Cloud Infrastructure
Security & Compliance
IAM & Identity Security
Least privilege, privilege escalation paths, cross-account access, federation
IAM Policy Analyser
Check your IAM configuration against least-privilege best practices across AWS, Azure, GCP.
Privilege Escalation Paths
Select your current IAM permissions and find potential escalation paths to admin.
IAM Best Practices
Least privilege, MFA enforcement, role-based access, JIT access, service account hygiene.
AWS Security
Amazon Web Services security services, misconfigurations, attack techniques, and detections
AWS Misconfiguration Checker
Select your AWS services and get a targeted misconfiguration checklist.
AWS Attack Techniques
IAM abuse, SSRF→IMDS, S3 exfil, Lambda backdoor, CloudTrail evasion.
AWS Security Services
GuardDuty, Security Hub, Inspector, Macie, Config, CloudTrail — full reference.
Azure Security
Microsoft Azure security services, Entra ID, Defender for Cloud, Sentinel KQL detections
Azure Security Services
Defender for Cloud, Sentinel, Entra ID, Key Vault, DDoS Protection — full reference.
Sentinel KQL Detections
Ready-to-use KQL queries for IAM abuse, impossible travel, privilege escalation, data exfil.
Azure Misconfiguration Checker
Select Azure services and get targeted hardening checklist.
GCP Security
Google Cloud Platform security services, IAM, VPC Service Controls, Chronicle SIEM
GCP Security Services
Security Command Center, Chronicle, Cloud Armor, Secret Manager, VPC Service Controls.
GCP IAM & Attack Paths
Service account abuse, workload identity, org policy bypass, privilege escalation.
Posture & Compliance
CSPM, CWPP, shared responsibility model, logging strategy, CIS benchmarks
Shared Responsibility Model
IaaS vs PaaS vs SaaS — what you own vs what the provider owns across AWS, Azure, GCP.
CSPM & CWPP Reference
Wiz, Prisma Cloud, Orca, Defender for Cloud — capabilities comparison.
Cloud Logging Strategy
Essential logs per platform, retention, SIEM ingestion, cost optimisation.
CIS Benchmark Checker
Select your cloud platform and get the top CIS benchmark controls to verify.
India Cloud Data Localisation
RBI, SEBI, DPDP, IRDAI, MeitY requirements — interactive compliance checker, regulator tabs, and gap assessment tool.
RBI Cloud Guidelines
Practical checklist for banks & NBFCs — data residency, IAM, network security, DR, audit logging, and vendor risk controls mapped to RBI circulars.
Shared Responsibility Matrix
Interactive IaaS/PaaS/SaaS × AWS/Azure/GCP matrix — who owns what, customer responsibility drill-down, and common misconceptions.
Terraform / IaC Security
Top misconfigurations with secure HCL patterns, tfsec & Checkov rule IDs, CI/CD security gate pipeline, and interactive scanner simulation.
Native Detection Reference
GuardDuty, Defender for Cloud, GCP SCC — finding types, MITRE ATT&CK mapping, KQL queries, IOCs, and response playbooks in one reference.
// SELECT CLOUD PLATFORM
// IAM UNIVERSAL PRINCIPLES
Least Privilege
Grant only permissions required for the task. Review quarterly.
✓ Use IAM Access Analyzer / Entra ID Access Reviews
No Long-Term Keys
Avoid static access keys. Use roles, instance profiles, workload identity.
⚠ Keys in code = breach waiting to happen
MFA Everywhere
Enforce MFA for all human identities. Hardware keys for privileged accounts.
✓ Conditional Access / SCPs to enforce
Just-in-Time Access
Temporary elevated access with approval. Azure PIM, AWS IAM Identity Center.
✓ Reduces standing privilege exposure
// SELECT STARTING PERMISSIONS
// AWS IAM BEST PRACTICES
Use IAM Roles
Assign roles to EC2, Lambda, ECS — never embed access keys in code or AMIs.
aws sts get-caller-identity # verify current roleEnable MFA Delete on S3
Prevent accidental or malicious deletion of versioned S3 objects.
aws s3api put-bucket-versioning --mfa-delete EnabledSCPs for Guardrails
Use Service Control Policies at org level to deny dangerous actions globally.
