Cloud Security Fundamentals

Shared responsibility

The provider secures the cloud (hardware, virtualisation, and the physical data centres). You secure what you put in it — data, identity, configuration, and the OS on your VMs.

Most breaches are customer-side: a public bucket or an over-permissive role.

$ aws s3api get-bucket-acl --bucket my-bucket   # is it public?

Two habits prevent most incidents: least privilege and no public by default.

Flag: ASEC{no_public_by_default}

Identity runs everything

There is no network edge to hide behind in the cloud — identity decides what can talk to what. Scoped roles, short-lived credentials, MFA, and no long-lived keys in code remove most attack paths.

$ aws sts get-caller-identity      # who am I / which role am I using?

A leaked access key with broad permissions is one of the most common ways cloud accounts fall.

Job-Ready Notes

Tools to know: ScoutSuite, Prowler, Pacu, the aws CLI, kube-bench.
Cheat sheet

aws sts get-caller-identity      # who am I / which role?
prowler aws                      # audit an AWS account

Interview practice

• Explain the shared responsibility model.
• Why is identity (IAM) called the new perimeter?
• Describe the SSRF-to-cloud-metadata attack.