Unit 1: How a cloud account is laid out · Lesson 2 of 5 · 18 min
Map what the account contains
List storage, machines, functions, people and networks so you know what you are defending.
mission
- You are
- Security engineer at Brightwell.
- Situation
- Nobody has a current diagram of the account. The last one was drawn before the AI tutor launched.
- Goal
- List every bucket, instance, function, user and network in eu-west-1.
- Hand in
- A short list of counts per service, the start of an asset inventory.
The account as a campus
List the buckets
Buckets hold most of the data that leaks in cloud incidents. Start there.
aws s3 ls
2026-10-22 11:52:17 brightwell-website
2026-10-22 11:52:17 brightwell-course-media
2026-10-22 11:52:17 brightwell-learner-exports
2026-10-22 11:52:18 brightwell-backups
2026-10-22 11:52:18 brightwell-tutor-knowledge
2026-10-22 11:52:18 brightwell-deploy-artifacts
2026-10-22 11:52:18 brightwell-logs
you should see Seven buckets. Names like learner-exports and backups hint at sensitive data.
List the machines
Instances with a public IP can be reached from the internet. Note which ones have one.
aws ec2 describe-instances --query 'Reservations[].Instances[].[Tags[?Key==`Name`]|[0].Value,State.Name,PublicIpAddress]' --output text
web-1 running 54.214.194.52
web-2 running 54.214.86.241
jump-1 running 54.214.53.4
dev-box-1 running 54.214.99.5
report-win-1 running 54.214.106.239
tutor-api-1 running None
db-1 running None
you should see Five instances with public addresses, two without. Your addresses will differ.
defender tip A dev box and an old Windows report server facing the internet are exactly what attackers scan for.
List functions, people and networks
aws lambda list-functions --query 'Functions[].[FunctionName,Runtime]' --output text invoice-generator python3.12 tutor-assistant python3.12 thumbnailer python3.12 aws iam list-users --query 'Users[].UserName' --output text maya.admin dev.ravi dev.ines secops old.contractor ci-deploy tutor-bot aws ec2 describe-vpcs --query 'Vpcs[].[CidrBlock,IsDefault]' --output text 172.31.0.0/16 True 10.40.0.0/16 False
you should see Three functions, seven users including two that are machines (ci-deploy, tutor-bot) and two networks.
defender tip Users like old.contractor are worth a second look. People leave, their access often stays.
Check the regions nobody looks at
Every command so far used the default region, eu-west-1. Instances and databases in other regions are invisible to it.
for r in us-east-1 eu-central-1 eu-west-2; do echo "$r $(aws ec2 describe-instances --region $r --query 'length(Reservations)') instances"; done
us-east-1 0 instances
eu-central-1 1 instances
eu-west-2 0 instances
you should see One instance in eu-central-1 that the default view never showed. You will come back to it in the capstone.
defender tip Attackers and forgotten experiments both like regions nobody watches. Inventories must loop over every enabled region.
What a defender takes away
- 1You cannot secure what you have not listed. Inventory comes first.
- 2Each service has its own list command: s3 ls, describe-instances, list-functions, list-users.
- 3Machine users and leftover accounts are as important as people.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.