Linux, networking, AWS compute/storage/IAM, backup, Git, Docker, CI/CD, Terraform, monitoring, cost controls and a deployment project.
What you will cover
Linux
networking
AWS compute/storage/IAM
backup
Git
Docker
CI/CD
Terraform
monitoring
cost controls
a deployment project
Topic list from the institute's programme record.
Certification
Certificate terms for this programme are confirmed by the institute at admission. Any ADIVAS course-completion certificate is an institute certificate; it is not a university degree, an externally accredited qualification or a vendor certification (such as AWS or Microsoft) unless the institute states so in writing.
Curriculum 0.1 · Draft: written for ADIVAS and awaiting academic review and approval. Topics and weeks may change before your batch starts.
Your skill trail
You move through 7 stations. Each week builds one skill you can show, not just a topic you have heard.
1
Linux, networking and cloud foundations
Work confidently on Linux servers and understand networking and the cloud model before building on it.
Week 1 Cloud concepts and safe lab setup
Week 2 Linux essentials
Week 3 Linux administration: users, permissions and services
Week 4 Networking foundations
Week 5 Shell scripting and automation
2
AWS compute, storage and identity
Secure an AWS account and run compute, storage and backups with least-privilege access.
Week 6 AWS identity and account security
Week 7 Compute with EC2
Week 8 VPC networking and security groups
Week 9 Object storage with S3
Week 10 Backup, recovery and lifecycle
3
Version control with Git
Track and share code with Git, branches and pull requests without leaking secrets.
Week 11 Git fundamentals
Week 12 Branches, pull requests and collaboration
4
Containers with Docker
Package applications as secure, small container images and run them consistently.
Week 13 Docker fundamentals
Week 14 Building images with Dockerfiles
Week 15 Compose, image security and networking
5
CI/CD pipelines
Automate build, test, scan and deployment with a pipeline and safe rollback.
Week 16 Continuous integration
Week 17 Pipeline quality and security checks
Week 18 Continuous delivery and rollback
6
Infrastructure as code with Terraform
Describe, create and change cloud infrastructure repeatably with Terraform.
Week 19 Terraform basics
Week 20 State, variables and modules
Week 21 Provisioning an application environment
7
Operate, secure and deliver
Monitor, control cost, review security and deliver a complete deployment project.
Week 22 Monitoring, logging and alerting
Week 23 Cost control and security review
Week 24 Deployment project and review
★
Deploy a Web Application End to End
Your project, reviewed by a trainer.
The ADIVAS mastery ladder: how each skill is recognised
Explored You have seen the idea and tried a first example.
Practising You can do it with hints and keep improving.
Proficient You complete the weekly practical task correctly on your own.
Proven You apply it in a project reviewed by your trainer.
Skill-level tracking is being added to the learner workspace. Your trainer already reviews weekly practical work.
What you will be able to do
Explain cloud service and shared-responsibility models and work safely inside an approved lab or free-tier account with budgets and alerts.
Administer Linux servers: users, permissions, services, packages and shell scripts.
Explain IP addressing, DNS, ports, HTTP and design a simple VPC with public and private subnets.
Secure AWS access with IAM users, roles, least-privilege policies and MFA.
Launch and manage EC2 instances and S3 storage, and plan backups and recovery.
Use Git for version control with branches, pull requests and safe handling of secrets.
Build, run, scan and publish Docker images and run multi-container applications with Compose.
Create CI/CD pipelines that test, scan and deploy an application automatically with rollback.
Define cloud infrastructure as code with Terraform, remote state and reusable modules.
Monitor applications with metrics, logs and alarms, and respond to incidents using a runbook.
Control cloud cost with tagging, budgets and clean-up, and review security configuration before release.
Who it suits
School Senior school students with strong interest in computers who want to see how websites and apps are run on the internet; guided labs and no prior experience needed.
College Engineering, science and IT students who want practical cloud and DevOps skills for projects and internships.
