eheler.tech
Home / Projects / Terraform Security Lab

Case study · Infrastructure as code

Terraform Security Lab

A reproducible AWS lab built to practice infrastructure security decisions and generate controlled telemetry for detection validation.

View repositorySee detection project

Architecture

Terraform execution identity ↓ IAM role separation ↓ AWS VPC ├── public subnet ├── private subnet ├── security groups └── EC2 ↓ AWS Systems Manager access ↓ CloudTrail / VPC Flow Log telemetry

The lab is a reusable AWS environment built through Terraform. It includes VPC networking, public and private subnets, security groups, EC2, IAM roles, and Systems Manager access without exposing SSH.

Security decisions

Administration without exposed SSH

Instance administration uses AWS Systems Manager rather than opening an inbound SSH management port. This reduces exposed management surface and avoids relying on a public SSH path for routine access.

Permission separation

Administrative permissions and Terraform execution permissions are separated through IAM roles. The lab is designed so infrastructure deployment and normal administration are not treated as the same identity context.

Telemetry as part of the design

The environment is also used as a controlled telemetry source. Saved project output shows VPC Flow Logs delivered to CloudWatch Logs and encrypted with a customer-managed KMS key with rotation enabled.

That makes the lab more than an infrastructure exercise: it provides known activity that can be compared against detection output from the CloudTrail Security Monitor and normalized network telemetry used by the detection lab.

Validation workflow

Controlled Terraform activity is used to create known AWS API behavior. The resulting CloudTrail events provide ground truth for validating detections such as VPC deletion and EC2 instance termination, including successful and failed activity.

This workflow keeps the cloud environment and detection project connected: infrastructure changes create predictable telemetry, and the detection tooling is evaluated against those known changes.

Why this project matters

The project demonstrates infrastructure-as-code, AWS networking, IAM role separation, secure administrative access, and telemetry-aware design in one reproducible environment. It also provides a controlled place to test security automation without presenting the lab as equivalent to production cloud-security tenure.