# Cloud Security

> Comprehensive cloud security practices including identity, network, data, and compliance controls

- Skill: `neuralblitz/cloud-security-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add neuralblitz/cloud-security-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/neuralblitz/cloud-security-4/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: NeuralBlitz (https://skillmd.com/u/neuralblitz)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/neuralblitz/cloud-security-4

---


# Cloud Security

## What I Do

I provide comprehensive expertise in cloud security - protecting cloud infrastructure, applications, and data from threats through identity management, network security, encryption, and compliance controls. I cover multi-cloud security strategies, zero-trust architectures, security automation, incident response, and regulatory compliance frameworks. My approach integrates security throughout the cloud lifecycle from infrastructure design to operational monitoring.

## When to Use Me

- Designing secure cloud architectures with defense-in-depth principles
- Implementing identity and access management for cloud resources
- Configuring network security controls (firewalls, VPCs, security groups)
- Encrypting data at rest and in transit across cloud services
- Meeting compliance requirements (SOC 2, HIPAA, PCI-DSS, GDPR)
- Automating security controls in CI/CD pipelines
- Responding to security incidents in cloud environments
- Implementing cloud-native security tools and services
- Securing container and Kubernetes workloads

## Core Concepts

- **Identity and Access Management (IAM)**: Centralized identity governance with least-privilege access controls
- **Multi-Factor Authentication (MFA)**: Additional verification layers for user and service authentication
- **Zero Trust Architecture**: Never trust, always verify - continuous authentication and authorization
- **Defense in Depth**: Layered security controls across network, application, and data layers
- **Shared Responsibility Model**: Understanding cloud provider vs. customer security responsibilities
- **Encryption at Rest and in Transit**: Protecting data through encryption using KMS and TLS
- **Security Groups and NACLs**: Network-level access controls and firewall rules
- **Secrets Management**: Secure storage and rotation of credentials using vaults
- **Cloud Security Posture Management (CSPM)**: Continuous security monitoring and compliance checking
- **Cloud Workload Protection (CWP)**: Security monitoring for cloud workloads and containers
- **Network Segmentation**: Isolating workloads to limit blast radius of breaches
- **Logging and Monitoring**: Comprehensive audit trails and security event analysis
- **Infrastructure as Code Security**: Scanning IaC templates for security misconfigurations
- **Container Image Scanning**: Identifying vulnerabilities in container images before deployment
- **Threat Detection**: Real-time analysis of security events for anomaly detection

## Code Examples

### AWS IAM Policy with Least Privilege

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnlyAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetBucketLocation",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::secure-bucket-prod",
        "arn:aws:s3:::secure-bucket-prod/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:sourceAccount": "123456789012"
        },
        "ArnEquals": {
          "aws:sourceArn": "arn:aws:cloudformation:us-east-1:123456789012:stack/prod-stack/*"
        }
      }
    },
    {
      "Sid": "AllowDynamoDBQueryOnly",
      "Effect": "Allow",
      "Action": [
        "dynamodb:Query",
        "dynamodb:GetItem"
      ],
      "Resource": "arn:aws:dynamodb:*:*:table/UserDataTable",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:Attributes": [
            "userId",
            "email",
            "createdAt"
          ]
        },
        "StringEquals": {
          "dynamodb:Select": "SPECIFIC_ATTRIBUTES"
        }
      }
    }
  ]
}
```

### Azure Conditional Access Policy

```json
{
  "displayName": "Require MFA for All Non-Admin Users",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeGroups": [
        "c4c639a8-6f1d-4a8b-9a9d-1a2b3c4d5e6f"
      ],
      "excludeGroups": [
        "admin-group-id"
      ]
    },
    "applications": {
      "includeAllApps": true
    },
    "locations": {
      "includeLocations": [
        "All"
      ],
      "excludeLocations": [
        "TrustedLocations"
      ]
    },
    "signInRiskLevels": [
      "low",
      "medium",
      "high"
    ]
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": [
      "mfa"
    ]
  },
  "sessionControls": {
    "signInFrequency": {
      "value": 7,
      "type": "days"
    },
    "persistentBrowser": {
      "mode": "never"
    }
  }
}
```

### Kubernetes NetworkPolicy

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: secure-namespace-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-service
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
          podSelector:
            matchLabels:
              app: ingress-controller
      ports:
        - protocol: TCP
          port: 8080
    - from:
        - podSelector:
            matchLabels:
              app: api-service
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
    - to:
        - ipBlock:
            cidr: 10.0.0.0/8
            except:
              - 10.0.1.0/24
      ports:
        - protocol: TCP
          port: 443
          name: https
        - protocol: TCP
          port: 80
          name: http
```

