1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Harden S3 Bucket Configurations via AWS Console
Locate exposed storage buckets in the AWS console and block public lookup access.
- Navigate to the S3 Management Console inside AWS.
- Click on the name of your target storage bucket (e.g.
student-vulnerable-bucket).
- Go to the Permissions tab in the top menu bar.
- Scroll to the Block public access (bucket settings) block, and click Edit.
- Check the box labeled Block *all* public access. Click Save changes, type
confirm in the validation prompt, and click Confirm. This denies external public requests.
STEP 2
Develop a Hardened Dockerfile Container Manifest
Construct a multi-stage Dockerfile that runs application nodes using non-root privileges.
- In your Kali terminal, create a project directory named
node-container.
- Use the multi-stage config in Step 4 to design a secure building template.
- Build and scan the container image using the commands below:
$ sudo docker build -t node-secure:1.0 .
This command runs the local compiler build engine to assemble the image from the Dockerfile.
| Part | What It Does |
|---|
docker | The Docker container runtime CLI tool |
-t | Show only TCP connections |
$ docker run -it --entrypoint whoami node-secure:1.0
This checks the default execution username, confirming it prints node rather than root.
4. Part 2: Complete Deliverable Assets & Production Templates
Below is the complete, secure multi-stage Dockerfile for application compilation:
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# Multi-stage secure Dockerfile configuration baseline
Line 2: This is a comment that describes what the code does: "Multi-stage secure Dockerfile configuration baseline". Comments start with # and are ignored by Python.
FROM node:18-alpine AS builder
Line 3: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
WORKDIR /app
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
COPY package*.json ./
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
RUN npm ci
Line 6: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
FROM node:18-alpine
Line 7: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
WORKDIR /app
Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
COPY --from=builder /app/node_modules ./node_modules
Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
COPY . .
Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# Enforce non-root execution permissions
Line 11: This is a comment that describes what the code does: "Enforce non-root execution permissions". Comments start with # and are ignored by Python.
USER node
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
EXPOSE 8080
Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
CMD ["node", "server.js"]
Line 14: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
# Multi-stage secure Dockerfile configuration baseline
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
FROM node:18-alpine
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY . .
# Enforce non-root execution permissions
USER node
EXPOSE 8080
CMD ["node", "server.js"]
5. Deliverables Summary
Created Files / Templates
- Hardened
Dockerfile configuration file
- Cloud audit summary report listing bucket permissions
Verification Artifacts
- Screenshots showing Block Public Access activated on S3.
- Command output of
docker run printing the non-root execution user.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
