TL;DR
Learn essential security practices and tools to protect your cloud infrastructure and applications.
Cloud Security Best Practices: Protecting Your Infrastructure
Security is paramount in cloud computing. This comprehensive guide covers essential practices and tools for securing your cloud infrastructure.
$1
$1
`` {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::my-bucket/*"
],
"Condition": {
"IpAddress": {
"aws:SourceIp": ["192.0.2.0/24"]
}
}
}
]
}
json
`
$1
` apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: production
name: pod-manager
rules:
resources: ["pods"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: pod-manager-binding
namespace: production
subjects:
name: developer
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-manager
apiGroup: rbac.authorization.k8s.io
yaml
`Kubernetes RBAC
$1
$1
` resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
enable_dns_hostnames = true
enable_dns_support = true tags = {
Name = "main"
Environment = "production"
}
} resource "aws_subnet" "private" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.1.0/24"
availability_zone = "us-west-2a" tags = {
Name = "Private Subnet"
}
} resource "aws_network_acl" "main" {
vpc_id = aws_vpc.main.id egress {
protocol = "-1"
rule_no = 100
action = "allow"
cidr_block = "0.0.0.0/0"
from_port = 0
to_port = 0
} ingress {
protocol = "tcp"
rule_no = 100
action = "allow"
cidr_block = "10.0.0.0/16"
from_port = 443
to_port = 443
}
}
hcl
`Terraform VPC configuration
$1
` resource "aws_security_group" "web" {
name = "web"
description = "Web Security Group"
vpc_id = aws_vpc.main.id ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
} egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
hcl
`
$1
$1
` apiVersion: v1
kind: Secret
metadata:
name: app-secrets
type: Opaque
data:
DB_PASSWORD: ${aws-kms-decrypt:AQICAHjJHQhxG7zPvuWfJtLmXXXXXXXXXXXXX}
yaml
`AWS KMS configuration
$1
` server {
listen 443 ssl http2;
server_name example.com; ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;
}
nginx
`NGINX SSL configuration
$1
$1
` {
"agent": {
"metrics_collection_interval": 60,
"run_as_user": "cwagent"
},
"metrics": {
"metrics_collected": {
"cpu": {
"measurement": [
"cpu_usage_idle",
"cpu_usage_user",
"cpu_usage_system"
],
"totalcpu": true
},
"memory": {
"measurement": [
"mem_used_percent"
]
}
}
},
"logs": {
"logs_collected": {
"files": {
"collect_list": [
{
"file_path": "/var/log/application.log",
"log_group_name": "application-logs",
"log_stream_name": "{instance_id}"
}
]
}
}
}
}
yaml
`AWS CloudWatch Agent configuration
$1
` apiVersion: audit.k8s.io/v1
kind: Policy
rules:
resources:
- group: ""
resources: ["pods"]
resources:
- group: ""
resources: ["secrets"]
yaml
`Kubernetes Audit Policy
$1
$1
` {
"ConfigRule": {
"ConfigRuleName": "s3-bucket-public-read-prohibited",
"Description": "Checks that your S3 buckets do not allow public read access",
"Scope": {
"ComplianceResourceTypes": [
"AWS::S3::Bucket"
]
},
"Source": {
"Owner": "AWS",
"SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
}
}
}
json
`
$1
` apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
spec:
privileged: false
seLinux:
rule: RunAsAny
runAsUser:
rule: MustRunAsNonRoot
fsGroup:
rule: RunAsAny
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
- 'persistentVolumeClaim'
yaml
`Pod Security Policy
$1
$1
` FROM alpine:3.14 RUN addgroup -S appgroup && adduser -S appuser -G appgroup WORKDIR /app COPY --chown=appuser:appgroup . . USER appuser ENTRYPOINT ["./entrypoint.sh"]
dockerfile
`Secure Dockerfile
Create non-root user
Set working directory
Copy application files
Use non-root user
Define entrypoint
$1
` name: Security Scan on:
push:
branches: [ main ] jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
yaml
`Trivy scanner configuration
$1
$1
` import boto3
import json def handle_security_event(event, context):
"""Handle security incidents automatically."""
# Parse CloudWatch Event
alert = json.loads(event['Records'][0]['Sns']['Message'])
# Initialize AWS clients
ec2 = boto3.client('ec2')
sns = boto3.client('sns')
# Take action based on alert type
if alert['type'] == 'unauthorized_access':
# Isolate the affected instance
instance_id = alert['instance_id']
ec2.modify_instance_attribute(
InstanceId=instance_id,
Groups=[] # Remove all security groups
)
# Notify security team
sns.publish(
TopicArn='arn:aws:sns:region:account:security-alerts',
Message=f'Instance {instance_id} isolated due to unauthorized access'
)
return {
'statusCode': 200,
'body': json.dumps('Security event handled')
}
python
`
$1
` apiVersion: v1
kind: ConfigMap
metadata:
name: incident-response-plan
data:
steps: |
1. Identification
- Monitor security alerts
- Validate incidents
- Assess severity
2. Containment
- Isolate affected systems
- Block malicious IPs
- Revoke compromised credentials
3. Eradication
- Remove malware
- Patch vulnerabilities
- Update security controls
4. Recovery
- Restore from backups
- Verify system integrity
- Resume operations
5. Lessons Learned
- Document incident
- Update procedures
- Implement improvements
yaml
`Incident Response Playbook
$1
$1
` stages:
- test
- scan
- build
- deploy security_scan:
stage: scan
script:
- trivy image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
- sonarqube-scanner
- owasp-dependency-check
artifacts:
reports:
security: gl-security-report.json dependency_scan:
stage: scan
script:
- safety check
- npm audit
artifacts:
reports:
dependency: gl-dependency-report.json container_scan:
stage: scan
script:
- clair-scanner $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
artifacts:
reports:
container: gl-container-report.json
yaml
`GitLab CI/CD Pipeline
$1
$1
` {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": [
"ec2:RunInstances"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"ec2:InstanceType": [
"t2.micro",
"t2.small"
]
}
}
}
]
}
json
`
$1
` locals {
mandatory_tags = {
Environment = var.environment
Owner = var.team
CostCenter = var.cost_center
Security = var.security_level
}
} resource "aws_instance" "web" {
# ... other configuration ...
tags = merge(
local.mandatory_tags,
{
Name = "WebServer"
Application = "Frontend"
}
)
}
hcl
``
$1
Implementing cloud security requires:
1. Strong IAM policies
2. Network segmentation
3. Data encryption
4. Continuous monitoring
5. Incident response planning
Remember to:
$1
1. [AWS Security Best Practices](https://aws.amazon.com/security/security-learning/)
2. [Kubernetes Security](https://kubernetes.io/docs/concepts/security/)
3. [OWASP Cloud Security](https://owasp.org/www-project-cloud-security/)
4. [DevSecOps Guidelines](https://www.devsecops.org/)
Why This Matters
Understanding the business and technical context helps you make informed decisions rather than blindly following patterns.
Trade-offs to Consider
Every architectural decision involves trade-offs. Consider your specific requirements, team expertise, and scale when evaluating options.
When NOT to Use This
Knowing when a solution doesn't apply is as valuable as knowing when it does. Consider alternatives for your specific situation.
Decision Framework
Use this framework to evaluate whether this approach is right for your use case based on your specific constraints and requirements.