# SecureCart Journey

SecureCart is an **AWS-native e-commerce platform** that prioritizes **security, scalability, and resilience** across all workloads. As SecureCart expands, **securing workloads and applications** becomes a top priority to protect customer data, maintain compliance, and prevent unauthorized access.

This section focuses on **how SecureCart secures its applications and workloads** in AWS by leveraging AWS security best practices, secure network configurations, and access control mechanisms.

***

## **Secure Application Configuration & Credentials**

**Goal:** Prevent credential leaks and unauthorized access to configuration data.

#### **Implementation**

* **Use AWS Secrets Manager** to store sensitive data such as
  * Database credentials (Amazon RDS PostgreSQL)
  * API keys for payment gateways
  * OAuth tokens for third-party services
* **IAM Role-based access** ensures that
  * Only authorized applications retrieve secrets.
  * Developers do not have direct access to production secrets.
* **AWS Systems Manager Parameter Store** manages **non-sensitive application configurations** securely.

**Use Case:** SecureCart’s ECS Fargate tasks retrieve RDS credentials from AWS Secrets Manager, ensuring credentials are never stored in application code.

***

### **Implement Network Segmentation & Security**

**Goal:** Enforce network-level security to isolate workloads and minimize exposure.

#### **Implementation**

* **VPC Architecture & Segmentation**
  * **Public Subnets** → Only for Load Balancers (ALB) and API Gateway.
  * **Private Subnets** → Application servers, RDS databases, and backend services.
* **Security Groups**
  * Restrict inbound/outbound access for each application component.

#### **Security Group Rules for SecureCart Components**

| **Component**                       | **Traffic Type** | **Source**                     | **Port Range** | **Direction** | **Purpose**                                            |
| ----------------------------------- | ---------------- | ------------------------------ | -------------- | ------------- | ------------------------------------------------------ |
| **Application Load Balancer (ALB)** | HTTP/HTTPS       | 0.0.0.0/0 (Public)             | 80, 443        | Inbound       | Accepts web traffic from customers.                    |
| **Application Load Balancer (ALB)** | HTTP/HTTPS       | VPC CIDR                       | 80, 443        | Outbound      | Sends traffic to backend services.                     |
| **ECS/EC2 Backend Services**        | HTTP             | ALB Security Group             | 8080           | Inbound       | Only allows traffic from ALB.                          |
| **ECS/EC2 Backend Services**        | Database         | RDS Security Group             | 5432           | Inbound       | Allows backend services to connect to RDS.             |
| **ECS/EC2 Backend Services**        | All              | Internet                       | Deny           | Inbound       | Blocks direct internet access.                         |
| **ECS/EC2 Backend Services**        | HTTPS            | S3 (AWS Services)              | 443            | Outbound      | Allows secure connection to AWS services like S3.      |
| **Amazon RDS (PostgreSQL)**         | Database         | ECS/EC2 Backend Security Group | 5432           | Inbound       | Ensures only backend services can access the database. |
| **Amazon RDS (PostgreSQL)**         | All              | Internet                       | Deny           | Inbound       | Blocks unauthorized direct database access.            |
| **Lambda Functions**                | HTTPS            | Internet                       | 443            | Outbound      | Allows Lambda to interact with AWS APIs securely.      |

* **Network ACLs (NACLs)**
  * Provide additional filtering for subnet-level control.

#### **Network ACL (NACL) Rules for SecureCart Subnets**

| **Rule #** | **Subnet Type**                           | **Traffic Type** | **Source/Destination** | **Port Range** | **Direction** | **Action** | **Purpose**                                               |
| ---------- | ----------------------------------------- | ---------------- | ---------------------- | -------------- | ------------- | ---------- | --------------------------------------------------------- |
| 100        | **Public Subnet (ALB)**                   | HTTP/HTTPS       | 0.0.0.0/0 (Internet)   | 80, 443        | Inbound       | Allow      | Allows public web traffic to ALB.                         |
| 110        | **Public Subnet (ALB)**                   | All              | 0.0.0.0/0              | All            | Inbound       | Deny       | Blocks all other inbound traffic.                         |
| 120        | **Public Subnet (ALB)**                   | HTTP/HTTPS       | VPC CIDR               | 80, 443        | Outbound      | Allow      | Allows traffic to backend services.                       |
| 130        | **Public Subnet (ALB)**                   | All              | 0.0.0.0/0              | All            | Outbound      | Deny       | Blocks unintended outbound traffic.                       |
| 200        | **Private Subnet (ECS/Backend Services)** | HTTP             | Public Subnet (ALB)    | 8080           | Inbound       | Allow      | Allows ALB to send traffic to backend services.           |
| 210        | **Private Subnet (ECS/Backend Services)** | Database         | Database Subnet        | 5432           | Inbound       | Allow      | Allows backend services to connect to RDS.                |
| 220        | **Private Subnet (ECS/Backend Services)** | All              | 0.0.0.0/0              | All            | Inbound       | Deny       | Blocks all other inbound traffic.                         |
| 230        | **Private Subnet (ECS/Backend Services)** | HTTPS            | 0.0.0.0/0              | 443            | Outbound      | Allow      | Allows secure AWS API access (e.g., S3, Secrets Manager). |
| 300        | **Database Subnet (RDS)**                 | Database         | Private Subnet (ECS)   | 5432           | Inbound       | Allow      | Ensures only backend services can access the database.    |
| 310        | **Database Subnet (RDS)**                 | All              | 0.0.0.0/0              | All            | Inbound       | Deny       | Blocks unauthorized database access.                      |
| 320        | **Database Subnet (RDS)**                 | All              | 0.0.0.0/0              | All            | Outbound      | Deny       | Prevents unintended outbound connections.                 |

