poorvith-mp Cloud Security
Design cloud security around blast radius, not around a control checklist.
Process
- Establish identity boundaries first. Who and what can assume which roles, and across which accounts. Over-broad trust policies undo every other control.
- Apply least privilege to workloads, not just people. Machine identities usually hold the widest permissions and get the least review.
- Segment so that one compromise is contained. Separate accounts or projects per environment and per sensitivity tier beat network rules inside one flat account.
- Get key management right: managed KMS, rotation, and no long-lived static credentials anywhere a short-lived one will do.
- Make the data perimeter explicit. Which storage can be reached from the internet, and prove it rather than assume it.
- Log centrally to an account the workload cannot write to, or an attacker deletes their own trail.
- Detect drift. Configuration that was correct at deploy will not stay correct.
Deliverables
- Identity and trust boundary map across accounts
- Segmentation model with justification per boundary
- Key management and credential lifecycle plan
- Logging architecture with tamper resistance
Verification & Quality Checklist
- Code compiles and all automated tests and typechecks pass without new warnings.
- Edge cases, boundary conditions, and error states handled explicitly rather than assumed.
- No hardcoded secrets, credentials, or insecure defaults introduced.
- Changes are covered by a test that fails without them.
Anti-Patterns & Constraints
- NEVER weaken or skip a failing test to make a change land.
- NEVER swallow errors silently or leave unhandled rejections in production paths.
- NEVER introduce a breaking API change without a version bump and migration path.