Key Takeaways: Cloud Security

A one-page reference. Reread this before an exam or before moving on. Dense by design.

The core vocabulary (memorize cold)

Shared responsibility — who secures what, by model

Rule: your share shrinks moving up the stack, but data and identity are ALWAYS yours — which is why most cloud breaches live in those two layers. "Shared" duties (e.g., encryption at rest) are the trap: provider supplies the capability; you must turn it on.

The top cloud misconfigurations (find these on sight)

Cloud IAM — the least-privilege pattern

// LEAST PRIVILEGE: exactly what's needed, scoped resource, TLS required
{ "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": ["arn:aws:s3:::meridian-loan-docs", "arn:aws:s3:::meridian-loan-docs/*"],
    "Condition": { "Bool": { "aws:SecureTransport": "true" } } }] }

• Design every policy assuming the credential will leak (assume breach → identity). Minimize blast radius.
• Roles + short-lived credentials over long-lived AKIA... keys. Require MFA via policy conditions.
• The wildcard policy ("Action":"*"/"Resource":"*") is the canonical anti-pattern — treat every wildcard as a finding.

CSPM vs. CWPP vs. guardrails — the control-plane hierarchy

Order: prevent with guardrails, detect with CSPM, protect workloads with CWPP — defense in depth on the control plane. Guardrail vs. gate: a guardrail auto-blocks only the unsafe action (engineers move fast); a gate halts a deployment for a human (bottleneck, gets bypassed). Guardrails scale in the cloud.

Cloud logging — the detections every SOC needs

Turn logging on in all regions, make it comprehensive, and protect it from deletion (separate locked-down account + object-lock). A log an attacker can erase is theater.

Decision aid — "which control when?"

Shortcut reflex: see AllUsers on a bucket → public, fix + guardrail. See "Action":"*"/"Resource":"*" → admin-equivalent, right-size. See 0.0.0.0/0 on 22/3389/3306/5432 → internet-exposed admin/DB, restrict source. See StopLogging/DeleteTrail → page someone now.

Certification crosswalk

Project additions this chapter

• Meridian program: cloud security baseline — Block Public Access (guardrail), all-region delete-proof CloudTrail, least-privilege IAM (no *, MFA, no long-lived keys), SCP denying 0.0.0.0/0 on sensitive ports, default encryption, CSPM against the CIS AWS Benchmark wired to the SOC.
• bluekit toolkit: cloudpost.py — s3_public(acl) (public-bucket check) and iam_overbroad(policy) (wildcard-policy check).

Common pitfalls

• Assuming a secure provider means a secure deployment (it does not — your config is your job).
• Misreading a shared duty (encryption at rest) as the provider's — leaving data unencrypted.
• The "Action":"*" policy "to get it working," never tightened — total compromise if the credential leaks.
• A 0.0.0.0/0 rule on an admin/DB port — a breach with a countdown timer.
• Buying a CSPM tool and treating the 4,000-finding dashboard as "the work" (the unwatched-SIEM trap).
• Running CloudTrail but never monitoring it — or running it where an attacker can delete it.
• "A researcher found it, not an attacker" — backwards; it proves the exposure was trivially discoverable.