### AWS Security Hub Integration

```python
import boto3
from datetime import datetime, timedelta
from dataclasses import dataclass
from typing import List, Dict
import json

@dataclass
class SecurityFinding:
    id: str
    title: str
    severity: str
    resource: str
    status: str
    remediation: str

class SecurityHubReporter:
    def __init__(self, region: str = 'us-east-1'):
        self.securityhub = boto3.client('securityhub', region_name=region)
        self.inspector2 = boto3.client('inspector2', region_name=region)
        self.config = boto3.client('config', region_name=region)
        
    def get_critical_findings(self, days: int = 7) -> List[SecurityFinding]:
        findings = []
        start_date = (datetime.utcnow() - timedelta(days=days)).isoformat()
        
        response = self.securityhub.get_findings(
            Filters={
                'RecordState': [{'Value': 'ACTIVE', 'Comparison': 'EQUALS'}],
                'SeverityLabel': [{'Value': 'CRITICAL', 'Comparison': 'EQUALS'}],
                'UpdatedAt': [{'Start': start_date, 'Comparison': 'GREATER_THAN_OR_EQUAL'}]
            },
            SortCriteria=[{'Field': 'UpdatedAt', 'SortOrder': 'DESC'}],
            MaxResults=100
        )
        
        for finding in response.get('Findings', []):
            findings.append(SecurityFinding(
                id=finding.get('Id'),
                title=finding.get('Title'),
                severity=finding.get('Severity', {}).get('Label'),
                resource=self._get_primary_resource(finding),
                status=finding.get('RecordState'),
                remediation=finding.get('Remediation', {}).get('Recommendation', {}).get('Text')
            ))
        
        return findings
    
    def get_vulnerability_findings(self) -> Dict:
        vulnerabilities = {}
        
        response = self.inspector2.list_finding_aggregations(
            findingAggregation={
                'groupByAttribute': 'SEVERITY'
            },
            filterCriteria={
                'findingType': [{'comparison': 'EQUALS', 'value': 'PACKAGE_VULNERABILITY'}],
                'sortBy': ['SEVERITY_DESC']
            }
        )
        
        return response.get('aggregations', [])
    
    def get_config_compliance(self) -> Dict:
        rules = {}
        
        response = self.config.describe_compliance_by_config_rules(
            ComplianceTypes=['AWS::Config::Compliance'],
            Limit=100
        )
        
        for result in response.get('ComplianceByConfigRules', []):
            rule = result.get('ConfigRuleName')
            status = result.get('Compliance().get('ComplianceType')
            count = result.get('Compliance().get('ComplianceContributorCount', {}).get('CappedCount')
            rules[rule] = {'status': status, 'non_compliant_count': count}
        
        return rules
    
    def generate_security_report(self) -> Dict:
        return {
            'generated_at': datetime.utcnow().isoformat(),
            'critical_findings': len(self.get_critical_findings()),
            'vulnerabilities': self.get_vulnerability_findings(),
            'compliance': self.get_config_compliance(),
            'recommendations': self._generate_recommendations()
        }
    
    def _get_primary_resource(self, finding: Dict) -> str:
        resources = finding.get('Resources', [])
        if resources:
            return f"{resources[0].get('Type')}: {resources[0].get('Id')}"
        return 'Unknown'
```

