# Cloud Security

> Securing cloud infrastructure, services, and workloads across AWS, GCP, and Azure environments

- Skill: `ffsshhttiikk/cloud-security-2` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/cloud-security-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/cloud-security-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/cloud-security-2

---


# Cloud Security

## What I Do

I provide guidance on securing cloud-native infrastructure and workloads. This covers identity and access management (IAM), network segmentation, encryption at rest and in transit, secure configuration of cloud services, infrastructure-as-code security scanning, and compliance monitoring across major cloud providers.

## When to Use Me

- Designing IAM policies and role hierarchies for cloud accounts
- Configuring VPCs, security groups, and network ACLs
- Implementing encryption for storage, databases, and message queues
- Scanning Terraform/CloudFormation templates for misconfigurations
- Setting up cloud audit logging and monitoring
- Achieving compliance (SOC 2, HIPAA, PCI-DSS) in cloud environments

## Core Concepts

1. **Shared Responsibility Model**: Cloud providers secure the infrastructure; customers secure their configurations, data, and applications running on it.
2. **IAM Least Privilege**: Grant only the permissions required for a specific task using fine-grained policies, conditions, and permission boundaries.
3. **Network Segmentation**: Use VPCs, subnets, security groups, and NACLs to isolate workloads and restrict lateral movement.
4. **Encryption Everywhere**: Encrypt data at rest (KMS-managed keys) and in transit (TLS 1.2+) for all services.
5. **Infrastructure as Code Security**: Scan IaC templates (Terraform, CloudFormation) for misconfigurations before deployment.
6. **Cloud Audit Logging**: Enable CloudTrail (AWS), Cloud Audit Logs (GCP), or Activity Log (Azure) and ship to a centralized SIEM.
7. **Service Control Policies**: Organization-level guardrails that restrict what member accounts can do regardless of IAM permissions.
8. **Secrets Management**: Use cloud-native secrets managers (Secrets Manager, Parameter Store, Vault) instead of hardcoded credentials.
9. **Immutable Infrastructure**: Deploy new instances instead of patching running ones to reduce configuration drift.

## Code Examples

### 1. Least-Privilege IAM Policy (AWS Terraform)

```hcl
resource "aws_iam_policy" "s3_reader" {
  name        = "s3-data-reader"
  description = "Read-only access to specific S3 bucket"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid      = "AllowReadSpecificBucket"
        Effect   = "Allow"
        Action   = ["s3:GetObject", "s3:ListBucket"]
        Resource = [
          "arn:aws:s3:::my-data-bucket",
          "arn:aws:s3:::my-data-bucket/*"
        ]
        Condition = {
          StringEquals = {
            "aws:RequestedRegion" = "us-east-1"
          }
        }
      }
    ]
  })
}
```

### 2. Secure VPC with Private Subnets (Terraform)

```hcl
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

resource "aws_subnet" "private" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = false
  availability_zone       = "us-east-1a"
}

resource "aws_security_group" "app" {
  vpc_id = aws_vpc.main.id

  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
```

### 3. KMS Encryption for S3 Bucket (Terraform)

```hcl
resource "aws_kms_key" "data_key" {
  description             = "KMS key for data bucket encryption"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

resource "aws_s3_bucket_server_side_encryption_configuration" "data" {
  bucket = aws_s3_bucket.data.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.data_key.arn
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket                  = aws_s3_bucket.data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}
```

### 4. Cloud Audit Logging (AWS CloudTrail Terraform)

```hcl
resource "aws_cloudtrail" "main" {
  name                          = "org-audit-trail"
  s3_bucket_name                = aws_s3_bucket.trail.id
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  kms_key_id                    = aws_kms_key.trail_key.arn

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3"]
    }
  }
}
```

## Best Practices

1. **Enforce MFA** for all human users and require it for sensitive API operations via IAM conditions.
2. **Use service accounts and roles** instead of long-lived access keys for machine-to-machine authentication.
3. **Block public access** to storage buckets and databases by default using account-level settings.
4. **Enable key rotation** for all KMS keys and rotate access credentials on a regular schedule.
5. **Scan IaC templates** with tools like tfsec, Checkov, or cfn-nag before applying changes.
6. **Tag all resources** with owner, environment, and data-classification to support audit and cost tracking.
7. **Use VPC endpoints** for AWS service access to keep traffic off the public internet.
8. **Centralize logging** into a dedicated security account with immutable storage and alerting.
9. **Apply Service Control Policies** at the organization level to prevent disabling of security controls.
10. **Review and prune IAM permissions** quarterly using access advisor data and unused permission reports.