Professional Support engineers, developers, system administrators and career changers moving into cloud and DevOps roles.
Prerequisites: Comfort with a computer, files and the internet; basic programming idea (reading a simple script) helps. Some familiarity with networking terms is useful but is taught from scratch in Weeks 4 and 8. Tools: Ubuntu Server in a virtual machine or cloud instance, AWS free-tier or institute-approved lab account, Git and GitHub, Docker Engine and Docker Compose, GitHub Actions, Terraform (or OpenTofu), AWS CLI and CloudWatch, Visual Studio Code.
Weekly plan
Linux, networking and cloud foundations Weeks 1–5
Week 1: Cloud concepts and safe lab setup
Theory
IaaS, PaaS, SaaS, regions and availability zones
Shared responsibility model
Free-tier limits, budgets and why every lab resource must be cleaned up
Lab
Set up the approved lab or free-tier account with MFA, create a zero-spend budget alert, and install a Linux VM plus the AWS CLI on your laptop.
Homework
Classify ten familiar services (UPI app, YouTube, a school ERP) as IaaS, PaaS or SaaS and justify each.
Deliverable
A lab-safety sheet with the account rules, budget alert screenshot and a service classification table.
Weekly checkpoint
Match service models to examples; scenario on who is responsible for patching in each model.
You will be able to
Explain cloud service and shared-responsibility models and work safely inside an approved lab or free-tier account with budgets and alerts.
Week 2: Linux essentials
Theory
File system layout and navigation
Viewing, searching and editing files; pipes and redirection
Package management with apt
Lab
Work through a guided terminal practice: build a folder tree, search logs with grep, install and remove packages, and write a cheat sheet of tested commands.
Homework
Solve ten command-line puzzles (find, count, sort and filter text) and note the commands used.
Deliverable
A commands cheat sheet with 25 tested commands and a sample output of each.
Weekly checkpoint
Command-line practical task: filter a log file for errors and count them by hour.
You will be able to
Administer Linux servers: users, permissions, services, packages and shell scripts.
Week 3: Linux administration: users, permissions and services
Theory
Users, groups, file modes and sudo with least privilege
Processes and systemd services
Disks, mounts and log files in /var/log
Lab
Create users and a shared group folder, install nginx, manage it with systemctl, and write a small systemd unit that restarts a script automatically.
Homework
Document how to give a developer access to restart one service only, without full root rights.
Deliverable
A server-setup document with permissions matrix and service unit file.
Weekly checkpoint
Troubleshoot a service that fails to start by reading its logs and fixing permissions.
You will be able to
Administer Linux servers: users, permissions, services, packages and shell scripts.
Week 4: Networking foundations
Theory
IP addressing, subnets and CIDR notation
DNS, TCP/UDP ports and the HTTP request cycle
Diagnosing with ping, ss, curl and dig
Lab
Plan an address range for a small office using CIDR, then diagnose three broken connections (wrong DNS, closed port, wrong gateway) in a prepared lab.
Homework
Calculate usable addresses for /24, /26 and /28 subnets and explain which one fits 50 laptops.
Deliverable
A network plan table and a three-fault diagnosis log.
Weekly checkpoint
Subnet calculation questions and a diagram question on a web request path.
You will be able to
Explain IP addressing, DNS, ports, HTTP and design a simple VPC with public and private subnets.
Week 5: Shell scripting and automation
Theory
Variables, conditions, loops, functions and exit codes
Cron scheduling and safe quoting
Logging from scripts and basic error handling
Lab
Write a bash script that checks disk space and a service status, logs the result with a timestamp, and runs every five minutes with cron.
Homework
Improve the script so it exits with a non-zero code on failure and prints a clear message.
Deliverable
A commented health-check script, cron entry and three log lines.
Weekly checkpoint
Read a script and predict output; fix a quoting or exit-code bug.
You will be able to
Administer Linux servers: users, permissions, services, packages and shell scripts.
