Security engineering / Cloud security
Cloud Security
A deterministic Python lab for AWS-style posture assessment, audit-event detection, and remediation verification, tested against versioned synthetic fixtures and reproducible reports.
Inspect the system
A completed, credential-free local lab. Synthetic snapshots and events drive assessment, triage, and closure verification; no AWS services are connected.
- System
- Typed Python with versioned JSON fixtures and no third-party runtime packages.
- Coverage
- 14 posture controls, six event detections, and one bounded correlation.
- Evidence
- Later resource/control reassessment and reproducible JSON/Markdown reports.
Overview
I built an offline cloud-security workflow that turns explicit configuration and event observations into findings, analyst triage, and verifiable remediation outcomes. Every input is labeled synthetic and runs without an AWS account.
Problem
A configuration flag, a suspicious event, and a verified fix require different evidence. The lab makes those boundaries executable and tests when an input should fail, a signal should request review, or a finding should remain open.
Assessment and event review
- Validate typed fixtures
- Assess posture or detect events
- Attach evidence and triage
- Reassess later configuration
- Export reproducible reports
Fourteen posture controls cover selected IAM grants and trust, bucket guardrails, administrative ingress, and logging. Six event detections feed review. One correlation escalates an ordered policy change followed by logging disablement within 15 minutes, only for the same account and exact principal/session.
Engineering decisions
Versioned input contracts reject malformed or unsupported data. Expected fixture outcomes are separate from evaluator code. Closure re-evaluates a later compatible snapshot and requires PASS for the same resource/control; status edits, removed resources, changed scope, or reclassified sensitivity cannot manufacture closure. Newly introduced findings remain visible.
Validation
The corpus contains 41 source scenarios: four valid snapshots, four invalid snapshots, and 33 event fixtures. The synthetic demo produces 17 findings and verifies all 17 closed after reassessment, alongside six alerts and one correlation. Ten JSON/Markdown artifacts reproduce byte-for-byte.
September 23, 2026 CI passed all six jobs, including 190 tests on each Windows/Ubuntu and Python 3.11/3.14 combination. The remaining jobs passed lint, typing, static security checks, dependency and secret scans, and package builds. Those dated checks do not certify security.
Lessons / constraints
This is bounded static IAM review and synthetic configuration verification, not a complete IAM authorization engine or an AWS compliance assessment. It cannot establish effective permissions, actual public exposure, network reachability, log delivery, or deployed remediation. Alerts request investigation; correlation does not prove malicious intent. There are no live cloud integrations or production detection-quality claims.