AWS Cloud SOC Lab

A Free Tier SOC lab on AWS. I exposed a Linux EC2 instance, simulated SSH brute-force and port-scanning against it, and traced the activity through VPC Flow Logs and CloudTrail. CloudTrail API activity and EC2 system logs were ingested into Splunk Free, where I wrote SPL searches and dashboards for failed authentication and unusual behaviour, then closed the exposure in the security group.

Anything public-facing in the cloud is exposed to brute-force and scanning. The lab asks a SOC-shaped question: using only native AWS logging and a SIEM, can you see an attack happen, confirm whether it worked, and respond?

Build a small, controlled environment on AWS Free Tier, attack it from outside, and work the incident from the logs: network evidence from VPC Flow Logs, control-plane evidence from CloudTrail, and centralised search and dashboards in Splunk.

EC2

Public-facing Linux instance used as the target

IAM

Admin and security configuration

CloudTrail

API and authentication logging

VPC Flow Logs

Network traffic monitoring

CloudWatch

Log storage and analysis

Splunk Free

Central search over CloudTrail API activity and EC2 system logs

• Simulated unauthorised SSH access attempts (brute-force behaviour), network reconnaissance and port scanning against my own instance.
• Analysed VPC Flow Logs to identify repeated inbound SSH connections from a single external IP.
• Reviewed CloudTrail to confirm no successful authentication occurred, and correlated network and control-plane logs to understand the attacker's behaviour.
• Ingested CloudTrail API activity and EC2 system logs into Splunk Free and built custom SPL queries and dashboards for failed authentication and anomalous user behaviour.
• Responded by restricting SSH in the EC2 security group, reducing public exposure, and documenting the incident.
• Kept it on Free Tier: instances stopped when idle and AWS Budgets configured to prevent surprise charges.

• Simulated SSH brute-force and reconnaissance against resources I own
• VPC Flow Logs showed repeated inbound SSH from a single external IP
• CloudTrail confirmed no authentication attempt succeeded
• CloudTrail and EC2 logs ingested into Splunk Free with custom SPL dashboards
• Response: SSH restricted in the security group and public exposure reduced

• Cloud security monitoring
• Log analysis and correlation
• Incident detection and response
• AWS IAM and network security
• Attack-surface reduction

• All testing was performed against AWS resources I own, for educational purposes.