AWS compute, storage and identity Weeks 6–10
Week 6: AWS identity and account security
Theory
Root user, IAM users, groups, roles and policies
Least privilege, MFA and access keys vs roles
CloudTrail as the audit log of account activity
Lab
Create an administrator group with MFA, a read-only auditor user and an EC2 role; write a small JSON policy that allows access to one S3 bucket only; then confirm in CloudTrail who did what.
Homework
Review a sample policy that uses an asterisk for everything and rewrite it with the minimum permissions.
Deliverable
An IAM design note with policy JSON and a CloudTrail screenshot of an allowed and a denied action.
Weekly checkpoint
Scenario on a leaked access key: list the response steps in order.
You will be able to
Secure AWS access with IAM users, roles, least-privilege policies and MFA. Explain cloud service and shared-responsibility models and work safely inside an approved lab or free-tier account with budgets and alerts.
Week 7: Compute with EC2
Theory
Instance types, AMIs, key pairs and user data
Elastic block storage and snapshots
Start, stop, terminate and the cost impact of each
Lab
Launch a small free-tier instance, connect with SSH keys, install nginx through a user-data script, take a snapshot and then terminate everything.
Homework
Compare three instance types for a small web app and explain the choice with cost and memory needs.
Deliverable
A running web page URL (for the demo day only), launch checklist and a clean-up confirmation screenshot.
Weekly checkpoint
Practical: launch, connect to and terminate an instance without leaving billable resources.
You will be able to
Launch and manage EC2 instances and S3 storage, and plan backups and recovery. Explain cloud service and shared-responsibility models and work safely inside an approved lab or free-tier account with budgets and alerts.
Week 8: VPC networking and security groups
Theory
VPC, subnets, route tables, internet gateway and NAT
Security groups vs network ACLs
Public vs private subnets and bastion access
Lab
Build a VPC with one public and one private subnet, launch a web server in public and a database-style instance in private, and allow traffic only on required ports.
Homework
Draw the VPC diagram and list every rule you opened with a reason.
Deliverable
A VPC diagram and security-group rule table.
Weekly checkpoint
Troubleshooting question: a web server in a public subnet is unreachable; find the missing route or rule.
You will be able to
Explain IP addressing, DNS, ports, HTTP and design a simple VPC with public and private subnets. Secure AWS access with IAM users, roles, least-privilege policies and MFA.
Week 9: Object storage with S3
Theory
Buckets, objects, storage classes and public-access block
Versioning, bucket policies and encryption
Static website hosting
Lab
Create a private bucket with versioning and encryption, upload files, host a static site through a controlled policy, and prove that an unauthorised user is denied.
Homework
Write a one-page note on how a public bucket leaks data and how you prevent it.
Deliverable
A bucket configuration record and screenshots of allowed and denied access.
Weekly checkpoint
Multiple-select question on which S3 settings reduce exposure.
You will be able to
Launch and manage EC2 instances and S3 storage, and plan backups and recovery. Secure AWS access with IAM users, roles, least-privilege policies and MFA.
Week 10: Backup, recovery and lifecycle
Theory
Backup types, RPO and RTO
Snapshots, S3 versioning and lifecycle rules
Testing a restore
Lab
Create a nightly backup job for a data folder to S3 with a lifecycle rule to expire old copies, then delete a file and restore it from the backup.
Homework
Write a backup policy for a school or small shop that states what, how often and how long.
Deliverable
A tested backup script and restore evidence.
Weekly checkpoint
Scenario: choose backup frequency from an RPO figure; practical restore task.
You will be able to
Launch and manage EC2 instances and S3 storage, and plan backups and recovery. Administer Linux servers: users, permissions, services, packages and shell scripts.
Version control with Git Weeks 11–12
Week 11: Git fundamentals
Theory
Repositories, commits and the staging area
Reading history with log and diff
Ignoring files and never committing secrets
Lab
Create a repository for a small web page, make five meaningful commits, undo a mistake with revert, and add a .gitignore that blocks credential files.
