Cloud Security Fundamentals
Security in the cloud is a shared effort. Your cloud provider secures the infrastructure, but you're responsible for securing what you put on it. Getting this right is non-negotiable — one misconfiguration can expose sensitive data to the world.
The Shared Responsibility Model
┌─────────────────────────────────────────────────────────┐
│ SHARED RESPONSIBILITY MODEL │
│ │
│ ┌───────────────────────────────────────────────────┐ │
│ │ CUSTOMER RESPONSIBILITIES │ │
│ │ ┌─────────┐ ┌──────────┐ ┌───────────────────┐ │ │
│ │ │ Data │ │ Identity │ │ Application │ │ │
│ │ │ │ │ & Access │ │ Security │ │ │
│ │ │Encrypt, │ │ Mgmt, │ │ Patches, Config │ │ │
│ │ │backup, │ │ IAM │ │ Firewall, Code │ │ │
│ │ │classify │ │ policies│ │ scanning │ │ │
│ │ └─────────┘ └──────────┘ └───────────────────┘ │ │
│ │ ┌─────────┐ ┌──────────┐ ┌───────────────────┐ │ │
│ │ │ OS │ │ Network │ │ Client & Server │ │ │
│ │ │ Patches │ │ Config │ │ Encryption │ │ │
│ │ └─────────┘ └──────────┘ └───────────────────┘ │ │
│ └───────────────────────────────────────────────────┘ │
│ ┌───────────────────────────────────────────────────┐ │
│ │ PROVIDER RESPONSIBILITIES │ │
│ │ ┌──────────┐ ┌───────────┐ ┌────────────────┐ │ │
│ │ │Physical │ │ Host │ │ Network │ │ │
│ │ │Security │ │ OS,HW │ │ Infrastructure│ │ │
│ │ └──────────┘ └───────────┘ └────────────────┘ │ │
│ │ ┌──────────┐ ┌───────────┐ ┌────────────────┐ │ │
│ │ │Data │ │ Software │ │ Global │ │ │
│ │ │Center │ │ Updates │ │ Infrastructure│ │ │
│ │ └──────────┘ └───────────┘ └────────────────┘ │ │
│ └───────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘
Identity and Access Management (IAM)
IAM is your first line of defense. It controls who can do what in your cloud environment. The golden rule: grant the least privilege necessary. No one gets admin access unless they truly need it.
┌──────────────────────────────────────────────┐
│ IAM POLICY STRUCTURE │
│ │
│ "Effect" "Action" "Resource" │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌────────┐ ┌──────────┐ ┌──────────┐ │
│ │ Allow │ │ s3:Put │ │ bucket/* │ │
│ │ or │ │ s3:Get │ │ │ │
│ │ Deny │ │ ec2:Start│ │ arn:aws: │ │
│ │ │ │ iam:... │ │ s3:::my │ │
│ └────────┘ └──────────┘ └──────────┘ │
│ │
│ Example Policy: │
│ { │
│ "Effect": "Allow", │
│ "Action": "s3:GetObject", │
│ "Resource": "arn:aws:s3:::mybucket/*" │
│ } │
└──────────────────────────────────────────────┘
Security Groups and Network ACLs
Think of security groups as firewalls for your instances. They control inbound and outbound traffic at the instance level. Network ACLs work at the subnet level and act as a secondary barrier.
Internet
│
▼
┌──────────────────────┐
│ Network ACL │ (Subnet level - stateless)
│ ┌──────────────┐ │
│ │ Inbound Rules│ │ Allow/Deny by port, CIDR
│ └──────────────┘ │
│ ┌──────────────┐ │
│ │Outbound Rules│ │ Evaluated separately
│ └──────────────┘ │
└──────────┬───────────┘
│
▼
┌──────────────────────┐
│ Security Group │ (Instance level - stateful)
│ ┌──────────────┐ │
│ │ Inbound Rules│ │ e.g., allow 443 from 0.0.0.0/0
│ └──────────────┘ │
│ ┌──────────────┐ │
│ │Outbound Rules│ │ e.g., allow all outbound
│ └──────────────┘ │
└──────────┬───────────┘
│
▼
┌─────────┐
│ EC2 │
│Instance │
└─────────┘
Compliance Frameworks
Cloud providers hold certifications like SOC 2, ISO 27001, HIPAA, and PCI DSS. But certification doesn't make you compliant — you still need to configure your resources correctly. Use tools like AWS Config or Azure Policy to continuously audit your environment against compliance rules.
Security Best Practices Checklist
[x] Enable MFA for all root and admin accounts
[x] Use IAM roles instead of access keys where possible
[x] Rotate access keys every 90 days
[x] Enable CloudTrail for audit logging
[x] Encrypt data at rest and in transit
[x] Apply security groups with minimal permissions
[x] Use VPC endpoints to keep traffic off the public internet
[x] Enable GuardDuty or equivalent threat detection
[x] Run regular vulnerability scans
[x] Document and test your incident response plan