![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/security-pillar-diagram.png\")
<\/figure>\n\n\n\nBelow is the explanation of above architecture diagram:<\/p>\n\n\n\n
- \n
- The user make the request to the application via HTTPS<\/li>\n\n\n\n
- AWS WAF filters the requests for common threat<\/li>\n\n\n\n
- ALB forwards cleaned and filtered request to EC2 instance<\/li>\n\n\n\n
- EC2 runs the backend apps and gets data from RDS<\/li>\n\n\n\n
- NAT gateway allows EC2 to access the internet for updates<\/li>\n\n\n\n
- Bastion host allows a secure SSH connection to EC2<\/li>\n\n\n\n
- Internet gateway connects public subnet with the internet<\/li>\n<\/ol>\n\n\n\n<\/div>\n\n\n\n
Step 1: Insecure Setup – Launch an EC2 Instance with Public Access<\/h2>\n\n\n\n
- \n
- Go to the EC2 Dashboard<\/strong>, click Launch Instance<\/strong>\n
- \n
- Name<\/strong>:
shoppingcart-app<\/code><\/li>\n\n\n\n- AMI<\/strong>: Amazon Linux 2 or Amazon Linux 2023 (both supported)<\/li>\n\n\n\n
- Instance type<\/strong>:
t2.micro<\/code> (Free Tier eligible)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-32.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
- \n
- Key pair<\/strong>: Create and download a new key pair (.pem file) for SSH access <\/li>\n\n\n\n
- Network settings<\/strong>:\n
- \n
- VPC<\/strong>: Use the default VPC<\/li>\n\n\n\n
- Auto-assign public IP<\/strong>: Enable this option<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Security Group settings<\/strong> – Add these inbound rules:<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/05\/image-1.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/05\/image-2.png\")
<\/figure>\n\n\n\n<\/div>\n\n\n\nStep 2: Insecure Setup – Install Node.js and Run the Application<\/h2>\n\n\n\n
We are simulating a web application deployment where the servers were setup without proper security<\/p>\n\n\n\n
Connect to EC2 instance with the .pem key<\/p>\n\n\n\n
ssh -i your-key.pem ec2-user@<your-ec2-public-ip><\/code><\/pre>\n\n\n\nand then install Node.js using nvm<\/p>\n\n\n\n
curl -o- https:\/\/raw.githubusercontent.com\/nvm-sh\/nvm\/v0.40.4\/install.sh | bash\nexport NVM_DIR=\"$HOME\/.nvm\"\nsource \"$NVM_DIR\/nvm.sh\"\nnvm install 24\nnvm use 24<\/code><\/pre>\n\n\n\nCreate the Shopping Cart application<\/p>\n\n\n\n
mkdir shoppingcart && cd shoppingcart\nmkdir public\n\ncat <<EOF > public\/index.html\n<!DOCTYPE html>\n<html>\n<head><title>ShoppingCart<\/title><\/head>\n<body><h1>Welcome to ShoppingCart<\/h1><p>This is the insecure Demo Page<\/p><\/body>\n<\/html>\nEOF\n\ncat <<EOF > server.js\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\nconst server = http.createServer((req, res) => {\n const filePath = path.join(__dirname, 'public', req.url === '\/' ? 'index.html' : req.url);\n fs.readFile(filePath, (err, content) => {\n if (err) {\n res.writeHead(404); res.end('Not Found');\n } else {\n res.writeHead(200); res.end(content);\n }\n });\n});\nserver.listen(80);\nEOF<\/code><\/pre>\n\n\n\nGet the full path to Node.js and copy the output<\/p>\n\n\n\n
[ec2-user@ip-172-31-18-36 shoppingcart]$ which node\n~\/.nvm\/versions\/node\/v24.16.0\/bin\/node<\/code><\/pre>\n\n\n\nStart the application<\/p>\n\n\n\n
# Get the full path to Node.js
which node
# Copy the output path (e.g., \/home\/ec2-ser\/.nvm\/versions\/node\/v24.16.0\/bin\/node) Please adjust the node version on your own installation
# Start the server using the full path (& makes sure the task runs on background to keep terminal functional for operations)
sudo \/home\/ec2-user\/.nvm\/versions\/node\/v24.16.0\/bin\/node server.js &<\/pre>\n\n\n\nTest the application by opening it using the EC2 instance public IP<\/p>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image.png\")
<\/figure>\n\n\n\n<\/div>\n\n\n\nStep 3: Insecure Setup – Deploy a Public RDS Instance<\/h2>\n\n\n\n
Again, we are simulating the most common miss-configuration in deploying database service which makes it publicly exposed to the public internet due to initially deployment for quick access.<\/p>\n\n\n\n
- \n
- Go to Aurora and RDS Dashboard<\/strong>, click Create Database<\/strong><\/li>\n\n\n\n
- Choose Easy Create and change the value later after database launched<\/li>\n\n\n\n
- Engine options<\/strong>:\n
- \n
- Creation method<\/strong>: Standard Create<\/li>\n\n\n\n
- Engine<\/strong>: MySQL<\/li>\n\n\n\n
- Template<\/strong>: Free Tier<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
<\/p>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-6.png\")
<\/figure>\n\n\n\n- \n
- Settings<\/strong>:\n
- \n
- DB instance identifier: <\/strong>
