Introduction to Cloud Security
Cloud security requires understanding the shared responsibility model. While cloud providers secure the infrastructure, you're responsible for securing your data, applications, and configurations. This guide provides actionable security practices for the three major cloud platforms.
The Shared Responsibility Model
What the Cloud Provider Secures
Physical infrastructure (data centers, hardware)
Network infrastructure
Hypervisor and virtualization layer
Managed service infrastructure
What You Secure
Data classification and encryption
Identity and access management
Network configuration and segmentation
Application security
Operating system patches (for IaaS)
Configuration management
AWS Security Best Practices
Identity and Access Management (IAM)
Critical configurations:
1Enable MFA for all IAM users, especially root
Use hardware MFA for root account
Enforce MFA in IAM policies for sensitive operations
Consider AWS SSO for centralized identity management
2Implement least privilege with IAM policies
Start with AWS managed policies, then customize
Use IAM Access Analyzer to identify unused permissions
Review permissions quarterly
Example restrictive S3 policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-bucket/user-data/${aws:username}/*",
"Condition": {
"Bool": {"aws:MultiFactorAuthPresent": "true"}
}
}
]
}3Use IAM roles instead of access keys
EC2 instance profiles for application access
Cross-account roles for multi-account access
Service-linked roles for AWS service access
4Regularly rotate credentials
Automate access key rotation (90 days maximum)
Use AWS Secrets Manager for application secrets
Audit key age with AWS Config rules
Network Security
VPC architecture best practices:
1Design with security zones
Public subnets: Load balancers, NAT gateways only
Private subnets: Application and database tiers
Isolated subnets: Sensitive workloads with no internet access
2Security Groups configuration
Default deny all inbound traffic
Allow only required ports from specific sources
Use security group references instead of IP ranges where possible
Document the purpose of each rule
Example web application security groups:
ALB Security Group: Allow 443 from 0.0.0.0/0
Web Server SG: Allow 443 from ALB SG only
App Server SG: Allow 8080 from Web Server SG only
Database SG: Allow 3306 from App Server SG only
3Enable VPC Flow Logs
Log to CloudWatch Logs or S3
Analyze with Amazon Athena for investigations
Set up alerts for rejected traffic patterns
4Use AWS WAF for web applications
Enable AWS Managed Rules for common threats
Create custom rules for application-specific patterns
Implement rate limiting to prevent DDoS
Data Protection
S3 security checklist:
Block public access at account level
Enable default encryption (SSE-S3 or SSE-KMS)
Enable versioning for data protection
Configure lifecycle policies for data retention
Enable access logging to separate bucket
Use S3 Object Lock for compliance data
KMS best practices:
Use customer managed keys (CMK) for sensitive data
Enable automatic key rotation
Define key policies with least privilege
Use key aliases for key identification
Monitor key usage with CloudTrail
Logging and Monitoring
Essential AWS security logging:
1CloudTrail - API activity logging (enable in all regions)
2VPC Flow Logs - Network traffic logging
3S3 Access Logs - Object-level access logging
4CloudWatch Logs - Application and system logs
5AWS Config - Resource configuration history
Security monitoring setup:
Enable GuardDuty for threat detection
Configure Security Hub for centralized findings
Set up EventBridge rules for security events
Create CloudWatch alarms for suspicious activity
Azure Security Best Practices
Azure Active Directory
Critical configurations:
1Enable Security Defaults or Conditional Access
Require MFA for all users
Block legacy authentication protocols
Require compliant devices for sensitive apps
2Implement Privileged Identity Management (PIM)
Just-in-time access for admin roles
Require approval for critical roles
Set maximum activation duration
Require MFA for activation
3Configure Identity Protection
Enable risk-based Conditional Access
Block or require MFA for risky sign-ins
Require password change for compromised users
Example Conditional Access policy:
Grant access only if:
User has completed MFA
Device is marked compliant
Sign-in risk is low or medium
User is not accessing from blocked location
Network Security
Azure network architecture:
1Virtual Network design
Hub-and-spoke topology for large deployments
Dedicated subnets for each tier
Network Security Groups on every subnet
2Azure Firewall deployment
Centralize outbound traffic filtering
Create application rules for allowed destinations
Enable threat intelligence filtering
Log all traffic for analysis
3Private Endpoints
Use Private Link for PaaS services
Disable public access where possible