* **AWS WAF (Web Application Firewall)**
  * Protects API Gateway and ALB from attacks like SQL Injection and XSS.

The following **AWS WAF rule set** is applied to **SecureCart’s ALB and API Gateway**.

| **Rule Name**                            | **Type**           | **Action**                       | **Purpose**                                                   |
| ---------------------------------------- | ------------------ | -------------------------------- | ------------------------------------------------------------- |
| Block SQL Injection                      | AWS Managed Rule   | Block                            | Prevents SQL Injection attempts targeting API requests.       |
| Block XSS Attacks                        | AWS Managed Rule   | Block                            | Protects against JavaScript injection in web forms.           |
| Rate Limiting                            | Rate-Based Rule    | Block if > 100 requests in 5 min | Prevents bot-driven brute force attacks.                      |
| Block Known Malicious IPs                | IP Reputation List | Block                            | Uses AWS Threat Intelligence feeds to block malicious actors. |
| Block Requests from Unapproved Countries | Geo-Blocking       | Block                            | Restricts access to SecureCart’s API to U.S. and Europe only. |

**AWS WAF automatically updates managed rulesets**, ensuring **continuous protection** against evolving threats.

* **AWS Shield**
  * Defends SecureCart against **DDoS attacks** on its public endpoints.

**Use Case:** SecureCart’s **RDS database is placed in a private subnet**, ensuring **only ECS tasks** can connect through **Security Groups** and blocking all external access.

***

### **Enforce Secure Application Access**

**Goal:** Implement strong authentication and authorization mechanisms to prevent unauthorized access.

#### **Implementation**

* **Amazon Cognito for Authentication**
  * SecureCart customers authenticate via **Cognito User Pools** before accessing the platform.
* **IAM Role-based Access for Services**
  * **ECS tasks assume IAM roles** to interact with S3 and DynamoDB.
  * **Lambda functions assume roles** to process customer orders securely.
* **API Gateway Authorization**
  * Enforces **Cognito-based authentication** for API endpoints.

**Use Case:** SecureCart’s **API Gateway allows only authenticated Cognito users** to fetch order history, ensuring **unauthorized requests are blocked**.

***

### **Protecting Workloads from External Threats**

**Goal:** Detect, prevent, and mitigate security threats targeting SecureCart’s workloads.

#### **Implementation**

* **AWS GuardDuty**
  * Monitors for **anomalous API calls, unauthorized access attempts, and data exfiltration**.
* **AWS WAF Rules**
  * Blocks **malicious traffic** such as SQL Injection and XSS attacks.
* **AWS Config**
  * Ensures compliance by checking security settings (e.g., **encrypted S3 buckets, security group rules**).
* **AWS CloudTrail**
  * Logs every API request for **security auditing and investigation**.

**Use Case:** If **AWS GuardDuty detects a brute-force attack**, SecureCart **automatically updates WAF rules** to block the attacker’s IP.

***

### **Automating Security & Compliance**

**Goal:** Continuously enforce security controls and automatically respond to threats.

#### **Implementation**

* **AWS Security Hub**
  * Centralizes security findings across **GuardDuty, AWS Config, and IAM Access Analyzer**.
* **AWS Lambda for Automated Security Remediation**
  * Automatically revokes excessive permissions when detected.
  * Disables unused IAM access keys.
* **IAM Access Analyzer**
  * Identifies unintended public access to resources.
* **AWS Config Rules**
  * Ensures encryption is enabled for **S3, RDS, and EBS volumes**.

**Use Case:** SecureCart enforces **automatic encryption** for **new S3 buckets** using an **AWS Config rule**, preventing misconfigurations.