Homework
Write good commit messages for five given changes and explain why each is better than 'update'.
Deliverable
A repository link with a clean history and .gitignore.
Weekly checkpoint
Sequence the Git workflow steps; spot a committed secret in a diff.
You will be able to
Use Git for version control with branches, pull requests and safe handling of secrets.
Week 12: Branches, pull requests and collaboration
Theory
Branching, merging and resolving conflicts
Pull requests and code review checklists
Branch protection and removing a leaked secret from history
Lab
In pairs, create a feature branch, cause and resolve a merge conflict, open a pull request, review each other's code and merge after a passing review.
Homework
Write a review checklist of ten points for infrastructure code.
Deliverable
A merged pull request with review comments and a review checklist.
Weekly checkpoint
Practical: resolve a conflict; scenario on an accidentally pushed API key.
You will be able to
Use Git for version control with branches, pull requests and safe handling of secrets.
Containers with Docker Weeks 13–15
Week 13: Docker fundamentals
Theory
Images, containers and registries compared with virtual machines
Running, stopping, logging and inspecting containers
Volumes, ports and environment variables
Lab
Run nginx and a small database as containers, publish ports, attach a volume, remove the container and show the data survived.
Homework
Explain in your own words three differences between a container and a VM.
Deliverable
A container cheat sheet and volume persistence evidence.
Weekly checkpoint
Compare containers and VMs; practical: run a container with a published port and a volume.
You will be able to
Build, run, scan and publish Docker images and run multi-container applications with Compose.
Week 14: Building images with Dockerfiles
Theory
Dockerfile instructions and layer caching
Small, non-root images and multi-stage builds
Tagging and pushing to a registry
Lab
Containerise a small Python or Node web app, make it run as a non-root user, shrink the image with a multi-stage build and push a tagged image to a registry.
Homework
Reduce the image size further and record the before and after sizes.
Deliverable
A Dockerfile, image size comparison and registry link.
Weekly checkpoint
Fix a Dockerfile that copies secrets into the image; order the layers for best caching.
You will be able to
Build, run, scan and publish Docker images and run multi-container applications with Compose.
Week 15: Compose, image security and networking
Theory
Docker Compose for multi-container applications
Container networks and secrets
Scanning images for vulnerabilities and base-image updates
Lab
Write a Compose file for web app, database and cache, keep passwords in an env file excluded from Git, and scan the image with a free scanner.
Homework
List three vulnerabilities from the scan result and propose fixes.
Deliverable
A Compose project with a scan report summary.
Weekly checkpoint
Practical: start the stack and prove services talk by name; question on secret handling.
You will be able to
Build, run, scan and publish Docker images and run multi-container applications with Compose. Control cloud cost with tagging, budgets and clean-up, and review security configuration before release.
CI/CD pipelines Weeks 16–18
Week 16: Continuous integration
Theory
CI concept: build and test on every commit
GitHub Actions workflows, jobs, steps and runners
Caching, artifacts and status checks
Lab
Add a workflow that installs dependencies, runs unit tests and builds the Docker image on each push and pull request, and make a failing test block the merge.
Homework
Add a lint step and record how long the pipeline takes before and after caching.
Deliverable
A passing workflow run and a deliberately failed run screenshot.
Weekly checkpoint
Sequence pipeline stages; diagnose why a pipeline is red from a log excerpt.
You will be able to
Create CI/CD pipelines that test, scan and deploy an application automatically with rollback.
Week 17: Pipeline quality and security checks
Theory
Unit tests, linting and dependency scanning
Secrets in CI and OIDC role access instead of long-lived keys
Image scanning gates and artifact versioning
Lab
Extend the pipeline with a dependency scan and image scan that fail on critical findings, and store credentials only as protected secrets.
