Cloud Security
This chapter focuses on protecting cloud identities, data, and networks. You will learn identity and access management, encryption at rest and in transit, key management, network controls, and core security principles such as least privilege and defense in depth.
Identity and access management
Identity and access management (IAM) governs who can do what. The principle of least privilege grants each user or service only the permissions it needs, limiting damage if credentials are compromised. Roles and policies define access, and multi-factor authentication adds a second factor beyond the password, which is especially important for administrative accounts. Federation and single sign-on centralize identity while still allowing strong authentication.
Encryption and key management
Data should be protected both at rest and in transit. Encryption at rest, such as full-disk or storage-level encryption, protects stored data, while Transport Layer Security (TLS) encrypts data as it moves across networks. A key management service centralizes the creation, rotation, and access control of encryption keys, supporting compliance and separation of duties so that no single person has unchecked access to both data and keys.
Network security controls
Layered network controls form defense in depth. Security groups and firewalls restrict traffic to only the ports and sources required, and default-deny rules are safer than broad allow rules. Placing sensitive tiers in private subnets, using zero-trust principles that verify every request, and segmenting networks all reduce the blast radius of a compromise.
Vulnerability and compliance management
Ongoing security requires finding and fixing weaknesses and proving controls to auditors. Vulnerability scanning identifies missing patches and misconfigurations, which are then prioritized and remediated. Compliance frameworks impose requirements on how data is handled, and cloud providers offer tools and attestations to help customers meet them, but the customer remains responsible for configuring their own resources correctly.