Cloud Native Security

name: cloud-native-security description: >- Cloud-native security covering service mesh hardening, Kubernetes admission controllers, serverless function misconfiguration, IaC security scanning, cloud workload protection, container runtime threats, cloud IAM auditing, GitOps security, cloud resource drift detection, logging completeness audits, secrets management, and cloud lateral movement detection. Spans AWS, GCP, Azure, and multi-cloud Kubernetes environments. domain: cybersecurity subdomain: cloud-native-security tags: - kubernetes - service-mesh - admission-controllers - serverless - infrastructure-as-code - cwpp - cloud-iam - gitops - drift-detection - cloud-logging - secrets-management - lateral-movement version: "1.0" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack: ["T1190", "T1078.004", "T1580", "T1552.007", "T1021.004", "T1538"] nist-csf: ["PR.AC-4", "PR.DS-5", "PR.IP-1", "DE.CM-1", "DE.CM-7"] frameworks: ["CIS Kubernetes Benchmark", "CIS AWS Foundations", "NIST SP 800-190", "NSA K8s Hardening Guide"]

Cloud-Native Security

When to Use

Activate when the operator asks about securing cloud-native architectures — service meshes, Kubernetes admission control, serverless security, IaC scanning, CWPP, cloud IAM, GitOps pipelines, drift detection, cloud logging, secrets management, or lateral movement detection across AWS/GCP/Azure/K8s environments.

Mode: [MODE: RED] for cloud attack paths; [MODE: BLUE] for cloud defense and detection; [MODE: ARCHITECT] for secure cloud-native design.

Prerequisites

• kubectl configured for target cluster
• AWS CLI / gcloud / az CLI authenticated
• Terraform >= 1.5 or OpenTofu for IaC scanning
• Istio/Linkerd CLI for service mesh operations
• OPA/Gatekeeper or Kyverno for admission control
• Falco or Tetragon for runtime detection

Quick Reference

Techniques

Workflow

1. Assess Cloud-Native Posture

# Kubernetes cluster scan
trivy k8s --report summary cluster

# AWS account baseline
aws configservice describe-compliance-by-config-rule --output json

# Terraform state audit
terraform plan -detailed-exitcode -out=plan.tfplan

2. Harden Admission Control

# Install Gatekeeper
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml

# Apply constraint templates
kubectl apply -f constraint-templates/
kubectl apply -f constraints/

3. Runtime Detection

# Deploy Falco
helm install falco falcosecurity/falco --namespace falco --create-namespace

# Verify rules
falco --list | grep -i cloud

4. Continuous Compliance

# IaC scanning in CI
tfsec . --format json --out results.json
checkov -d . --output json > checkov-results.json

Verification

• Service mesh mTLS enforced (STRICT mode, no PERMISSIVE)
• Admission controllers block privileged pods in production
• Serverless functions follow least-privilege IAM
• IaC scanned in CI/CD — zero HIGH+ findings
• CWPP deployed on all nodes and workloads
• Runtime detection rules tuned and alerting
• Cloud IAM follows least privilege — no wildcard policies
• GitOps pipelines enforce signed commits and image verification
• Drift detection runs on schedule with alerts
• All cloud API actions logged (no blind spots)
• Secrets managed via Vault/CSI — no hardcoded credentials
• Lateral movement detection rules deployed in SIEM

Detection Opportunities

• Service mesh telemetry for unauthorized service-to-service calls
• Admission controller audit logs for denied workload deployments
• CloudTrail/GCP Audit Logs for IAM privilege escalation
• Terraform plan diffs for unauthorized infrastructure changes
• Falco alerts for container escape and runtime anomalies
• SIEM correlation for cross-account lateral movement patterns