DevSecOps Practice Hub

Cloud Workload Security

Protect VMs, serverless functions and managed compute with hardening, patching and telemetry.

IntermediateWorkload SecurityCloudInfrastructureOperations

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Deploy Policy enforcement, admission control and infrastructure security.
  • Operate Runtime security, secrets rotation and configuration reconciliation.

Overview

Workload security applies baseline hardening, patch cadence, instance-role scoping and runtime telemetry to whatever compute is actually running.

Why it matters

Long-lived instances drift and accumulate unpatched software and over-broad instance roles.

How it works

  1. 01Golden images are hardened and rebuilt regularly.
  2. 02Instances are replaced rather than patched in place where possible.
  3. 03Instance roles are scoped per workload and audited.

Common tools

OpenSCAPFalcoCloud CustodianAWSAzureLinuxRed Hat

Implementation examples

bashCompliance scan against a benchmark
oscap xccdf eval --profile cis \  --results scan-results.xml \  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
Produces an auditable benchmark result per host.

Best practices

  • Prefer immutable replacement over in-place patching.
  • Scope instance roles per workload.

Common mistakes

  • Sharing one instance profile across unrelated services.