🎖️

Cloud guardrail drills

The preventive controls behind a real ATO — written as actual AWS policy JSON. Lock workloads to GovCloud regions, enforce TLS and KMS encryption, require classification tags, protect the audit trail, and bound permissions. Every drill is graded live in your browser against the real JSON — no AI, no autocomplete.

Why this matters:in the shared-responsibility model, a FedRAMP/IL authorization doesn't cover your configuration — a public bucket or a workload in the wrong region is on you. These SCPs and bucket policies are how the frameworks in the decks become enforced boundaries no account can bypass.

🌎

Region & residency guardrails

0/1 done

Keep regulated workloads inside approved GovCloud regions. Write AWS Organizations Service Control Policies (SCPs) — org-wide, mandatory guardrails no account can override — graded as real JSON in your browser.

1. Lock the org to GovCloud regions (SCP)Write an AWS Organizations Service Control Policy that DENIES every action when the request is NOT in an approved GovCloud region. Use one statement:medium

🔒

Encryption & transport

0/2 done

Enforce encryption in transit and at rest with S3 bucket policies — deny non-TLS access and reject uploads that aren't KMS-encrypted. The controls that keep CUI/classified-adjacent data protected.

1. Deny non-TLS access to a bucketWrite an S3 bucket policy statement that DENIES all S3 access when the connection is NOT encrypted (HTTP instead of HTTPS):medium 2. Require KMS encryption on uploadWrite an S3 bucket policy statement that DENIES an upload unless it is encrypted with SSE-KMS:hard

🏷️

Data governance & audit

0/3 done

Require data-classification tags, protect the audit trail, and bound permissions with a permissions boundary — the preventive controls behind a real ATO and the shared-responsibility model.

1. Require a data-classification tag (SCP)Write an SCP statement that DENIES launching an EC2 instance unless a "Classification" tag is provided:hard 2. Protect the audit trail (SCP)Write an SCP statement that stops anyone from tampering with CloudTrail auditing. One Deny statement covering BOTH actions:medium 3. Bound permissions to approved servicesWrite an IAM permissions-boundary policy that ALLOWS only the approved services (it caps the MAX permissions an identity can have). One statement:medium