Homework
Document what the pipeline must do when a scan finds a critical issue.
Deliverable
A pipeline with scanning gates and a secrets-handling note.
Weekly checkpoint
Scenario: a developer put a key in the workflow file; list the corrective steps.
You will be able to
Create CI/CD pipelines that test, scan and deploy an application automatically with rollback. Control cloud cost with tagging, budgets and clean-up, and review security configuration before release.
Week 18: Continuous delivery and rollback
Theory
Deployment strategies: rolling, blue-green and manual approval
Deploying a container to EC2 with SSH or SSM from a pipeline
Health checks, versioned releases and rollback
Lab
Deploy the tagged image to an EC2 instance through the pipeline after approval, check a health endpoint, then roll back to the previous tag.
Homework
Write rollback criteria: what result makes you roll back and who decides.
Deliverable
A deploy workflow with health check and a recorded rollback.
Weekly checkpoint
Practical: trigger a deployment and roll back; scenario on a failed release.
You will be able to
Create CI/CD pipelines that test, scan and deploy an application automatically with rollback.
Infrastructure as code with Terraform Weeks 19–21
Week 19: Terraform basics
Theory
Infrastructure as code, providers, resources and the plan-apply cycle
Variables, outputs and the dependency graph
Reading a plan before applying
Lab
Write Terraform to create an S3 bucket and a security group, run init, plan and apply, change a setting and read the plan diff before destroying the lab.
Homework
Explain what each of the plan symbols (+, ~, -) means with an example.
Deliverable
A Terraform configuration with plan output and destroy confirmation.
Weekly checkpoint
Interpret a plan output; sequence the Terraform workflow.
You will be able to
Define cloud infrastructure as code with Terraform, remote state and reusable modules.
Week 20: State, variables and modules
Theory
State files, remote state in S3 and locking
Input variables, locals and tfvars files
Reusable modules and version pinning
Lab
Move local state to an S3 backend with locking, extract the network code into a module and call it twice with different variables.
Homework
List what must never be committed from a Terraform project and why.
Deliverable
A repo with remote state, a reusable module and a .gitignore.
Weekly checkpoint
Scenario on two engineers applying at once; why remote state with locking matters.
You will be able to
Define cloud infrastructure as code with Terraform, remote state and reusable modules. Use Git for version control with branches, pull requests and safe handling of secrets.
Week 21: Provisioning an application environment
Theory
Composing VPC, compute, storage and IAM in code
Tagging standards and environment separation (dev, staging)
Validating and scanning IaC before apply
Lab
Provision a tagged dev environment (VPC, EC2, S3, instance role) with Terraform and scan the code with a free checker before apply.
Homework
Fix three issues reported by the IaC scanner.
Deliverable
A tagged environment definition and a scanner report.
Weekly checkpoint
Practical: change a variable and apply safely; identify an over-permissive rule in code.
You will be able to
Define cloud infrastructure as code with Terraform, remote state and reusable modules. Control cloud cost with tagging, budgets and clean-up, and review security configuration before release. Secure AWS access with IAM users, roles, least-privilege policies and MFA.
Operate, secure and deliver Weeks 22–24
Week 22: Monitoring, logging and alerting
Theory
Metrics, logs and alarms; the four golden signals
CloudWatch agent, log groups and dashboards
Alert design: avoid noisy alarms and write a runbook
Lab
Ship application and system logs to CloudWatch, create a CPU and an error-rate alarm and a dashboard, trigger the alarm and follow a runbook to resolve it.
Homework
Write a runbook for a high-CPU alert with first checks and escalation.
Deliverable
A dashboard, two alarms and a completed runbook.
Weekly checkpoint
Scenario: choose the metric to alarm on for slow responses; read a log excerpt to find the cause.
You will be able to
Monitor applications with metrics, logs and alarms, and respond to incidents using a runbook.
