Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
YouTube Security VideosGoogle Cloud Tech: Gemini is coming to your city(24.09.2026 um 15:00 Uhr)
•
AI & KI NachrichtenGoogle’s latest moonshot to put machine learning in space(24.09.2026 um 15:12 Uhr)
•
Windows Tipps & SecurityPoll: What's your favorite Surface of 2026?(24.09.2026 um 14:58 Uhr)
•••
Sichere ProgrammierungStreaming Materialized Views for Live Read Models (2026)(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungA Day Is Not 86400 Seconds: The DST Bug in Your Date Math(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungSetting up Traefik: reverse proxy with automatic HTTPS(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungA 200 OK response does not prove a secret leak(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungHow hot do you like it?(24.09.2026 um 15:05 Uhr)
•
YouTube Security VideosGoogle Cloud Tech: Gemini is coming to your city(24.09.2026 um 15:00 Uhr)
•
AI & KI NachrichtenGoogle’s latest moonshot to put machine learning in space(24.09.2026 um 15:12 Uhr)
•
Windows Tipps & SecurityPoll: What's your favorite Surface of 2026?(24.09.2026 um 14:58 Uhr)
•••
Sichere ProgrammierungStreaming Materialized Views for Live Read Models (2026)(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungA Day Is Not 86400 Seconds: The DST Bug in Your Date Math(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungSetting up Traefik: reverse proxy with automatic HTTPS(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungA 200 OK response does not prove a secret leak(24.09.2026 um 15:02 Uhr)
•
Sichere ProgrammierungHow hot do you like it?(24.09.2026 um 15:05 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

The Cloud Resume Challenge: a perfect way to explore the cloud

I came across The Cloud Resume Challenge by Forrest Brazeal while studying for my AWS CCP exam, and without much thought, I added the website to my bookmarks. I was certain that at some point, I would take on the challenge, as it seemed…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I came across The Cloud Resume Challenge by Forrest Brazeal while studying for my AWS CCP exam, and without much thought, I added the website to my bookmarks. I was certain that at some point, I would take on the challenge, as it seemed like a great opportunity to gain hands-on experience with AWS. And… I did — after passing my exam, I started working on the project.






Getting started



At the very beginning, I had to set up my AWS personal development environment to ensure that my account (and my wallet!) was properly protected. To do so, I decided to use AWS Organizations. I created a "root" AWS account and set up an AWS Organization with an Organizational Unit (OU) inside it. Under the OU, a new AWS account was created, and this was the account used to create any resources related to the project.

Finally, I set up SSO (Single Sign-On) in the "root" account to log into the "project" account. This was done via AWS IAM Identity Center. After spending some time browsing the internet to learn how to do it — and what I was actually doing — it worked, and I was able to log in to IAM Identity Center via the CLI.






Frontend



At this stage of the project, I used a dummy HTML file, as I planned to build and style the website at the end of the challenge. I already had some experience with creating websites, so this part wasn’t new to me. For styling, I used Tailwind CSS instead of the "vanilla" CSS suggested in the challenge.

After my HTML skeleton was ready, I uploaded it to an S3 bucket as a static website. Then, I created a distribution in Amazon CloudFront, which the S3 bucket was configured to serve through, and connected it to an external domain registrar (Cloudflare). This gave me some trouble with AWS Certificate Manager during DNS validation, but a bit of Googling saved the day, and everything was ready — my website was accessible via my custom domain name and was using HTTPS for security.

Last but not least, I decided to create a GitHub repository for the project right from the beginning, so it would be easier to track changes along the way.






Backend



To track the number of visitors to my website, I built a simple backend using AWS services. I started by creating a DynamoDB table to store the visitor count. Then, I wrote a Python-based Lambda function that increments and retrieves the count from the database. This function was triggered via an API Gateway configured as a REST API.

To make the backend accessible from the frontend, I deployed the Lambda function behind the API Gateway endpoint and enabled CORS. I also added basic validation and error handling to ensure the function responds reliably.

Creating a DynamoDB table was pretty straightforward. I already had some experience writing Python scripts, so the biggest challenge was properly configuring the API Gateway — making sure all the necessary methods were defined and that the Lambda function had permission to invoke the API. However, it wasn’t anything that would make me lose sleep over it.






Integration



Now it was time to tie the frontend and backend together and allow them to communicate. The first step was to write a simple JavaScript script that would make an API call to the backend via API Gateway, retrieve the visitor count, and display it on the website. I had to refresh my memory a bit about async functions in JavaScript, but overall, everything came together smoothly.

This part also involved writing smoke tests for the API. To do that, I chose Cypress. I hadn’t had the opportunity to create automated tests before, so this was completely new to me. After some Googling, I was ready to start — it turned out that Cypress is very user-friendly and only needs to know what output your URL should return in response to a given input.

I managed to prepare the following tests:




  1. Check if the counter is correctly incremented.

  2. Check if the API returns a 400 error when an invalid request body is passed.

  3. Check if the API returns a 405 error when an unsupported HTTP method is used.

  4. (Additional test, not part of cypress.config.js) Check if the DynamoDB item is initialized correctly. This one was created for experimental/learning purposes. To run it properly, the item with the count must be deleted first. In my Lambda function, I added a snippet that checks whether such an item exists in the database — and if not, it initializes it.



API tests results






Automation/CI



Up until this point, every AWS resource had been created manually through the AWS Console — but here comes the magic word: automation.

Infrastructure as Code was definitely one of the most challenging parts of the entire project. I decided to use Terraform to manage it, as learning it had been on my to-do list for a while. I had a hard time structuring my .tf files — I wanted the setup to be simple, yet “professional”.

In the end, I decided to organize my folder structure into modules, and I think it was a good call. Navigating through them is straightforward and intuitive.



Terraform folder structure

SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - The Cloud Resume Challenge: a perfect way to explore the cloud
id: b4b7c29b-a39b-49c8-be42-df91bc331e4a
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "The Cloud Resume Challenge: a " ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich The Cloud Resume Challenge: a perfect wa.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten The Cloud Resume Challenge: a perfect way to explore the cloud

Thematisch verwandte Begriffe: Cloud, Resume, Challenge, perfect · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97152 | Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploi…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger • Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick