Build an AI Security Guard for AWS

Build an automated S3 security scanner that detects AWS vulnerabilities and uses AI to automatically fix them. Prevent the breaches that cost Capital One $150M+

Introduction

This project has been archived

We're no longer updating this project - we recommend checking out our active projects instead!

If you've already completed this project, don't worry! Your documentation is still available for you to check out and share.

If you have any questions, leave a question in our Discord and we'll get back to you ASAP!

⚡️ 30 second Summary

Enterprise security teams at companies like Netflix, Airbnb, and Stripe use tools like Amazon GuardDuty, Security Hub, and Prowler to automatically monitor thousands of AWS resources against security best practices. When they find issues, they fix them fast using automated remediation.

In 2019, a misconfigured S3 bucket at Capital One exposed 100 million customer records. In 2025, the Codefinger ransomware group encrypted S3 data at multiple companies. These breaches share a common thread: preventable S3 security misconfigurations that automated scanning could have caught.

Most teams check AWS security manually through the console, read compliance reports, hope for the best... or they could automate it.

Professional security teams use AI-powered scanners - tools that analyze AWS resources instantly and catch issues before they become breaches. In this project, you'll build one: write a scanner, run it, and see vulnerabilities with severity ratings.

What you'll build

In this project, you'll use Python with boto3 and Cursor with AWS MCP to build an AI security guard that detects and automatically fixes AWS misconfigurations.

Do I need an AWS account?

Yes! Complete Set Up An AWS Account for Free first. The free tier is more than enough for this project.

💡 Why AWS MCP for security?

AWS MCP bridges Cursor's AI with your AWS account through boto3. Instead of manually writing fix commands, you tell Cursor "fix all critical S3 buckets" and it executes the boto3 API calls for you. Professional security teams use similar AI-assisted workflows to remediate faster.

💡 New to AWS security?

You don't need any prior security or AWS experience. This project teaches you how to scan AWS resources and craft automated fixes using AI.

Not sure if this project is right for you? Check if it matches your goals

How you'll build it:

First, you'll write a security scanner that checks your S3 buckets for public access misconfigurations. Then, you'll configure AWS MCP in Cursor so you can fix issues through conversation.

By the end of this project, you'll have:

  • A working security scanner that detects S3 misconfigurations with severity ratings.
  • An AI-powered fix workflow using Cursor + AWS MCP to remediate issues automatically.
  • 💎 Secret Mission: Use AI to automatically fix all security issues through natural language.

Before you begin, try this quick quiz to get familiar with the concepts:

Set Up Your Security Automation Environment

Let's get your environment ready for AWS security scanning! We'll install Python, the AWS CLI, boto3, and configure your AWS credentials - everything you need to scan and secure your cloud infrastructure.

In this step, you're going to:

  • Install Python 3.12+
  • Install the AWS CLI
  • Set up your AWS credentials
  • Install boto3 and uv
  • Create your project folder

Install Python 3.12+

Why Python 3.12+?

Python is the language we'll use to write our AWS security scanner. We need version 3.12 or higher because it includes modern security features and compatibility with the latest boto3 (AWS SDK) library. Python 3.12+ also has better performance and improved error messages that make debugging easier.

Check what Python version you have installed.

Open your terminal:

  • Windows: Press Win key and type PowerShell
  • macOS: Press Cmd+Space and type Terminal

Run this command:

🍎 macOS

python3 --version

🖼️ Windows

python --version

What do you see?

✅ I see a version number

You have Python installed. You should see something like:

Python 3.12.0

Need Python 3.12+?

This project requires Python 3.12 or higher. If you see an older version like Python 3.10.x, visit python.org/downloads to download and install the latest version.

  • Continue to the next section.

❌ Command not found

You don't have Python installed yet.

  • Download the latest Python 3 installer.
  • Run the installer.
  • Important: Check the box that says "Add python.exe to PATH".
  • Click Install Now and complete the installation.
  • Close the installer.
  • Restart your terminal (close and reopen it).
  • Verify the installation:
python --version

You should now see the Python version number!

Still seeing "command not found"?

Make sure you restarted your terminal after installation. If it still doesn't work, try restarting Cursor completely.

Install AWS CLI

What is the AWS CLI?

The AWS Command Line Interface (CLI) is a tool that lets you interact with AWS services from your terminal. Instead of clicking through the AWS Console web interface, you can run commands like aws s3 ls to list S3 buckets or aws configure to set up your credentials. We'll use it to configure credentials and verify your AWS connection is working.

Check if you have the AWS CLI installed.

Open your terminal:

  • Windows: Press Win key and type PowerShell
  • macOS: Press Cmd+Space and type Terminal

Run this command:

aws --version

What do you see?

✅ I see a version number

Perfect! AWS CLI is already installed and ready to use. You should see something like:

aws-cli/2.15.0 Python/3.11.6 Darwin/23.0.0 source/arm64
  • Continue to the next section.

❌ Command not found

AWS CLI isn't installed yet. Let's install it.

🍎 macOS

In your terminal, run these commands:

curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "AWSCLIV2.pkg"
sudo installer -pkg AWSCLIV2.pkg -target /

The installer will run and install AWS CLI.

Verify installation:

aws --version

You should see the AWS CLI version number!

🖼️ Windows

In your PowerShell terminal, run this command:

msiexec.exe /i https://awscli.amazonaws.com/AWSCLIV2.msi

The installer will open. Click Next on the Welcome screen.

Check "I accept the terms in the License Agreement" and click Next.

Click Next on the Custom Setup screen (accept defaults).

Click Install to begin installation.

Wait for the installation to complete.

Click Finish when installation completes.

Open a new PowerShell window and run:

aws --version

What do you see?

✅ I see a version number

Perfect! AWS CLI is installed. You should see something like:

  • Continue to the next section.
❌ I don't see a version

If you don't see the AWS CLI version:

  • Make sure you opened a new PowerShell window after installation
  • Try closing all PowerShell windows and opening a fresh one
  • Restart your computer if needed
Still stuck?

Ask Claude for help with AWS CLI installation. You can also ask the NextWork community!

Configure AWS Credentials

What are AWS credentials and why do we need them?

AWS credentials (Access Key ID and Secret Access Key) authenticate your programmatic access to AWS. The security scanner we're building needs these to call the AWS API and access your S3 buckets. An API (Application Programming Interface) lets your code talk directly to AWS services - instead of clicking buttons in the console, your scanner sends requests to AWS and gets data back. Keep these credentials secure - never commit them to version control.

Check if you have AWS credentials configured.

Open your terminal:

  • Windows: Press Win key and type PowerShell
  • macOS: Press Cmd+Space and type Terminal

Run this command:

aws sts get-caller-identity

What do you see?

✅ I see my AWS account information

Perfect! Your credentials are configured and working. You should see something like:

{
    "UserId": "AIDAI23XXXXXXXXXXX",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/your-username"
}
  • Continue to the next section.

❌ Error or credentials not found

Let's configure your AWS credentials.

I already have access keys

How do I check if I have access keys?

Run aws sts get-caller-identity in your terminal. If you see your account info, you have working credentials. If you get an error, you need to create access keys.

Run the AWS configure command:

aws configure

Enter your AWS information when prompted:

  1. AWS Access Key ID: Your access key (from AWS Console)
  2. AWS Secret Access Key: Your secret key (from AWS Console)
  3. Default region: e.g., us-east-1
  4. Default output format: json
What region should I use?

Check your AWS Console - your current region is shown in the top-right corner next to your username. Use that region code (e.g., us-east-1, ap-southeast-2).

Verify your credentials are working:

aws sts get-caller-identity

You should see your AWS account ID and user information!

Ahhh! I don't have access keys!

Let's create a new IAM user and get access keys.

  • Search for IAM.
  • Hover over IAM
  • Click on IAM under Top features'.
  • Click Users in the left sidebar, then click Create user button.
  • Enter a username (e.g., "MyAccessKey") and click Next.
  • Select Attach policies directly.
  • Search for AdministratorAccess, check the AdministratorAccess policy.
  • Click Next.
  • Click Create user.

You'll see "User created successfully". Go back to Users

  • Click on your new user (MyAccessKey).
  • Select Security credentials
  • Scroll down to "Access keys" section and click Create access key.
  • Select Command Line Interface (CLI).
  • Check "I understand the above recommendation" and click Next.
  • (Optional) Add a description tag, then click Create access key.

IMPORTANT:

  • Copy both the Access key ID and Secret access key.
  • Run the following in your terminal:
aws configure

You will be prompted to enter:

  1. AWS Access Key ID: Your access key (from AWS Console)
  2. AWS Secret Access Key: Your secret key (from AWS Console)
  3. Default region: e.g., us-east-1
  4. Default output format: json
  • Run the following in your terminal:
aws sts get-caller-identity

You should see your AWS account ID and user information!

Create Project Folder

Let's set up your project folder and open it in Cursor.

  • Open Cursor.
  • Click Open Project.
  • Navigate to your Desktop.
  • Click New Folder and name it aws-security-guard.
  • Select the aws-security-guard folder.
  • Click Open.

Set Up Your Python Virtual Environment

Before installing packages, let's create a virtual environment to keep your project dependencies isolated.

What is a virtual environment?

A virtual environment is like a separate workspace for your Python project. It keeps all your project's packages isolated from other projects, so they don't interfere with each other. Think of it as a sandbox where you can install whatever you need without affecting your computer's main Python setup.

To set up a virtual environment, let's run a few commands in Cursor's terminal.

In Cursor, click Terminal → New Terminal from the top menu.

Keyboard shortcut

Press Ctrl+' on Windows or Cmd+' on macOS.

The terminal will automatically open in your aws-security-guard project folder.

Now let's create a virtual environment.

Run this command:

python -m venv venv
  • Activate the virtual environment.

🍎 macOS

source venv/bin/activate

🖼️ Windows

venv\Scripts\activate

You should see (venv) appear at the beginning of your terminal prompt. This tells us your virtual environment is active.

Install boto3 and uv

What is boto3?

Boto3 is the official AWS SDK (Software Development Kit) for Python. It provides Python functions to interact with every AWS service - S3, EC2, IAM, and hundreds more. It's the foundation for any AWS automation in Python.

Now that your virtual environment is active, let's install boto3 (the AWS SDK for Python).

Run this command:

pip install boto3

Now check if you have uv (Python package manager) installed:

Run this command:

uv --version

What do you see?

✅ I see a version number

Perfect! uv is already installed and ready to use. You should see something like:

❌ Command not found

uv isn't installed yet. Let's install it.

🍎 macOS

Install uv using the official installer:

curl -LsSf https://astral.sh/uv/install.sh | sh
  • Restart your terminal after installation
  • Verify installation:
uv --version

You should see the uv version number!

🖼️ Windows

Install uv using PowerShell:

iwr https://astral.sh/uv/install.ps1 -UseBasicParsing | iex
  • Restart your PowerShell window after installation
  • Verify installation:
uv --version

You should see the uv version number!

In your terminal, verify both boto3 and uv are installed.

Make sure your virtual environment is activated!

You should see (venv) at the beginning of your terminal prompt. If you don't, ask for help reactivating your virtual environment in my terminal prompt.).

💡 What is uv?

uv is a fast Python package manager that we'll use to run the AWS MCP server. When Cursor needs to connect to AWS through MCP, uv will handle installing and running the MCP server packages automatically.

🍎 macOS

pip list | grep boto3

🖼️ Windows

pip list | Select-String boto3

Perfect! Your environment is ready. Now let's build the scanner that will detect security vulnerabilities in your AWS account.

Build Your AWS Security Scanner

Let's build a Python scanner that checks all your S3 buckets for public access misconfigurations - the same vulnerability that caused the Capital One breach. You'll write code using boto3 to scan your AWS account and detect security issues before they become data breaches.

