Automatizované nasazení bezpečnostní infrastruktury v AWS pomocí Infrastructure-as-Code

This master's thesis addresses the growing importance of security in cloud environments and focuses on the design and implementation of a security framework within Amazon Web Services. As organizations migrate to the cloud, new risks arise, particularly regarding misconfigurations and identity management, which traditional manual processes cannot effectively address. Therefore, the goal of this thesis is to create an automated, consistent, and auditable solution based on Infrastructure-as-Code and Security-as-Code principles, aimed at minimizing the risk of human error. The theoretical part analyzes the specifics of cloud security, the Shared Responsibility Model, and modern DevSecOps approaches. Furthermore, it details the concept of Infrastructure-as-Code and the architecture of the Terraform tool, which form the technological foundation of the entire work. Building on these foundations, the practical part describes the development of a modular framework using this tool. The solution integrates key native AWS services – CloudTrail for audit logging, AWS Config for compliance, Amazon GuardDuty for threat detection, and IAM Access Analyzer and Security Hub for centralized monitoring. The framework's functionality is validated on a model infrastructure through a set of testing scenarios simulating real-world threats, such as exposing sensitive data in a public S3 bucket, using unencrypted storage, or abusing excessive IAM permissions. The outcome of the thesis is a practically usable tool that enables even smaller organizations to quickly deploy robust security standards without the need for complex configuration.