☁️ Cloud Security Labs — AWS Hands-on AWS cloud security labs focused on visibility, detection, and incident response from a SOC perspective. This repository demonstrates how security teams monitor, detect and respond to threats in AWS environments using logs, telemetry and security best practices.

🎯 Objective To showcase practical cloud security operations aligned with SOC workflows, including: Visibility and logging Detection use cases Incident investigation Security posture hardening This is cloud security for defenders, not architecture theory.

🧠 Cloud Security Perspective In cloud environments, security depends on: Telemetry first (logs and signals) Contextual detections Fast investigation Clear ownership between cloud and SOC These labs reflect that reality. 🔍 What You’ll Find Here ✔ AWS security monitoring scenarios ✔ CloudTrail analysis ✔ IAM security use cases ✔ Network visibility and anomalies ✔ Detection ideas mapped to SOC operations ✔ Incident response considerations in cloud 🛡️ Key AWS Security Components Covered

AWS CloudTrail IAM & Access Analysis VPC Flow Logs S3 Security & Logging Security monitoring concepts Cloud-native detection ideas

🧪 Example Scenarios Suspicious IAM activity Abnormal API calls Unauthorized access attempts Misconfiguration leading to exposure Cloud incident investigation workflow Each scenario answers: “How would a SOC detect and investigate this in AWS?”

🧩 Detection & Response Flow Copiar código Text AWS Logs & Telemetry ↓ Detection Logic ↓ Context Enrichment ↓ SOC Investigation ↓ Response & Mitigation 📂 Repository Structure

cloud-security-aws/ ├── logs/ │ ├── cloudtrail-samples.json ├── detections/ │ ├── iam-anomalies.md │ ├── api-abuse.md ├── response/ │ └── incident-response.md └── README.md

🛠️ Tools & Concepts Applied AWS logging & telemetry Cloud security monitoring IAM security analysis Detection logic (tool-agnostic) SOC investigation workflows Cloud incident response concepts

🧠 Why This Matters Many SOC analysts struggle in cloud environments because: logs are misunderstood detections lack context ownership is unclear This repository demonstrates how SOC thinking translates to the cloud.

🎯 Target Audience SOC Analysts Cloud Security Analysts Detection Engineers Blue Team Engineers Security Operations Teams

👤 Author Gustavo Okamoto Cybersecurity Analyst | SOC / SIEM | Threat Detection & Incident Response | Blue Team Cloud Security • Detection Engineering • Automation

🔗 GitHub: https://github.com/gustavo89587 🔗 LinkedIn: https://linkedin.com/in/gustavo-okamoto-de-carvalho-ti

⭐ Star this repository if you value practical cloud security for SOC teams.