Cloud security

Cloud Security

Comprehensive cloud security guidance for AWS, GCP, and Azure. Covers IAM, network security, data protection, compliance, and automated security scanning.

"Cloud security is a shared responsibility. Know your side of the shared model."

---

🎯 When to Use

• Securing cloud infrastructure (AWS/GCP/Azure)
• Configuring IAM policies and roles
• Hardening storage (S3, GCS, Blob)
• Setting up network security (VPC, NSG, firewall rules)
• Compliance preparation (SOC2, ISO 27001, PCI-DSS)
• Auditing cloud resources for misconfigurations
• Incident response in cloud environments

---

☁️ Shared Responsibility Model

┌─────────────────────────────────────────────────────────────┐
│                      CUSTOMER                               │
│  ├─ Data security & encryption                              │
│  ├─ Identity & access management                            │
│  ├─ Application security                                    │
│  ├─ OS, network, firewall configuration                     │
│  ├─ Client-side encryption                                  │
│  └─ Server-side encryption (customer-managed keys)          │
├─────────────────────────────────────────────────────────────┤
│                      CLOUD PROVIDER                         │
│  ├─ Physical infrastructure                                 │
│  ├─ Host OS & virtualization                                │
│  ├─ Network infrastructure                                  │
│  └─ Data center security                                    │
└─────────────────────────────────────────────────────────────┘

---

🔐 AWS Security

IAM Best Practices

// Least privilege policy example
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-bucket/${aws:username}/*",
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }
    ]
}

# IAM audit commands
aws iam list-users --output table
aws iam list-roles --output table
aws iam list-policies --scope Local --output table
aws iam get-account-authorization-details

# Check for unused credentials
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | column -t -s,

# Find policies with wildcards
aws iam list-policies --scope Local | jq '.Policies[] | select(.Arn | contains("arn:aws:iam")) | .PolicyName'

S3 Bucket Security

# Check bucket permissions
aws s3api get-bucket-acl --bucket my-bucket
aws s3api get-bucket-policy --bucket my-bucket
aws s3api get-public-access-block --bucket my-bucket

# Secure bucket configuration
aws s3api put-public-access-block \
    --bucket my-bucket \
    --public-access-block-configuration \
    "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

# Enable encryption
aws s3api put-bucket-encryption \
    --bucket my-bucket \
    --server-side-encryption-configuration '{
        "Rules": [{
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms",
                "KMSMasterKeyID": "arn:aws:kms:region:account:key/key-id"
            },
            "BucketKeyEnabled": true
        }]
    }'

# Enable versioning and logging
aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled
aws s3api put-bucket-logging --bucket my-bucket --bucket-logging-status '{
    "LoggingEnabled": {
        "TargetBucket": "my-logs-bucket",
        "TargetPrefix": "s3-access-logs/"
    }
}'

VPC Security

# Security group audit
aws ec2 describe-security-groups --query 'SecurityGroups[?length(IpPermissions[?IpRanges[?CidrIp==`0.0.0.0/0`]]) > `0`].[GroupName,GroupId]'

# Remove overly permissive rules
aws ec2 revoke-security-group-ingress \
    --group-id sg-xxxxxxxx \
    --protocol tcp \
    --port 22 \
    --cidr 0.0.0.0/0

# VPC Flow Logs
aws ec2 create-flow-logs \
    --resource-type VPC \
    --resource-ids vpc-xxxxxxxx \
    --traffic-type ALL \
    --log-destination-type cloud-watch-logs \
    --log-group-name vpc-flow-logs \
    --deliver-logs-permission-arn arn:aws:iam::account:role/FlowLogsRole

AWS Security Tools

# AWS Config for compliance monitoring
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "s3-bucket-public-read-prohibited",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
        }
    }'

# GuardDuty (threat detection)
aws guardduty create-detector --enable

# Security Hub (centralized security findings)
aws securityhub enable-import-findings-for-product --product-arn arn:aws:securityhub:region::product/aws/guardduty

# Inspector (vulnerability scanning)
aws inspector create-assessment-target --assessment-target-name production-target

---

🔐 GCP Security

IAM & Access Control

# List IAM policies
gcloud projects get-iam-policy PROJECT_ID
gcloud resource-manager folders get-iam-policy FOLDER_ID
gcloud organizations get-iam-policy ORGANIZATION_ID

# Check for overly permissive bindings
gcloud projects get-iam-policy PROJECT_ID --format=json | jq '.bindings[] | select(.role=="roles/owner" or .role=="roles/editor")'

# Service account audit
gcloud iam service-accounts list
gcloud iam service-accounts keys list [email protected]

Cloud Storage Security

# Check bucket IAM
gsutil iam get gs://my-bucket

# Enable uniform bucket-level access
gsutil uniformbucketlevelaccess set on gs://my-bucket

# Enable encryption
gsutil kms encryption -k projects/PROJECT/locations/LOCATION/keyRings/RING/cryptoKeys/KEY gs://my-bucket