DNS configuration for private resolution
4DDoS Protection
Enable DDoS Protection Standard for production
Configure alerts for attack detection
Review mitigation reports after attacks
Data Security
Storage account security:
Require secure transfer (HTTPS only)
Enable infrastructure encryption
Use private endpoints for access
Disable blob public access
Enable soft delete and versioning
Configure immutable storage for compliance
Key Vault best practices:
Use separate Key Vaults per application/environment
Enable soft delete and purge protection
Configure access policies with least privilege
Enable logging to Log Analytics
Use managed identities for application access
Azure Defender (Microsoft Defender for Cloud)
Enable Defender plans for:
Servers (vulnerability assessment, file integrity)
Storage (malware scanning, anomaly detection)
SQL (vulnerability assessment, threat detection)
Kubernetes (runtime protection, image scanning)
App Service (vulnerability detection)
GCP Security Best Practices
IAM and Organization
Organization structure:
1Use organization policies
Restrict resource locations
Disable public IP addresses on VMs
Require OS Login for SSH access
Disable service account key creation
2Implement service accounts properly
Use Workload Identity for GKE
Avoid user-managed service account keys
Grant minimal permissions per service account
Use short-lived credentials where possible
3Enable Cloud Identity
Centralize identity management
Enforce security settings organization-wide
Configure 2-Step Verification enforcement
IAM best practices:
Use groups for permission assignment
Implement custom roles for least privilege
Review IAM recommendations in Security Command Center
Audit permissions with Policy Analyzer
Network Security
VPC architecture:
1Shared VPC for multi-project deployments
Centralize network management
Consistent security policies across projects
Simplified firewall rule management
2Firewall rules hierarchy
Organization-level policies for baseline rules
Folder-level policies for business unit rules
Project-level rules for application-specific access
3Private Google Access
Enable for all subnets
Access Google APIs without public IPs
Use Private Service Connect for enhanced privacy
4Cloud Armor for web security
Configure WAF rules
Enable adaptive protection
Implement rate limiting
Use preconfigured rules for OWASP Top 10
Data Security
Cloud Storage security:
Enable uniform bucket-level access
Configure retention policies
Enable object versioning
Use Customer-Managed Encryption Keys (CMEK)
Configure VPC Service Controls for sensitive data
Secret Manager:
Store all secrets in Secret Manager
Use IAM for access control
Enable automatic rotation
Audit access with Cloud Audit Logs
Security Command Center
Enable premium features:
Security Health Analytics for misconfigurations
Event Threat Detection for runtime threats
Container Threat Detection for GKE
Web Security Scanner for applications
Cross-Cloud Security Principles
1. Automate Security Controls
Infrastructure as Code security:
Scan IaC templates before deployment (Checkov, tfsec)
Use policy-as-code for guardrails (OPA, Sentinel)
Implement automated remediation for drift
2. Implement Cloud Security Posture Management (CSPM)
CSPM capabilities needed:
Continuous misconfiguration detection
Compliance mapping (CIS, SOC 2, PCI DSS)
Multi-cloud visibility
Automated remediation
3. Centralize Security Operations
Security operations requirements:
Aggregate logs from all cloud providers
Correlate events across platforms
Standardize alerting and response
Maintain unified threat intelligence
4. Regular Security Assessments
Assessment cadence:
Weekly: Automated vulnerability scans
Monthly: Configuration compliance review
Quarterly: Penetration testing
Annually: Third-party security audit
Cloud Security Maturity Assessment
Level 1: Basic
IAM with MFA enabled
Basic network segmentation
Logging enabled
Manual security reviews
Level 2: Developing
Conditional access policies
Infrastructure as Code
CSPM tool deployed
Basic automation
Level 3: Defined
Zero Trust principles applied
Policy-as-code implemented
Security integrated in CI/CD
Regular penetration testing
Level 4: Managed
Full CSPM coverage
Automated remediation
Threat detection and response
Continuous compliance monitoring
Level 5: Optimized
AI/ML-driven security
Predictive threat analysis
Full DevSecOps integration
Continuous improvement process
Conclusion
Cloud security is an ongoing process requiring continuous attention and improvement. Start with the fundamentals—identity, network, data protection—and build maturity over time.
The most critical factor is understanding your shared responsibility and ensuring no gaps exist between what the cloud provider secures and what you must secure.
Asfaleia-Tech provides cloud security assessments and architecture reviews across AWS, Azure, and GCP. Contact us to evaluate your cloud security posture.