In this step, you're going to:

  • Create the S3 security scanner
  • Add public access checks
  • Run the scanner

Create the Scanner

Now let's create the Python file for your security scanner.

  • In Cursor, right-click in the file explorer on the left side.
  • Select New File.
  • Type scanner.py and press Enter.

What is a .py file?

Files ending in .py are Python source code files. When you run python scanner.py, Python reads and executes the code inside this file line by line.

We're going to give you a few Python code outlines - it's your job to fill them in by clicking the placeholders and replacing them with the correct values.

Create the Scanner Skeleton

Let's add the basic structure of your scanner to the scanner.py file.

This code has 1 placeholder to fill in:

  1. YOUR_SERVICE - The boto3 client name for Amazon S3. A client is how boto3 connects to a specific AWS service. Hint: It's the lowercase service abbreviation.
import boto3
from botocore.exceptions import ClientError

def scan_s3_buckets():
    """Scan all S3 buckets for public access misconfigurations"""
    s3 = boto3.client([[YOUR_SERVICE="YOUR_SERVICE"]])
    findings = []

    print("Scanning S3 buckets for public access...\n")

    buckets = s3.list_buckets()
    print(f"Found {len(buckets['Buckets'])} buckets to scan\n")

    for bucket in buckets['Buckets']:
        bucket_name = bucket['Name']

        # We'll add the try/except blocks next

    print(f"\nScan complete. Found {len(findings)} issues.\n")
    return findings

if __name__ == "__main__":
    scan_s3_buckets()

Once you've added the placeholder:

  • Copy this entire code block into your scanner.py file.

Your scanner.py file should now look like this:

What does this code do?

This creates the basic structure of your scanner:

  • import boto3 - Loads the AWS SDK library so you can interact with AWS services
  • from botocore.exceptions import ClientError - Imports the exception class we'll use to handle AWS API errors properly
  • s3 = boto3.client('s3') - Creates a client object that connects to Amazon S3 using your AWS credentials
  • s3.list_buckets() - Makes an API call to AWS that returns a list of all S3 buckets in your account
  • print(f"Found {len(buckets['Buckets'])} buckets to scan\n") - Shows how many buckets were found
  • for bucket in buckets['Buckets']: - Loops through each bucket so you can check it individually
  • findings = [] - Creates an empty list to store any security issues found
  • if __name__ == "__main__": - This Python pattern means "only run this code if this file is executed directly" (what's a module?)

Add the Security Check Logic

Now let's add the complete try/except block that checks each bucket for public access issues and handles errors. Try/except lets your code attempt something and gracefully handle errors instead of crashing.

This code has 1 placeholder to fill in:

  1. YOUR_CONFIG_KEY - The response key containing the configuration settings. Hint: AWS responses nest the actual config in a key named PublicAccessBlockConfiguration. (What does "nesting" mean?)
        try:
            public_block = s3.get_public_access_block(Bucket=bucket_name)
            config = public_block['[[YOUR_CONFIG_KEY="YOUR_CONFIG_KEY"]]']

            if not all([
                config.get('BlockPublicAcls'),
                config.get('BlockPublicPolicy'),
                config.get('IgnorePublicAcls'),
                config.get('RestrictPublicBuckets')
            ]):
                findings.append({
                    'bucket': bucket_name,
                    'issue': 'Public access not fully blocked',
                    'severity': 'CRITICAL'
                })
                print(f"WARNING: [{bucket_name}] Public access not fully blocked")

        except ClientError as e:
            if e.response['Error']['Code'] == 'NoSuchPublicAccessBlockConfiguration':
                findings.append({
                    'bucket': bucket_name,
                    'issue': 'No public access block configured',
                    'severity': 'CRITICAL'
                })
                print(f"CRITICAL: [{bucket_name}] No public access block configured")
            else:
                print(f"ERROR: Could not scan {bucket_name}: {str(e)}")

        except Exception as e:
            print(f"ERROR: Could not scan {bucket_name}: {str(e)}")

What does this code do?

