# Cloud Security Patterns

> Cloud infrastructure security patterns for IaC and cloud services. Use when writing or reviewing Terraform, CDK, CloudFormation, Kubernetes manifests, or cloud infrastructure configuration. Do NOT use for application code security -- use security-patterns instead.

- Skill: `majiayu000/cloud-security-patterns` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/cloud-security-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/cloud-security-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/cloud-security-patterns

---


# Cloud Security Patterns

Cloud infrastructure security principles. For application code security (OWASP, input validation, authentication), see security-patterns skill.

## IAM

- No wildcard permissions (`*`) on actions or resources
- Service accounts scoped to minimum required actions
- Prefer IAM roles over long-lived access keys
- Review IAM policies for overly broad resource access (`Resource: "*"`)
- Separate IAM roles per service/function (no shared "admin" roles)

## Network Segmentation

- Databases and internal services not exposed to public internet
- Security groups and network policies follow deny-by-default
- Service-to-service communication restricted to required paths only
- Public-facing resources isolated in separate subnets/VPCs
- Egress rules restrict outbound traffic to known destinations

## Secrets Management

- No secrets in environment variables, config files, source code, or IaC templates
- Use dedicated secrets managers (Vault, AWS Secrets Manager, GCP Secret Manager)
- Secrets rotated on a defined schedule
- Secret references in IaC use dynamic lookups (not hardcoded values)
- CI/CD pipeline secrets scoped to the minimum required stage

## Container Security

- Base images from trusted registries only
- Images pinned by digest, not mutable tags
- Containers run as non-root user
- Read-only root filesystem where possible
- No privileged mode unless explicitly justified

## IaC Security Scanning

For pipeline integration of security scanning (SAST, secrets detection, dependency scanning), see cicd-patterns skill. The following are IaC-specific scanning concerns:

- Terraform/CDK/CloudFormation templates scanned for misconfigurations before apply
- Security group rules reviewed for overly permissive access (0.0.0.0/0)
- Encryption at rest enabled for all data stores
- Logging enabled for all services (CloudTrail, VPC Flow Logs, access logs)

## Review Checklist

- [ ] No wildcard IAM permissions
- [ ] No secrets in IaC templates or environment variables
- [ ] Databases not publicly accessible
- [ ] Containers run as non-root
- [ ] Base images pinned by digest
- [ ] Encryption at rest enabled
- [ ] Logging and audit trails enabled