### Terraform Security Scanning Pipeline

```yaml
# .github/workflows/security-scan.yml
name: Infrastructure Security Scan

on:
  push:
    paths:
      - '**.tf'
      - 'terraform/**/*'
  pull_request:
    paths:
      - '**.tf'
      - 'terraform/**/*'
  schedule:
    - cron: '0 0 * * 0'

jobs:
  tfsec:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run tfsec
        uses: aquasecurity/tfsec-action@v1.2.0
        with:
          soft_fail: true
          format: sarif
          output_path: tfsec.sarif
      
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: tfsec.sarif
          category: '/tfsec'

  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          output_format: sarif
          output_file_path: checkov.sarif
      
      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: checkov.sarif
          category: '/checkov'

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_CONFIG_PATH: .gitleaks.toml
      
      - name: Run TruffleHog
        uses: trufflesecurity/trufflehog-action@main
        with:
          extra_args: --filesystem terraform/

  secrets_scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Scan for secrets
        uses: marvinpinto/action-automatic-releases@latest
        with:
          repo: Yelp/detect-secrets
          automatic_release_tag: latest
          files: detect-secrets baseline
```

### GCP Organization Policy

```yaml
# org-policies/iam.yaml
constraints:
  # Disable service account key creation
  constraints/iam.disableServiceAccountKeyCreation: {}
  
  # Restrict allowed service account scopes
  constraints/iam.allowedPolicyMemberDomains:
    - allowedList:
        values:
          - "domain:company.com"
  
  # Require OS Login for VM access
  constraints/compute.requireOsLogin: {}

---
# org-policies/onetwork-security.yaml
constraints:
  # Disable external IP on VMs
  constraints/compute.disableExternalIPCreation:
    deny:
      all: true
  
  # Require VPC flow logs
  constraints/compute.enableVpcFlowLogs:
    enforce: true
  
  # Restrict subnet creation
  constraints/compute.restrictSubnetworkCreation:
    allowedList:
      values:
        - "projects/*/regions/*/subnetworks/prod-*"

---
# org-policies/data-protection.yaml  
constraints:
  # Require CMEK for BigQuery
  constraints/bigquery.restrictPublicVisibility: {}
  
  # Enable VPC Service Controls
  constraints/ storage.uniformBucketLevelAccess:
    enforce: true
  
  # Require labels on resources
  constraints/resourcemanager.requiredLabels:
    requiredList:
      values:
        - key: "environment"
          value: "production"
        - key: "team"
          value: "*"
```

## Best Practices

- Implement zero-trust architecture with continuous verification of all access requests
- Use infrastructure as code with security scanning integrated into CI/CD pipelines
- Enforce least-privilege access with regular reviews and automated access certification
- Enable MFA for all human users and service accounts where possible
- Encrypt all data at rest using customer-managed keys (CMK/CMEK)
- Use TLS 1.2+ for all data in transit with modern cipher suites
- Implement comprehensive logging with SIEM integration for threat detection
- Regular security assessments including penetration testing and red team exercises
- Use cloud-native security services (Security Hub, Defender, Security Command Center)
- Implement network segmentation with strict firewall rules between environments
- Use secrets management services (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager)
- Automate incident response with playbooks and runbooks
- Regular backup and disaster recovery testing with security considerations
- Use container image scanning and signed images with admission controllers
- Implement pod security standards and runtime protection in Kubernetes
- Regular training and security awareness for teams with cloud access

## Common Patterns

- **Shared Responsibility Model**: Clearly define and document security boundaries between provider and customer
- **Defense in Depth**: Layer multiple security controls across network, application, and data layers
- **Assume Breach**: Design systems to minimize impact when breaches occur
- **Just-in-Time Access**: Grant elevated access for limited time periods
- **Policy as Code**: Define and enforce security policies through code
- **Continuous Compliance**: Automate compliance monitoring and reporting
- **Micro-segmentation**: Fine-grained network isolation between workloads
- **Immutable Infrastructure**: Replace rather than modify infrastructure for consistency
- **Secrets Rotation**: Automated rotation of credentials and certificates
- **Security Observability**: Comprehensive logging, metrics, and tracing for security context