This try/except block checks each bucket's 4 security settings (BlockPublicAcls, BlockPublicPolicy, IgnorePublicAcls, RestrictPublicBuckets) and handles errors gracefully. CRITICAL severity means no public access block exists at all. If even one setting is False, the bucket has partial protection.

Once you've filled in the placeholder:

  • In your scanner.py file, find this line:
        # We'll add the try/except blocks next
  • Delete that comment line and replace it with the complete code block above.

Important: Watch your indentation!

The try and except lines should be aligned (8 spaces or 2 tabs from the left edge). Python is very sensitive to indentation - if it's wrong, the code won't run.

Your scanner.py file should now look like this:

What does this code do?

This try/except block checks each bucket for security issues and handles errors gracefully:

The try block: This is where we check each bucket's security settings.

  • s3.get_public_access_block(Bucket=bucket_name) - Fetches the public access block configuration for this specific bucket
  • config = public_block['PublicAccessBlockConfiguration'] - Extracts the actual configuration settings from the AWS response
  • if not all([...]) - Checks if ALL 4 security settings are enabled (BlockPublicAcls, BlockPublicPolicy, IgnorePublicAcls, RestrictPublicBuckets). If even one is False, this bucket has partial protection
  • findings.append({...}) - Adds a dictionary to the findings list with details about this security issue
  • print(f"WARNING: ...") - Prints a colored warning message to the terminal

The except blocks:

  • except ClientError as e: - Catches AWS API errors (this is the standard boto3 pattern for handling AWS exceptions)
  • if e.response['Error']['Code'] == 'NoSuchPublicAccessBlockConfiguration': - Checks if the error is specifically "no public access block configured" (which has critical severity! Why is this critical?)
  • else: - Any other AWS API error (wrong region, permission issues, etc.)
  • except Exception as e: - Catches any non-AWS errors (network issues, unexpected errors, etc.) so the scanner doesn't crash

💡 Why try/except?

Without error handling, the scanner would crash on the first problematic bucket and never check the rest. Try/except lets us handle each bucket's errors individually and continue scanning.

Verify Your Complete Scanner

Your complete scanner.py file should now have both parts: the skeleton and the try/except block.

Excellent! Your scanner can now detect security issues. Next, we'll connect Cursor to AWS so you can fix those issues automatically through chat.

Connect Cursor to AWS with MCP

Time to connect Cursor to your AWS account using the AWS MCP server! This connects Cursor to your AWS infrastructure so you can scan resources, analyze results, and fix issues simply by chatting.

What is MCP and why do we need it?

MCP (Model Context Protocol) lets AI assistants connect to external tools. The AWS MCP server bridges Cursor's AI with your AWS account - when you ask Cursor to "fix all critical S3 buckets," MCP translates that into boto3 API calls and executes them with your credentials. Without MCP, Cursor could only read/write files, not actually interact with AWS.

In this step, you're going to:

  • Configure AWS MCP in Cursor
  • Restart Cursor
  • Verify the MCP connection

Add AWS MCP Configuration

In Cursor:

  • Click settings icon (gear) in top right
  • Select MCP
  • Click Add Custom MCP

Add this to your mcp.json:

{
  "mcpServers": {
    "aws": {
      "command": "uv",
      "args": ["run", "--with", "awslabs.aws-api-mcp-server", "awslabs.aws-api-mcp-server"],
      "env": {
        "AWS_REGION": "[[YOUR_AWS_REGION="your-region"]]"
      }
    }
  }
}
  • Replace your-region with your AWS region (the one you set in aws configure).

For example, if you're in Sydney, use "ap-southeast-2". If you're in Virginia, use "us-east-1".

What region did I configure?

Check your AWS configuration:

Use that value in your mcp.json.

What does this configuration do?

This JSON tells Cursor how to start the AWS MCP server:

  • "command": "uv" - Tells Cursor to use the uv package manager to run the server
  • "args": [...] - Specifies to install and run the official AWS MCP server package (awslabs.aws-api-mcp-server)
  • "env": {"AWS_REGION": "..."} - Sets the AWS region the server should connect to
  • When Cursor starts, it reads this file and launches the AWS MCP server automatically
  • The server connects to your AWS account using the credentials you configured with aws configure
  • This gives Cursor the ability to execute AWS API calls on your behalf through chat
  • Save and restart Cursor completely.

