Securing workloads in AWS, Azure and GCP. The provider secures the cloud; you secure what you put in it. Service detail is in 2. AWS IAM and Security, 5. Azure Identity and Security and 1. GCP Fundamentals. Principles are in 1. Security Fundamentals.

Shared responsibility

flowchart TB
    subgraph You[Your responsibility]
    D[Data and classification]
    I[Identities and access]
    C[Configuration of services]
    A[Application and code]
    O[OS, patching and network rules on VMs]
    end
    subgraph Provider[Provider responsibility]
    H[Hardware, data centres, global network]
    V[Hypervisor and managed-service internals]
    end
    You --> Provider

The more managed the service, the more the provider handles (VM > container > serverless > SaaS). Identity, data and configuration are always yours. Most cloud breaches are misconfiguration, not provider failure.

Services at a glance

1. Identity First

Identity is the new perimeter.

• Never use the root / global admin account for daily work. Lock it away with MFA and alerts on use
• Least privilege: start with nothing, add narrow permissions, review regularly (IAM Access Analyzer, Entra access reviews, IAM Recommender)
• Roles over long-lived keys: instances, functions and pods assume roles (instance profiles, managed identities, workload identity). No access keys in code
• MFA for every human; short-lived credentials through SSO
• Federation for CI/CD: GitHub Actions to the cloud with OIDC, no stored keys (GitHub Actions)
• Separate accounts / subscriptions / projects per environment and workload to limit blast radius

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::my-unique-bucket-12345/reports/*"
  }]
}

A narrow policy: one action, one prefix. Compare with the "Action": "*" anti-pattern.

2. Protect Data

Keys: separate who can use a key from who can administer it; log all key usage.

3. Secure the Network

• Private by default: workloads in private subnets, one controlled entry (load balancer, WAF, CDN)
• Security groups / NSGs: allow only needed ports from needed sources. Never 0.0.0.0/0 on SSH or RDP; use SSM Session Manager, Azure Bastion or IAP tunnels instead
• Private endpoints keep traffic to storage and databases off the internet
• Egress control: restrict outbound traffic to stop data exfiltration and callbacks
• WAF in front of public web apps; DDoS protection for exposed services
• Segment with hub-and-spoke networks and firewalls (VPC Playground, Cloud Portfolio Blueprints)

Network concepts: Network Security.

4. Log, Detect, Respond

flowchart LR
    S[Cloud services and apps] --> L[Central audit logs]
    L --> D[Threat detection]
    D --> A[Alerts]
    A --> R[Respond: isolate, revoke, restore]
    L --> K[(Long-term immutable storage)]

• Turn on organisation-wide audit logging (CloudTrail, Activity Log, Cloud Audit Logs) and send it to a separate, locked account / project
• Enable managed threat detection (GuardDuty, Defender for Cloud, Security Command Center)
• Alert on: root / admin sign-in, MFA disabled, policy changes, new public resources, unusual regions, large data transfers
• Keep logs long enough to investigate (months), protected from deletion

5. Govern with Policy and Posture

• Policy as code blocks bad configuration before it ships: SCPs, Azure Policy, Organization Policy, plus Terraform checks
• CSPM (cloud security posture management) continuously finds drift: Security Hub, Defender for Cloud, Security Command Center
• Tag and inventory everything so there are no orphaned, unowned resources
• Cost anomalies are also a security signal (crypto-mining shows up as a bill spike): 6. Azure Governance and Cost Management

Benchmarks to measure against: CIS Benchmarks for each cloud and cloud provider well-architected security pillars.

6. Secure the Build and Deploy Path

• Scan infrastructure code (Checkov, tfsec / Trivy, cfn-lint) before apply: Terraform Best Practices, Infrastructure as Code
• Scan container images and use minimal base images: 3. Container Images and Build Tools
• Keep Terraform state private and encrypted: it can contain secrets
• Protect the pipeline itself: 5. Secure Coding and Supply Chain
• Kubernetes: RBAC, network policies, pod security, no privileged containers (Orchestration Platforms)

Common Cloud Mistakes

Quick Review Checklist

• [ ] MFA on all humans; root / global admin locked down
• [ ] No long-lived keys; roles and OIDC used
• [ ] Storage private by default and encrypted
• [ ] Private subnets, narrow security groups, no open admin ports
• [ ] Audit logs on, centralised and protected
• [ ] Threat detection and posture tools enabled
• [ ] Policy guardrails and IaC scanning in the pipeline
• [ ] Backups tested; budget alerts set