labs/lab-3/LAB-REPORT.md

# Lab 3

## Prep
- [x] Gitea set up
- [x] MFA set up
- [x] Add git ignore
- [x] Secrets/Token Management
    - [x] Consider secret-scanning
      - [x] Added git-leaks on pre-commit hook
- [x] Create & Connect to a Git*** repository
  - [x] https://git.dropbear-minnow.ts.net/
- [x] Modify and make a second commit
    ![image of terminal](./assets/prep-console.png)
- [x] Test to see if gitea actions works
- [x] Have an existing s3 bucket

## Resources
- [x] [Capital One Data Breach](./assets/Capital%20One%20Data%20Breach%20—%202019.%20Introduction%20_%20by%20Tanner%20Jones%20_%20Nerd%20For%20Tech%20_%20Medium.pdf)
- [x] [Grant IAM User Access to Only One S3 Bucket](./assets/Grant%20IAM%20User%20Access%20to%20Only%20One%20S3%20Bucket%20_%20Medium.pdf)
- [ ] [IAM Bucket Policies](./assets/From%20IAM%20to%20Bucket%20Policies_%20A%20Comprehensive%20Guide%20to%20S3%20Access%20Control%20with%20Console,%20CLI,%20and%20Terraform%20_%20by%20Mohasina%20Clt%20_%20Medium.pdf)
- [ ] [Dumping S3 Buckets!](https://www.youtube.com/watch?v=ITSZ8743MUk)

## Lab
- [x] create a custom IAM Policy
- [x] create an IAM Role for EC2
  ![trust relationships](./assets/trust-relationships.jpg)
  ![permissions](./assets/permissions.jpg)
- [x] Attach the Role to your EC2 Instance
- [x] Verify is3 access from the EC2 Instance
  * HTTPS outbound was not set up
    * I did not check outbound rules (even when the lab explicitly called this out)
      because it mentioned lab 2, so my assumption was that it had already been set up
      (it was not). When connection to s3 failed I double checked lab 3 instructions
  ![screenshot of listing s3 contents](./assets/s3-access-screenshot.jpg)

### Stretch
- [ ] Create a bucket policy that blocks all public access but allows your IAM role
- [ ] **Experiment** with requiring MFA or VPC conditions.
  - [ ] MFA conditions
    * MFA did not work out of the box after setting it in the s3 bucket policy. 
      The ways I found you can configure MFA:
      * [stackoverflow](https://stackoverflow.com/questions/34795780/how-to-use-mfa-with-aws-cli)
        * via cli roles
        * configuration via ~/.aws/credentials
        * 1Password CLI with AWS Plugin
          * I use bitwarden, which also has an AWS Plugin
          * This is probably what I will gravitate towards for a more 
            long-term setup, because having all of these credentials
            floating around in various areas on my computer/virtualbox
            envs gets confusing. Not a fan.
          * I've seen a lot more recommendations (TBH it's more like 2 vs 0)
            for 1password for password credential setup. Wonder why?
        * other apps that handle this
          * I did not look into this because I didn't want to install
            yet another specialized CLI that I didn't understand
  - [ ] VPC
- [ ] **Host a static site**
  - [ ] Enable a static website hosting (`index.html`)
  - [ ] Configure route 53 alias or CNAME for `resume.<yourdomain>` to the bucket endpoint.
  - [ ] Deploy CloudFront with ACM certificate for HTTPS
  #### Private "Innvite-Only" Resume Hosting
  1. **Pre-signed URLs**
    `aws s3 presign s3://<YOUR_BUCKET_NAME>/resume.pdf --expires-in 3600`
  2. **IAM-only access**
    - [ ] Store under `private/`
    - [ ] Write a bucket policy allowing only the role `EC2-S3-Access-Role-daphodell` to `GetObject`
  3. **Restrict to IP address**
    - [ ] copy pasta json into bucket policy

## Further Reading
- [ ]
- [ ] 
- [ ] 

## Reflection
* What I built
* Challenges
* Security concerns
  On scale and security at scale

## Terms
### Identity Access Management
```mermaid
graph LR
  IAMPolicy -- attaches to --> IAMIdentity
  ExplainIAMIdentity[users, groups of users, roles, AWS resources]:::aside
  ExplainIAMIdentity -.-> IAMIdentity
  
  classDef aside fill:#fffbe6,stroke:#bbb,stroke-dasharray: 5 5,stroke-width:2px;
```

## Problems encountered

    more carefully. Note to self: always double check.

## End lab
- [ ] On June 20, 2025, do the following:
  - [ ] Clean up
    - [ ] Custom roles
    - [ ] Custom policies
  - [ ] Stop ec2 Instance
  - [ ] Remove s3 bucket