PATCH//NOTES Open the interactive version
← All lessons
Defence · Intermediate · 4 min

Cloud security

Most cloud breaches are misconfigurations, not clever hacks.

What it is

In the cloud, the provider secures the infrastructure but you secure what you put on it: the shared responsibility model. The biggest risks are storage buckets left public, over-powered access keys, leaked secrets in code, and identities with far more permissions than they need. Because everything is an API, one stolen key can be as bad as a stolen server room.

Real case · 2019

Capital One

A misconfigured web firewall let an attacker use server-side request forgery (SSRF) to grab cloud credentials from AWS's metadata service, then download data on about 100 million customers.

Source: Wikipedia: Server-side request forgery (Capital One)

How defenders stop it

  • Least-privilege IAM roles and no long-lived keys
  • Block public access to storage by default
  • Scan code repositories for leaked secrets
  • Enable cloud audit logs and alerts (CloudTrail, Azure Monitor)

Try it yourself

Play flAWS, an AWS mistakes game

Check yourself

1. Under the shared responsibility model, who secures your S3 bucket permissions?

  1. Amazon
  2. You, the customer
  3. Nobody
  4. Your internet provider
Show answer

You, the customer. The provider secures the platform; configuration is on you.

2. Which is one of the most common causes of cloud data leaks?

  1. Storage buckets left open to the public
  2. Slow internet connections
  3. Cloud providers being hacked
  4. Turning on two-factor authentication
Show answer

Storage buckets left open to the public. Most cloud breaches come from customer misconfiguration, such as public buckets and over-powered keys, not the provider.

3. Why is a leaked cloud access key so dangerous?

  1. Keys expire the moment they leak
  2. Everything in the cloud is an API, so the key can control resources directly
  3. It only affects billing
  4. It only reveals your IP address
Show answer

Everything in the cloud is an API, so the key can control resources directly. With the right key, an attacker can create, read or delete resources from anywhere, as if they owned the account.

Answer them in the app to earn XP.

Next: Passwords, MFA & passkeys →