Cloud security
14 guides tagged Cloud security, grouped by topic, with the SDLC phase and role each is written for.
Application security
1 guideRuntime, cloud & APIs
11 guidesReview infrastructure changes as access changes
Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
Release, Maintenance · Developers, Platform engineers and SREs
Review cloud permissions and role trust together
Distinguish who can obtain a cloud identity from what that identity can do, then test the effective access path.
Release, Maintenance · Developers, Platform engineers and SREs
Prevent subdomain takeover from dangling DNS records
A DNS record that outlives its cloud resource lets whoever claims the name serve content on your domain. Bind records to resources in IaC, remove the record first, verify domains and scan for dangling records.
Release, Maintenance · Platform engineers and SREs
Authenticate workloads and authorize their service actions
Use service identities, mutual TLS and function permissions without mistaking an encrypted connection for complete authorization.
Release, Maintenance · Platform engineers and SREs
Turn runtime events into a tested investigation and containment path
Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.
Maintenance · Platform engineers and SREs
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs
Detect container and host threats at runtime with eBPF sensors and cloud services
Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.
Maintenance · Platform engineers and SREs
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Development, Release, Maintenance · AppSec engineers, Platform engineers and SREs
Choose cloud security posture tools and apply zero trust
What CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM each find and miss, how they overlap, how to evaluate one on your own accounts, and how zero trust as defined in NIST SP 800-207 uses what they measure.
Testing, Release, Maintenance, Security program · Platform engineers and SREs
Case study: the CircleCI security incident (January 2023)
How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.
Release, Maintenance · Platform engineers and SREs
Case study: Microsoft AI researchers' over-permissive SAS token (2023)
How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.
Maintenance · Platform engineers and SREs
Identity & cryptography
2 guidesEnvelope encryption and key rotation: data keys, KMS keys and backups
Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.
Design, Maintenance · Developers, Platform engineers and SREs
Contain a leaked secret, then investigate and clean up
Revoke an exposed API key, token or private key at its issuer before anything else, end the sessions it minted, check the provider's logs, then remove every copy and replace it with a credential that expires on its own.
Development, Maintenance · Developers, AppSec engineers, Platform engineers and SREs
Practice
SSRF lab: Guard an outbound fetch against SSRF
A webhook sender fetches whatever URL the user gives it, and follows redirects. An attacker can point it at the cloud metadata service or an internal admin page, directly or through a redirect. Repair the guard so it resolves each host and refuses private addresses, in literals, encodings and redirects alike.
SSRF validation lab: Validate a fetch URL with ipaddress
An image importer fetches any URL a user submits, so a crafted URL reaches the cloud metadata service or an internal host, directly or through an encoded IP literal. Repair the validator so it parses the URL, resolves the host and allows only public addresses.
IAM trust policy lab: Evaluate a role trust policy against the confused deputy
An evaluator for AWS sts:AssumeRole trust policies matches the principal and action but ignores the Condition block and does not honour an explicit Deny, so a broad principal can assume a role without the external id — the confused deputy. Repair evaluate_trust to enforce conditions and Deny.