Verify Connection

After restarting Cursor:

  • Go to Settings → Tools & MCP
  • Look for the aws MCP server

What color is the indicator next to "aws"?

✅ I see a green indicator

Perfect! AWS MCP is connected and ready to use.

⚠️ I see red or yellow

The AWS MCP isn't connecting properly. Let's troubleshoot:

  • Check your mcp.json syntax - Make sure the JSON is valid (no missing commas or brackets)
  • Verify uv is installed - Run uv --version in terminal
  • Check AWS credentials - Run aws sts get-caller-identity to verify credentials work
  • Restart Cursor completely - Quit Cursor entirely and reopen
  • Check the MCP logs - Look for error messages in the MCP panel

Still stuck?

Ask Claude for help debugging your MCP connection. You can also ask the NextWork community!

Test Your Scanner with AI-Created Issues

Now it's time to put everything together! You'll use Cursor with AWS MCP to create a deliberately insecure test bucket, then run your Python scanner to detect the security issue.

In this step, you're going to:

  • Create a test bucket with a security issue using Cursor + AWS MCP
  • Run your scanner.py to detect the security issue

Create a Test Bucket Using Cursor + AWS MCP

Before running your scanner, let's use Cursor's AI with AWS MCP to create a deliberately insecure S3 bucket. This will give you a security issue to find and fix!

  • Open Cursor's chat panel by pressing Cmd+L (macOS) or Ctrl+L (Windows)
  • Send this prompt to Cursor
Create an S3 bucket named "test-security-demo-[[YOUR_RANDOM_NUMBERS="12345"]]" without any public access block configuration, so my security scanner will detect it as a CRITICAL issue.

Replace 12345 with 5 random digits (like 67890). S3 bucket names must be globally unique.

  • Cursor will propose AWS commands - You'll see it planning to use the AWS CLI to create your bucket
  • Click "Allow" when Cursor asks permission to run the commands
  • Wait for confirmation - You should see a success message that the bucket was created

What just happened?

The AWS MCP server comes with built-in tools that Cursor's AI can use. When you asked it to create a bucket, the server automatically picked the right tools:

  • suggest_aws_commands - Figured out which AWS command creates an S3 bucket
  • call_aws - Executed aws s3 mb s3://test-security-demo-xxxxx to create it

Your bucket was created WITHOUT public access blocks - this means anyone on the internet could potentially access its contents if you uploaded files to it. That's the security vulnerability your scanner will detect!

This is your first time using AI to control AWS through natural language!

Run Your Security Scanner

Now let's run your scanner to detect the security issue in the bucket you just created.

  • Open a terminal in Cursor (Terminal → New Terminal)
  • Make sure your virtual environment is activated (you should see (venv) in the prompt). Not activated? in my terminal prompt.) Why does this matter?
  • Run your scanner:

🍎 macOS

python3 scanner.py

🖼️ Windows

python scanner.py

What do you see?

✅ I see CRITICAL findings

Perfect! Your scanner detected the security issue.

Your output should look like this:

You'll see:

  • Found X buckets to scan - Shows how many buckets exist in your account (including your test-security-demo bucket)
  • CRITICAL: [test-security-demo-xxxxx] No public access block configured - Your test bucket has NO protection at all
  • Scan complete. Found 1 issues. (or more if you have other insecure buckets)

What do these findings mean?

  • CRITICAL: Bucket has no public access block configured at all - anyone could potentially make it public
  • WARNING (if you see this for other buckets): Bucket has partial protection - some of the 4 security settings are enabled, but not all

❌ I get an error!

If your scanner shows an error or doesn't find your test bucket, here's how to troubleshoot:

Check if the bucket was created:

aws s3 ls

You should see your test-security-demo-xxxxx bucket in the list.