# Enable access logging
gsutil logging set on -b gs://logs-bucket -o access_log/ gs://my-bucket

VPC & Network Security

# Firewall rules audit
gcloud compute firewall-rules list --format='table(name,sourceRanges,allowed)'

# Check for overly permissive rules
gcloud compute firewall-rules list --filter="sourceRanges='0.0.0.0/0'"

# VPC Flow Logs
gcloud compute networks subnets update SUBNET \
    --region=REGION \
    --enable-flow-logs

GCP Security Tools

# Security Command Center
# Enable in console or via gcloud

# Cloud Asset Inventory
gcloud asset list --content-type resource --asset-types="compute.googleapis.com/Instance"

# Policy Analyzer
gcloud asset analyze-iam-policy --organization=ORGANIZATION_ID

---

🔐 Azure Security

RBAC & Access Control

# List role assignments
Get-AzRoleAssignment | Where-Object { $_.Scope -eq "/subscriptions/$subscriptionId" }

# Check for Owner/Contributor roles
Get-AzRoleAssignment | Where-Object { $_.RoleDefinitionName -in @("Owner","Contributor") }

# Custom role with least privilege
$role = Get-AzRoleDefinition "Reader"
$role.Id = $null
$role.Name = "Custom VM Operator"
$role.Description = "Can start/stop VMs"
$role.Actions = @("Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/deallocate/action")
$role.NotActions = @()
$role.AssignableScopes = @("/subscriptions/$subscriptionId")
New-AzRoleDefinition -Role $role

Storage Account Security

# Enable secure transfer
Set-AzStorageAccount -Name mystorage -ResourceGroupName myrg -EnableHttpsTrafficOnly $true

# Enable encryption
Set-AzStorageAccount -Name mystorage -ResourceGroupName myrg -StorageEncryption

# Network rules
$rule = New-AzStorageAccountNetworkRuleSet -DefaultAction Deny
Add-AzStorageAccountNetworkRule -ResourceGroupName myrg -Name mystorage -VirtualNetworkResourceId $subnetId

Network Security

# NSG audit
Get-AzNetworkSecurityGroup | ForEach-Object { $_.SecurityRules | Where-Object { $_.SourceAddressPrefix -eq "*" } }

# Enable NSG flow logs
Set-AzNetworkWatcherConfigFlowLog -NetworkWatcher $nw -TargetResourceId $nsg.Id -StorageAccountId $storage.Id -EnableFlowLog $true

Azure Security Tools

# Azure Security Center (Defender for Cloud)
Set-AzSecurityPricing -Name "VirtualMachines" -PricingTier "Standard"

# Azure Policy for compliance
New-AzPolicyAssignment -Name "require-https-storage" -PolicyDefinition $policy -Scope "/subscriptions/$subscriptionId"

# Azure Sentinel (SIEM)
# Deploy via Azure Portal or ARM templates

---

🔍 Automated Security Scanning

Cloud Security Posture Management (CSPM)

# Prowler (AWS)
prowler aws --category identity --severity critical
prowler aws --checks s3_bucket_public_read_acl

# ScoutSuite (AWS/GCP/Azure)
scout aws --report-dir ./scout-report
scout gcp --report-dir ./scout-report
scout azure --report-dir ./scout-report

# CloudSploit (AWS/GCP/Azure)
# Requires API keys, runs as SaaS or self-hosted

# Steampipe (AWS/GCP/Azure)
steampipe query "select * from aws_s3_bucket where block_public_acls = false"
steampipe check aws_compliance.benchmark.cis_v130

Infrastructure as Code (IaC) Scanning

# Checkov
checkov -d ./terraform --framework terraform

# tfsec
tfsec ./terraform

# Terrascan
terrascan scan -i terraform -d ./terraform

# Semgrep for cloud configs
semgrep --config=auto --json ./terraform

---

📋 Compliance Mapping

SOC 2 Controls

Control	AWS	GCP	Azure
Access Control	IAM + MFA	IAM + 2FA	RBAC + MFA
Encryption	KMS + S3 SSE	CMEK + Cloud KMS	Key Vault
Monitoring	CloudTrail + Config	Cloud Audit Logs	Activity Log
Logging	CloudWatch + S3	Cloud Logging	Log Analytics

CIS Benchmarks

# AWS CIS Benchmark
prowler aws --compliance cis_1.5_aws

# GCP CIS Benchmark
gcloud compute instances list --format=json | jq -r '.[] | .name'
# Use Forseti or CIS-CAT for automated scanning

# Azure CIS Benchmark
# Use Azure Policy built-in initiatives

---

🚨 Incident Response in Cloud

1. Detection
   ├─ CloudWatch/Cloud Logging alerts
   ├─ GuardDuty/Security Center findings
   └─ SIEM correlation rules

2. Containment
   ├─ Isolate compromised instances (security group rules)
   ├─ Revoke compromised credentials
   ├─ Disable compromised accounts
   └─ Snapshot affected resources for forensics

3. Eradication
   ├─ Patch vulnerabilities
   ├─ Rotate all potentially exposed secrets
   ├─ Rebuild compromised instances from clean images
   └─ Update IAM policies

4. Recovery
   ├─ Restore from clean backups
   ├─ Verify integrity of restored systems
   └─ Gradually restore access

5. Lessons Learned
   ├─ Update threat models
   ├─ Improve detection rules
   └─ Update runbooks

---

📚 References

• AWS Security Best Practices
• GCP Security Foundations
• Azure Security Documentation
• CIS Cloud Benchmarks
• Cloud Security Alliance