Sachin Chaurasiya
Search articles, labs, tools…

Path 08 · learning path

Cloud Security Foundations

The controls that decide whether a cloud-hosted system can be exposed safely: short-lived identities for people, workloads and CI; network boundaries that default to deny; secrets kept out of images, source and plain-text storage; audit and application logs you can query; and a hardening checklist that ties them together. Infrastructure as Code Security catches insecure configuration before apply; this path is about the running system.

Parts
5 parts
Total reading time
~1.1 h to read
Difficulty
beginner intermediate
Start with part 1 See the path ↓

What you will learn

  • Replace static access keys with short-lived, workload-bound credentials and scope what each identity can do
  • Segment a workload into public, application and data tiers and prove each boundary with a connection test
  • Keep secrets out of images and source, read what a Kubernetes Secret really stores, and encrypt it at rest
  • Turn on Kubernetes audit logging, tune it, and read who did what from where; alert on the signals that matter

Before you start

Knowledge assumed

  • Terraform basics and the conventions of the Infrastructure as Code Security path
  • Kubernetes basics for the secrets and audit-log parts
  • Builds on Infrastructure as Code Security

Hands-on environment

  • Docker, to run Terraform, Checkov, Vault, Trivy and Gitleaks from their images
  • A disposable Kubernetes cluster (kind 0.31 with one worker is what every part uses)
  • No cloud account: nothing in the path creates billable resources

Each part names what it needs. Nothing has to be installed before part 1.

The path

5 parts, in order

Each part states what it assumes from the previous one, so you can also jump in where your setup already is.

  1. Part 1 of 5 Start here

    Cloud Identity and Least Privilege: Humans, Workloads and CI

    Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.

    Cloud Security beginner 13 min read
  2. Part 2 of 5

    Cloud Network Security Boundaries: Exposure, Tiers and Default Deny

    Deciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.

    Cloud Security beginner 14 min read
  3. Part 3 of 5

    Secrets and Configuration Security: Images, Kubernetes, Vault and Rotation

    The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.

    Cloud Security intermediate 14 min read
  4. Part 4 of 5

    Logging, Audit and Security Visibility: Who Did What, From Where

    Application, infrastructure and audit logs and what each answers; Kubernetes API audit logging enabled on a real cluster, tuned from lease noise to the events that matter, and read for denied and privileged requests.

    Cloud Security intermediate 13 min read
  5. Part 5 of 5

    Production Cloud Hardening: A Checklist That Connects the Controls

    The hardening checklist for a cloud-hosted production workload, built from parts 1 to 4 and the existing edge, container and Kubernetes articles: each control with the command that proves it and the gap it covers.

    Cloud Security intermediate 13 min read

Practise

Labs that exercise this path

All labs →
Lab

Scan Git Repositories with Gitleaks

Seed a repository with realistic fake secrets, catch them with Gitleaks in history and working-tree modes, ignore a confirmed false positive by fingerprint, and block the next one at commit time.

beginner 25 minutes Gitleaks
Lab

Least-Privilege Kubernetes RBAC for a Deployer Service Account

Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.

intermediate 35 minutes Kubernetes
Lab

Secure Docker Images with Trivy

Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.

beginner 30 minutes Trivy · Docker

Toolchain

Tool profiles used in this path

All tools →
protect Secrets management

HashiCorp Vault

Centralised secrets management with dynamic, short-lived credentials.

deploy Infrastructure as code

Terraform

Infrastructure as code with a plan/apply workflow and a large provider ecosystem.

secure IaC scanner

Checkov

Static analysis for infrastructure as code: Terraform, CloudFormation, Kubernetes and Dockerfiles.

deploy Orchestration

Kubernetes

Container orchestration platform and the deployment target for most of the toolchain.

secure Secrets detection

Gitleaks

Detects hard-coded secrets in Git history and working trees.

secure Vulnerability & misconfiguration scanner

Trivy

All-in-one scanner for container images, filesystems, IaC, Kubernetes and SBOMs.

After the last part

Where to go next

One path picks up where this one stops. It is a suggestion, not a requirement.