shoppingcart-db<\/code><\/li>\n\n\n\n- Master username:<\/strong>
admin<\/code><\/li>\n\n\n\n- Set a simple password<\/strong> (for example,
Secret123!<\/code>)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-2.png\")
<\/figure>\n\n\n\n- \n
- Connectivity<\/strong> (Here is where the critical security issues<\/strong> are happening<\/strong>):\n
- \n
- VPC<\/strong>: Default VPC<\/li>\n\n\n\n
- Public access<\/strong>: YES<\/strong> (Major vulnerability – never do this in production<\/strong>)<\/li>\n\n\n\n
- VPC security group<\/strong>: Create new or use existing<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-3.png\")
<\/figure>\n\n\n\nSecurity Group Configuration<\/strong> on EC2<\/strong>:<\/p>\n\n\n\n
- \n
- Edit the security group to add:<\/li>\n\n\n\n
- Inbound rule<\/strong>: MySQL\/Aurora (port 3306) from
0.0.0.0\/0<\/code><\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-4.png\")
<\/figure>\n\n\n\n<\/div>\n\n\n\nStep 4: Insecure Setup – Create Public S3 Bucket<\/h2>\n\n\n\n
In here, we are demonstrating how S3 bucket miss-configuration can lead to accidentally sensitive data to be exposed.<\/p>\n\n\n\n
- \n
- Go to S3 Dashboard<\/strong>, click Create Bucket<\/strong> \n
- \n
- Name the bucket:
shoppingcart-insecure-demo<\/code>. (Ensure the name has to be globally unique) <\/li>\n\n\n\n- Choose the same region as your EC2 instance.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-7.png\")
<\/figure>\n\n\n\n- \n
- Under Block Public Access settings<\/strong>:\n
- \n
- Uncheck Block all public access<\/strong><\/li>\n\n\n\n
- Acknowledge the warning prompt<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-8.png\")
<\/figure>\n\n\n\nClick Create Bucket<\/p>\n\n\n\n
- \n
- Upload a Sample File\n
- \n
- Click into your newly created bucket \u2192 Upload<\/strong> tab<\/li>\n\n\n\n
- Upload a sample file, such as
shoppingcart-logo.png<\/code>, and click Upload<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-10.png\")
<\/figure>\n\n\n\n- \n
- Apply Dangerous Bucket Policy\n
- \n
- Go to the Permissions<\/strong> tab of the bucket.<\/li>\n\n\n\n
- Scroll to Bucket Policy<\/strong> \u2192 click Edit<\/strong><\/li>\n\n\n\n
- Paste the following policy and save (Modify the resource value accordingly to your bucket name):<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowPublicReadAccessToObjects\",\n \"Effect\": \"Allow\",\n \"Principal\": \"*\",\n \"Action\": \"s3:GetObject\",\n \"Resource\": \"arn:aws:s3:::shoppingcart-insecure-demo\/*\"\n }\n ]\n}<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-11.png\")
<\/figure>\n\n\n\nThis allows all users (even unauthenticated) to read any object in this bucket.<\/p>\n\n\n\n
- \n
- Verify Public Access\n
- \n
- Go back to the uploaded object (
shoppingcart-logo.png<\/code>)<\/li>\n\n\n\n- Copy the Object URL<\/strong> (visible at the top)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/ichwanchandra.com\/blog\/wp-content\/uploads\/2026\/01\/image-12.png\")
<\/figure>\n\n\n\n- \n
- Open it in an incognito\/private browser window <\/li>\n\n\n\n
- The file should be accessible without any authentication via below URL:<\/li>\n<\/ul>\n\n\n\n
https://shoppingcart-insecure-demo.s3.us-east-1.amazonaws.com\/shoppingcart-logo.png<\/code><\/pre>\n\n\n\n
- Copy the Object URL<\/strong> (visible at the top)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- Go back to the uploaded object (
- Scroll to Bucket Policy<\/strong> \u2192 click Edit<\/strong><\/li>\n\n\n\n
- Go to the Permissions<\/strong> tab of the bucket.<\/li>\n\n\n\n
- Upload a sample file, such as
- Click into your newly created bucket \u2192 Upload<\/strong> tab<\/li>\n\n\n\n
- Acknowledge the warning prompt<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- Uncheck Block all public access<\/strong><\/li>\n\n\n\n
- Choose the same region as your EC2 instance.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
- Name the bucket:
- Go to S3 Dashboard<\/strong>, click Create Bucket<\/strong> \n
- Public access<\/strong>: YES<\/strong> (Major vulnerability – never do this in production<\/strong>)<\/li>\n\n\n\n
- VPC<\/strong>: Default VPC<\/li>\n\n\n\n
- Master username:<\/strong>
- DB instance identifier: <\/strong>
- Engine<\/strong>: MySQL<\/li>\n\n\n\n
- Auto-assign public IP<\/strong>: Enable this option<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- Network settings<\/strong>:\n
- AMI<\/strong>: Amazon Linux 2 or Amazon Linux 2023 (both supported)<\/li>\n\n\n\n
- Name<\/strong>:
- Go to the EC2 Dashboard<\/strong>, click Launch Instance<\/strong>\n