Cloud Security

AWS, Azure, GCP security, shared responsibility model, and cloud-native protection.

Overview

Cloud security protects data, applications, and infrastructure in cloud environments.

Shared Responsibility Model

┌─────────────────────────────────────────┐
│           Customer Responsibility        │
│  ┌─────────────────────────────────┐    │
│  │      Data Security              │    │
│  │      Application Security       │    │
│  │      Operating System           │    │
│  │      Network Configuration      │    │
│  └─────────────────────────────────┘    │
├─────────────────────────────────────────┤
│           Provider Responsibility       │
│  ┌─────────────────────────────────┐    │
│  │      Physical Security          │    │
│  │      Network Infrastructure     │    │
│  │      Hypervisor                 │    │
│  │      Hardware                   │    │
│  └─────────────────────────────────┘    │
└─────────────────────────────────────────┘

AWS Security

IAM Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::bucket/*"
    }
  ]
}

Security Groups

# Allow HTTPS
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0

Azure Security

Network Security Groups

# Create NSG rule
az network nsg rule create \
  --nsg-name myNsg \
  --resource-group myResourceGroup \
  --name AllowHTTPS \
  --priority 100 \
  --destination-port-ranges 443 \
  --protocol Tcp \
  --access Allow

GCP Security

Firewall Rules

# Allow internal traffic
gcloud compute firewall-rules create allow-internal \
  --network default \
  --allow tcp,udp,icmp \
  --source-ranges 10.0.0.0/8

Cloud Security Tools

Best Practices

1. Enable MFA — Multi-factor authentication
2. Encrypt Data — At rest and in transit
3. Least Privilege — Minimum access
4. Logging — Enable cloud logs
5. Backup — Regular data backups

Practice

Configure AWS IAM policies with least privilege access.