Cloud security basics.
Most companies now run on AWS, Microsoft Azure or Google Cloud. Cloud skills are among the best-paid in security. Today you'll learn how the cloud works, who is responsible for what, and the mistakes that cause the biggest leaks.
What "the cloud" really means
The cloud is simply someone else's computers that you rent over the internet. Instead of buying servers and keeping them in an office room, a company rents computing power from Amazon (AWS), Microsoft (Azure) or Google (GCP), and pays for what it uses. Many of these companies have large offices and data centres in and around Hyderabad.
| Model | You rent | House example | Examples |
|---|---|---|---|
| IaaS | Raw servers, storage, networks | Renting an empty flat: you furnish and maintain it | AWS EC2, Azure VMs |
| PaaS | A platform to run your code | A furnished flat: you just move in your things | Azure App Service, Google App Engine |
| SaaS | Ready software | A hotel room: everything is managed | Gmail, Microsoft 365, Zoom |
The shared responsibility model
The most important cloud security idea: security is shared. The cloud provider secures the cloud itself (buildings, hardware, their network). You secure what you put in the cloud (your data, accounts, settings).
Amazon guarantees the bank locker room is safe. If you leave your own locker open, that's on you. Most cloud breaches are customer mistakes, not the provider being hacked.
A company stores customer Aadhaar copies in cloud storage and accidentally makes the folder public. Who is responsible?
Settings and data are the customer's responsibility in the shared responsibility model.
IAM: who can do what
IAM (Identity and Access Management) controls who can access what in the cloud. Good IAM follows the rules you already know:
- Least privilege: give each person and app only the permissions they need.
- MFA for every human login, especially the all-powerful root/owner account, which should almost never be used.
- No secret keys in code: developers sometimes paste cloud access keys into code and push it to public GitHub. Bots scan GitHub constantly and abuse such keys within minutes.
- Review permissions regularly and remove old accounts.
The top cloud mistakes
- Public storage buckets (AWS S3, Azure Blob) holding private files.
- Leaked access keys in code, screenshots or chats.
- Over-permissive IAM: everyone is "admin" because it's easier.
- Open management ports (SSH 22, RDP 3389) to the whole internet.
- No logging: cloud logs (like AWS CloudTrail) switched off, so nobody can investigate.
AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG..." committed in config.py "just for testing".nowNot good. Emergency. Public keys get found by bots within minutes. Revoke (deactivate) the key immediately, create a new one, check the cloud logs for misuse, and store secrets in a secrets manager instead.
Good. Individual accounts, MFA, and a protected root account are textbook best practice.
Career note
Cloud security roles (Cloud Security Engineer, Cloud SOC Analyst) are in high demand. Good starting points: free fundamentals courses from AWS (Cloud Practitioner), Microsoft (AZ-900 / SC-900) and Google. These entry certifications are affordable and well recognised.
Which is the BEST practice for the cloud "root" or owner account?
The root account can do anything. Lock it down and use individual, least-privilege accounts daily.
Your task (20 min)
Go to Microsoft Learn (learn.microsoft.com) and look at the free learning path for SC-900: Security, Compliance and Identity Fundamentals, or AWS Skill Builder's free Cloud Practitioner Essentials. Read the first module. Note one new idea and post it in Shia Circle under c/Career to explain it to others: teaching is the best way to learn.
Lesson 15 complete!
You understand IaaS, PaaS and SaaS, the shared responsibility model, IAM and the top cloud mistakes. Next: scanning with Nmap, plus the Module 4 test.
Next: Scanning with Nmap →