DevSecOps Practice Hub

Cloud Security

Secure cloud accounts, identities, networks and data services across providers.

IntermediateCloud ConfigurationCloudIdentityInfrastructure

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

Cloud security work concentrates on identity boundaries, network exposure, encryption defaults, logging coverage and account structure — most of it configuration rather than code.

Why it matters

Cloud misconfiguration is exploitable from the internet within minutes of being introduced.

How it works

  1. 01Accounts are separated by environment with guardrail policies.
  2. 02Baseline scans evaluate configuration against benchmarks.
  3. 03Logging and detection are enabled in every region, not just the primary one.

Common tools

ProwlerScoutSuiteCheckovCloud CustodianAWSAzureIBM CloudTerraform

Implementation examples

bashBaseline account assessment
prowler aws --severity critical high --output-formats json-ocsf
Provides a benchmark-based baseline. Run against every account, not only production.

Best practices

  • Separate accounts per environment.
  • Enable logging in all regions.
  • Use short-lived federated credentials.

Common mistakes

  • Enabling detection only in the primary region.