Cloud Security

Cloud Security Patterns

IAM Least Privilege

// AWS — service-specific role, no wildcards
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-app-data/*",
      "Condition": {
        "StringEquals": {
          "s3:prefix": ["uploads/${aws:userid}/"]
        }
      }
    }
  ]
}

# Find overly permissive policies
aws iam get-account-authorization-details \
  --query 'UserDetailList[*].AttachedManagedPolicies'

# IAM Access Analyzer — find external access
aws accessanalyzer create-analyzer \
  --analyzer-name account-analyzer \
  --type ACCOUNT

# List findings
aws accessanalyzer list-findings --analyzer-name account-analyzer

Service Control Policies (AWS Organizations)

// Prevent disabling CloudTrail across all accounts
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyCloudTrailDisable",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:DeleteTrail",
        "cloudtrail:StopLogging",
        "cloudtrail:UpdateTrail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyLeaveOrg",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    },
    {
      "Sid": "RequireMFA",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {"aws:MultiFactorAuthPresent": "false"},
        "StringNotEquals": {"aws:PrincipalType": "Service"}
      }
    }
  ]
}

AWS Security Hub & GuardDuty

# Enable Security Hub (aggregates findings)
aws securityhub enable-security-hub \
  --enable-default-standards \
  --region us-east-1

# Enable GuardDuty (threat detection)
aws guardduty create-detector --enable --finding-publishing-frequency FIFTEEN_MINUTES

# Get high-severity findings
aws guardduty list-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-criteria '{"Criterion":{"severity":{"Gte":7}}}'

CloudTrail Alerting

# Alert on root account usage via CloudWatch
import boto3

cloudwatch = boto3.client('cloudwatch')
logs = boto3.client('logs')

# Create metric filter for root API calls
logs.put_metric_filter(
    logGroupName='CloudTrail/DefaultLogGroup',
    filterName='RootAccountUsage',
    filterPattern='{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }',
    metricTransformations=[{
        'metricName': 'RootAccountUsageCount',
        'metricNamespace': 'CloudTrailMetrics',
        'metricValue': '1'
    }]
)

# Create alarm
cloudwatch.put_metric_alarm(
    AlarmName='RootAccountUsage',
    MetricName='RootAccountUsageCount',
    Namespace='CloudTrailMetrics',
    Statistic='Sum',
    Period=300,
    EvaluationPeriods=1,
    Threshold=1,
    ComparisonOperator='GreaterThanOrEqualToThreshold',
    AlarmActions=['arn:aws:sns:us-east-1:123456789:security-alerts']
)

Infrastructure as Code Security Scanning

# tfsec — Terraform security scanner
brew install tfsec
tfsec . --minimum-severity HIGH

# Checkov — multi-framework IaC scanner
pip install checkov
checkov -d . --framework terraform
checkov -f docker-compose.yml --framework dockerfile
checkov -d k8s/ --framework kubernetes

# KICS — another IaC scanner
docker run -v $(pwd):/path checkmarx/kics scan -p /path -o /path/results

GCP Security Patterns

# Enable Security Command Center
gcloud services enable securitycenter.googleapis.com

# Org-level audit log config
gcloud organizations add-iam-policy-binding ORG_ID \
  --member="serviceAccount:audit@project.iam.gserviceaccount.com" \
  --role="roles/logging.viewer"

# VPC Service Controls — restrict API access by network
gcloud access-context-manager perimeters create myperimeter \
  --policy=POLICY_NAME \
  --title="Production Perimeter" \
  --resources=projects/my-project \
  --restricted-services=storage.googleapis.com,bigquery.googleapis.com

Security Posture Checklist

Identity:
  ✓ Root/owner account has MFA, no access keys
  ✓ All human access via SSO (no long-lived IAM users)
  ✓ Service accounts use short-lived tokens (Workload Identity)
  ✓ No wildcard permissions (*) in production roles

Logging:
  ✓ CloudTrail enabled in all regions, logs to immutable S3
  ✓ VPC Flow Logs enabled
  ✓ S3 access logging enabled for sensitive buckets
  ✓ Logs retained ≥1 year

Network:
  ✓ No 0.0.0.0/0 inbound except ports 80/443
  ✓ SSH/RDP via bastion or SSM Session Manager (no open 22/3389)
  ✓ VPC endpoints for S3/DynamoDB (no internet traversal)

Data:
  ✓ S3 Block Public Access enabled account-wide
  ✓ Encryption at rest (KMS CMK for sensitive data)
  ✓ RDS encrypted, no public endpoint
  ✓ Secrets in Secrets Manager (not env vars in Lambda)