Week 23: Cost control and security review
Theory
Cost drivers, tagging, budgets and Cost Explorer
Right-sizing, scheduled stop and clean-up automation
Tag all project resources, set a budget with alerts, review the account with a security checklist, and fix every finding before the final project.
Homework
Estimate monthly cost of the project architecture and list three ways to reduce it.
Deliverable
A cost estimate, a completed security checklist and fixes log.
Weekly checkpoint
Scenario: an unexpected bill; order the investigation steps.
You will be able to
Control cloud cost with tagging, budgets and clean-up, and review security configuration before release. Secure AWS access with IAM users, roles, least-privilege policies and MFA.
Week 24: Deployment project and review
Theory
Architecture and release documentation
Incident review without blame
Presenting trade-offs and a demo
Lab
Final build day: complete and demonstrate the end-to-end project (Git to pipeline to Terraform-provisioned AWS environment with monitoring), then clean up all resources.
Homework
Prepare a five-minute demo and a one-page architecture and runbook summary.
Deliverable
The final project repository, architecture diagram, demo and clean-up confirmation.
Weekly checkpoint
End-of-course practical review: demonstrate a deployment, a rollback and a monitoring alert.
You will be able to
Create CI/CD pipelines that test, scan and deploy an application automatically with rollback. Define cloud infrastructure as code with Terraform, remote state and reusable modules. Monitor applications with metrics, logs and alarms, and respond to incidents using a runbook. Explain cloud service and shared-responsibility models and work safely inside an approved lab or free-tier account with budgets and alerts.
Sample lessons
Week 8
Security groups and public versus private subnets
A VPC is your own private network inside the cloud. A subnet is a smaller part of it. A public subnet has a route to the internet gateway, so its servers can be reached from the internet. A private subnet has no direct route in from the internet; its servers talk only to your other resources. A security group is a firewall attached to a server: it lists which ports and sources are allowed in. Security groups are stateful, meaning that replies to allowed requests are allowed back automatically. Good design puts only the web tier in the public subnet and keeps databases private.
Internet
Internet gateway
Public subnet: web server (SG: 80, 443)
Private subnet: database (SG: 5432 from web SG)
Only the web tier faces the internet.
Step by step
Create the VPC with a CIDR range such as 10.0.0.0/16.
Create a public subnet and a private subnet in different ranges.
Attach an internet gateway and add a route for 0.0.0.0/0 to the public subnet's route table only.
Create a web security group that allows ports 80 and 443 from anywhere and port 22 from your own IP.
Create a database security group that allows the database port only from the web security group.
In real life
A bank branch has a front counter open to customers (public subnet) and a locked strong room (private subnet). Staff walk from the counter to the strong room with permission; customers never walk in directly.
Worked example
Problem. Your database instance must accept connections only from the web servers on port 5432. Which source should the rule use?
Solution. Use the web servers' security group as the source for port 5432 instead of an IP range. Then any instance in that group can connect and nothing else can, even if IP addresses change.
Common mistakes
Opening port 22 to the whole internet instead of your own address.
Putting the database in a public subnet because it seemed easier to connect.
Try it yourself
Draw a VPC with one public and one private subnet and mark where each security group applies.
Write the inbound rules for a web server that must be reachable by customers and administered only from the office IP.
Week 16
A continuous integration pipeline
Continuous integration means every change is built and tested automatically as soon as it is pushed. A pipeline is a set of steps stored in the repository as code, so it runs the same way for everyone. In GitHub Actions, a workflow file lists the trigger, the jobs and the steps. If a step fails, the pipeline turns red and a branch rule can stop the change from being merged. The goal is to find mistakes in minutes, when they are cheap to fix, instead of after release.
1Push code
2Install and cache
3Lint and test
4Scan and build image
5Report pass or fail
Every change runs the same checks.
Step by step
Add a workflow file under .github/workflows triggered on push and pull request.
Check out the code and set up the language runtime.
Install dependencies using a cache to save time.
Run the unit tests and the linter.