If you don't see your test bucket:

  • Go back to the previous step and use Cursor + AWS MCP to create the bucket again
  • Make sure Cursor showed a success message confirming bucket creation
  • Check your AWS region: aws configure get region - the bucket was created in that region

If you see the bucket in aws s3 ls but scanner doesn't find it:

  • Make sure your virtual environment is activated: you should see (venv) in your terminal prompt
  • Check your scanner.py file has the correct code (compare with screenshot-21.webp)
  • Try running the scanner again

If you get IndentationError:

  • Python is very sensitive to indentation - make sure your try and except blocks are aligned
  • Check that you're using consistent spacing (either all tabs or all spaces, not mixed)
  • Compare your code carefully with the screenshots

If you get permission errors:

  • Run aws sts get-caller-identity to verify your AWS credentials are working
  • If that fails, run aws configure again and re-enter your credentials

Still stuck?

Ask Claude for help. You can also ask the NextWork community!

Secret mission

So far, you've built a scanner that detects security issues - but detection alone isn't enough. Professional security teams need to actually fix what they find.

In this secret mission, you'll close the loop: use Cursor with AWS MCP to automatically remediate the CRITICAL findings in your S3 buckets, then verify the fixes worked - all through natural language, without touching the AWS Console.

Automatically Fix Issues with AI

Clean Up Your Resources

Clean Up Your Resources

Nice work completing this project! Let's clean up the resources we created.

Resources to clean up:

  • Deactivate your Python virtual environment
  • Remove AWS test resources (optional)
  • Delete the project folder (optional)

Deactivate Virtual Environment

First, deactivate your virtual environment:

deactivate

You should see the (venv) prefix disappear from your terminal prompt.

What About Your AWS Resources?

You have options for the test bucket you created:

💾 Keep the test bucket

If you want to keep practicing with your scanner, keep the test bucket!

Your scanner is ready to run anytime - just activate the virtual environment:

cd aws-security-guard
source venv/bin/activate  # On macOS/Linux
# OR
venv\Scripts\activate  # On Windows
python scanner.py

Optional: Add .gitignore

If you use Git, create a .gitignore file to protect your AWS credentials:

venv/
__pycache__/
*.pyc
.env

🗑️ Delete the test bucket

If you're completely done with the test bucket:

  • Open AWS S3 Console
  • Find your test-security-demo-xxxxx bucket
  • Select it and click Delete
  • Follow the confirmation prompts

Your test bucket is now removed.

Delete Project Files (Optional)

If you want to completely remove the project:

  • Delete the entire aws-security-guard folder from your Desktop.

What About AWS MCP?

The AWS MCP server in Cursor is still configured. You can:

  • Keep it - Useful for future AWS projects with Cursor
  • Remove it - Go to Cursor Settings → Tools & MCP → Remove "aws" server

All resources have been cleaned up!

That's a wrap!

That's a wrap!

You did it! 🎊 You've built an AI-powered AWS security system using Python + Cursor + AWS MCP.

What you learned:

  • 🔍 AWS S3 security and public access configurations
  • 🐍 Python automation with boto3
  • 🤖 Using Cursor with AWS MCP to control AWS through chat
  • 🔧 Building security automation workflows
  • 📊 Security scanning and risk assessment

Ready to quiz yourself? 💪

p.s. Does it say "Still tasks to complete!" at the bottom of the screen?

This means you still have screenshots left to upload, or questions left to answer!

  • Press Ctrl+F (Windows) or Cmd+F (Mac) on your keyboard
  • Search for the text Return to later
  • Jump straight to your incomplete tasks!

📣 If you're EVER stuck - ask the NextWork community. Students like you are already asking questions about this project.

🚀 p.s. Does it say "Still tasks to complete!" at the bottom of the screen?

This means you still have screenshots left to upload, or questions left to answer!

  1. Press Ctrl+F (Windows) or Command+F (Mac) on your keyboard.
  2. Search for the text Return to later.
  3. Jump straight to your incomplete tasks!
  4. 🙋‍♀️ Still stuck? Ask the community!