Technical Documentation
Comprehensive technical reference for the AWS Student Data Infrastructure project. This documentation covers architecture decisions, security controls, operational procedures, and compliance requirements — designed for cloud engineers, security teams, and technical reviewers.
6
Documentation Sections
7
Security Controls
4
Compliance Standards
Quick Navigation
Jump to Section
01
Architecture Summary
Three-tier VPC design with network isolation
02
Design Goals
Core objectives and architectural principles
03
Security Controls
Defense-in-depth implementation details
04
Technology Stack
AWS services and automation tools
05
Compliance
FERPA, CIS, and regulatory alignment
06
Resources
Interactive tools and additional materials
Architecture Summary
Production ReadyThe infrastructure implements a production-grade three-tier architecture optimized for security, compliance, and high availability.
Public Tier
172.32.1.0/24
NAT Gateway, Bastion Host, IGW Attached
Application Tier
172.32.10.0/24
ECS Fargate, Lambda, ALB
Database Tier
172.32.20.0/24
RDS PostgreSQL, No Internet
Security Layer
Cross-VPC
CloudTrail, GuardDuty, KMS
Network Isolation
Database tier has no internet gateway route; access only via app tier security groups
Encryption Everywhere
Customer-managed KMS keys for all data with automatic rotation
Complete Visibility
CloudTrail, VPC Flow Logs, and GuardDuty for comprehensive monitoring
Multi-AZ Deployment
Spans us-east-1a and us-east-1b for high availability
VPC Endpoints
Private access to S3, KMS, and CloudWatch without internet transit
NAT Gateway
Secure outbound-only access for patching and updates
Core Design Goals
FERPA Alignment
Maintain data isolation and access controls aligned with educational privacy requirements and Family Educational Rights and Privacy Act compliance.
Zero Public Exposure
Eliminate all public attack surfaces through network segmentation and private subnet deployment for sensitive resources.
Least Privilege
Enforce IAM least privilege access, multi-factor authentication requirements, and role-based access control throughout.
Full Auditability
Ensure complete audit trail via CloudTrail, VPC Flow Logs, and GuardDuty for compliance and security monitoring.
Defense-in-Depth
Implement multiple security layers at each tier including network, application, and data protection controls.
High Availability
Enable multi-AZ deployment with automated failover for business continuity and disaster recovery.
Security Controls
Comprehensive security controls implemented across all infrastructure layers:
Network Isolation
Database tier has no internet gateway route; access only via application tier security groups
Active
Encryption at Rest
Customer-managed KMS keys for all data (RDS, S3, EBS volumes) with automatic key rotation
Active
Encryption in Transit
TLS 1.2+ for all data transmission; RDS SSL connections required
Active
Access Control
Tag-based S3 access policies, IAM conditions, and security group rules with least privilege
Active
Threat Detection
GuardDuty threat detection, CloudWatch alarms, and automated response workflows
Active
Audit Logging
Complete audit trail of all API calls (CloudTrail), network traffic (Flow Logs), and security events
Active
Backup & Recovery
Automated RDS backups with 7-day retention, S3 versioning, and cross-region replication
Active
Technology Stack
Core AWS services and technologies powering the infrastructure:
Networking
AWS VPC
Security Groups
NACLs
NAT Gateway
Internet Gateway
VPC Endpoints
Compute
EC2
ECS Fargate
Lambda
ALB
Database & Storage
RDS PostgreSQL
Multi-AZ
S3
EBS
Security
IAM
KMS
CloudTrail
GuardDuty
AWS WAF
Monitoring
CloudWatch
VPC Flow Logs
CloudWatch Logs
SNS Alerts
Automation
Python 3.11
Boto3 SDK
AWS CLI
Custom Scripts
Compliance & Standards
The infrastructure aligns with industry standards and regulatory requirements:
FERPA
Educational Privacy
Family Educational Rights and Privacy Act alignment for student data protection with proper access controls and audit trails.
CIS
AWS Foundations
Center for Internet Security AWS Foundations Benchmark compliance for cloud infrastructure configuration.
WAF
Well-Architected
AWS Well-Architected Framework security pillar best practices including encryption and monitoring.
SOC 2
Security Controls
Aligned with SOC 2 Type II requirements for data security, availability, and confidentiality.
Additional Resources
Explore related documentation and interactive tools:
Detailed Architecture
In-depth architecture documentation with animated network diagrams and component details.
Explore Architecture →
Interactive Diagram
Explore the VPC architecture visually with clickable components and live traffic simulation.
Launch Diagram →
IAM Automation
Learn about the automated provisioning workflow and Python Boto3 implementation.
View Automation →
Security Simulator
Test and understand how security controls defend against common attack vectors.
Launch Simulator →
Cost Calculator
Estimate infrastructure costs with real AWS pricing and ROI analysis.
Calculate Costs →
Project Review
View evaluation results, technical achievements, and skills demonstrated.
View Review →