Build the Docker image and upload the result as an artifact; require the checks before merging.
In real life
A school fee app is updated by three students. The pipeline runs the tests on each pull request, so a change that breaks fee totals is caught before the principal sees a wrong figure.
Worked example
Problem. A pull request shows a red cross on the test step: 'Expected total 2550 but got 2250'. What do you do?
Solution. Open the failed step log, read the first failing test, reproduce it locally, fix the calculation, push a new commit and wait for the pipeline to turn green before asking for review.
Common mistakes
Merging while the pipeline is red because the change 'looks fine'.
Writing secrets directly in the workflow file instead of using protected secrets.
Try it yourself
Write the list of steps for a pipeline that tests and builds a small web app.
Explain why a pipeline must be fast and what you can do when it becomes slow.
Try the questions
The same skills are asked at three levels: School (Classes 6–12), College and Professional. Switch the level and the language (English or Tamil), and say how sure you are before you check: knowing what you are unsure about is part of learning.
Classes 6–12: everyday examples, no prior knowledge. Practice only. Nothing here is graded or saved.
Question 1 / 4 · Explain the cloud idea
A library lends books so that you do not need to buy every book. Which idea in computing is most similar?
Projects
Deploy a Web Application End to End
A small Madurai training business wants its booking web app deployed repeatably on AWS inside an approved lab or free-tier account. Build the full path: code in Git, tests and scans in a pipeline, a container image, infrastructure created with Terraform, monitoring and logs, and a cost and security review.
Tasks
Put the application and Dockerfile in a Git repository with branch protection and a .gitignore that blocks secrets.
Create a GitHub Actions pipeline that tests, scans and builds an image and deploys it after approval with a health check and rollback.
Provision the VPC, EC2 instance, S3 bucket and IAM role with Terraform using remote state and tags.
Send logs to CloudWatch, add an alarm and write a one-page runbook.
Complete the cost estimate and security checklist, demonstrate the system, then destroy all resources.
Sample input
Application: simple booking page with a /health endpoint; environment: dev; region: ap-south-1; budget alert: set below the lab limit
Expected output
A passing pipeline run, a reachable health endpoint during the demo, a Terraform plan with no unexpected changes, a triggered and resolved alarm, a completed checklist and a confirmation that all resources were destroyed.
How it is assessed
Criterion
Weight
Pipeline with tests, scans and rollback
25%
Infrastructure as code quality and tagging
20%
Security: IAM, networking, secrets
20%
Monitoring, logging and runbook
15%
Cost control and clean-up
10%
Demo and documentation
10%
Stretch challenge: Add a staging environment using the same Terraform module with different variables and a manual approval before production.
Linux Server Hardening and Backup Runbook
Prepare a Linux server for a small office: harden it, automate a backup to S3 and prove that a restore works. Document the procedure so a colleague can repeat it.
Tasks
Create users and groups, disable password SSH login and enable a firewall with only required ports.
Write a backup script that sends a dated archive to a private, versioned S3 bucket using a limited IAM role.
Schedule the script with cron and log each run.
Delete a sample file and restore it from the backup, recording the time taken.
Sample input
Server with /srv/data folder; users: manager, accountant; RPO target: 24 hours
Expected output
A hardened server, a scheduled backup with logs, a successful timed restore and a short runbook.
How it is assessed
Criterion
Weight
Hardening and least privilege
35%
Backup and restore proof
35%
Runbook clarity
30%
Stretch challenge: Add a notification when a backup fails and a weekly automated restore test.
How you are assessed
Each week: a short quiz (concepts, scenarios and one diagram question), a graded lab recorded in the learner's repository or lab notes, and a short written reflection on what was automated and what could go wrong.
Practical work. Learners work in approved lab or free-tier accounts; the trainer checks repositories, pipeline runs, Terraform plans, monitoring screens and clean-up confirmation. Every resource must be tagged and destroyed after labs.
