of S3, video transcoding, and CloudWatch alarms.
Why this matters for security
A checklist turns "I think it is secure" into evidence. In real jobs, a cloud security review or a penetration test report is exactly this table with findings and fixes. Keep yours – in the Kali and OWASP parts you will attack each row and prove that the control works.
Ravindra Bagale's Tip
As soon as the project works, students share the link on LinkedIn – without completing the checklist! Tick every row first, then share. And if you're going to push the code to GitHub, put config.php in .gitignore – once a password reaches a public repo, bots find it very quickly.
Ravindra Bagale's Tip – मराठी
Project चालू झाला की students लगेच LinkedIn वर link share करतात – checklist पूर्ण न करता! आधी प्रत्येक row tick करा, मग share करा. आणि GitHub वर code push करणार असाल तर config.php .gitignore मध्ये टाका – password public repo मध्ये गेला की bots तो खूप लवकर शोधतात.
Ravindra Bagale's Tip – हिंदी
Project चलते ही students तुरंत LinkedIn पर link share कर देते हैं – checklist पूरी किए बिना! पहले हर row tick करो, फिर share करो. और GitHub पर code push करने वाले हो तो config.php को .gitignore में डालो – password public repo में गया तो bots उसे बहुत जल्दी ढूँढ लेते हैं.
Lab
Go through the checklist on your live app and tick every row with proof (a command, a screenshot or a config line). Add config.php and vendor/ to .gitignore and push the project to a private GitHub repository.
Thodkyaat sangaycha tar
- Three tiers: EC2 (Nginx + PHP-FPM) → S3 for videos (private) and RDS for data (private); the browser plays videos from S3 through short presigned URLs.
- The EC2 IAM role replaces access keys; the S3 client is created with no credentials; IMDSv2 required.
- Only
public/is the web root;config.php,src/,vendor/stay outside it. - Upload: CSRF → size →
finfoMIME allow-list → random key →putObject→ prepared INSERT. - Feed: cursor pagination, selected fields only, presigned URL per video; UI with scroll-snap and IntersectionObserver.
- Check every file with
php -l, test configs withnginx -t, add HTTPS + HSTS + CSP, and finish the security checklist.
Samjla ka? Tumhi aata ek purna cloud app banavla aahe – he khup mothi goshta aahe, mitrano! Nasel samjla tar 16.1 cha diagram punha bagha. Aata pudhe jaauya – he sagla Kali Linux chya aadhi ka shikla, te samjuya.