Deny: s3:DeleteBucket, iam:CreateUser, cloudtrail:StopLoggingIAM Access Analyzer
Continuously finds resources shared externally — S3, KMS, Lambda, roles, queues.
aws accessanalyzer list-findings --analyzer-arn ARN// AZURE ENTRA ID BEST PRACTICES
Conditional Access
Require MFA, compliant device, named location for all privileged access.
PIM for Privileged Roles
No standing Global Admin. Activate via PIM with justification + approval.
Managed Identities
Use system/user-assigned managed identities for Azure workloads — no secrets.
Access Reviews
Quarterly review of group memberships and app role assignments.
// GCP IAM BEST PRACTICES
Workload Identity Federation
Keyless auth for GKE, Cloud Run, GitHub Actions — eliminates service account keys.
Org Policy Constraints
Enforce constraints: disable SA key creation, restrict resource locations, require OS Login.
VPC Service Controls
Create perimeter around sensitive APIs to prevent data exfiltration even with valid creds.
Audit Log Retention
Enable Data Access audit logs for BigQuery, GCS, CloudSQL. Export to Chronicle/SIEM.
// SELECT AWS SERVICES IN USE
// AWS ATTACK TECHNIQUES
SSRF → IMDSv1
SSRF vulnerability in EC2-hosted app → query metadata service → steal IAM role credentials.
http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE⚠ Fix: Enforce IMDSv2 (require session token)
S3 Bucket Enumeration
Find misconfigured public buckets, list contents, download sensitive data.
aws s3 ls s3://target-bucket --no-sign-request
aws s3 sync s3://target-bucket . --no-sign-requestIAM Privilege Escalation
iam:PassRole + lambda:CreateFunction = admin. 20+ escalation paths documented.
aws iam list-attached-user-policies --user-name TARGET
aws iam simulate-principal-policy ...CloudTrail Evasion
Delete trails, disable logging, use services not covered by CloudTrail.
aws cloudtrail delete-trail --name TARGET
# Detect: CloudWatch alarm on StopLogging APILambda Backdoor
Modify Lambda function code to exfiltrate data or maintain persistence.
aws lambda update-function-code --function-name TARGET --zip-file fileb://backdoor.zipCross-Account Pivot
Assume role in another account via misconfigured trust policy.
aws sts assume-role --role-arn arn:aws:iam::TARGET_ACCT:role/ROLE --role-session-name pivot// AWS SECURITY SERVICES DEEP DIVE
// AZURE SECURITY SERVICES
Defender for Cloud
CSPM + CWPP. Secure Score, regulatory compliance, workload protections for VMs, containers, DBs, storage.
✓ Covers Azure, AWS, GCP in multi-cloud mode
Microsoft Sentinel
Cloud-native SIEM/SOAR. 200+ data connectors, built-in UEBA, automation rules, Jupyter notebooks.
✓ Native integration with Defender XDR
Entra ID Protection
Risk-based Conditional Access. Detects leaked credentials, impossible travel, anonymous IP, malware-linked IPs.
Defender for Identity
On-prem AD monitoring — detects lateral movement, pass-the-hash, DCSync, golden ticket attacks.
Defender for Endpoint
EDR for Windows/Linux/macOS. Integrates with Sentinel for XDR correlation.
Azure Policy
Enforce compliance at scale — deny non-compliant resources, audit existing configs, auto-remediate.
// KQL — IMPOSSIBLE TRAVEL
// KQL — PRIVILEGED ROLE ASSIGNMENT
// KQL — MASS DOWNLOAD FROM SHAREPOINT
// KQL — AZURE VM CRYPTO MINING
// SELECT AZURE SERVICES IN USE
// GCP SECURITY SERVICES
Security Command Center
Asset inventory, vulnerability findings (CVEs, misconfigs), threat detection, compliance dashboards.
✓ Premium tier includes Event Threat Detection
Chronicle SIEM
Petabyte-scale security analytics. YARA-L detection rules. Ingests logs from GCP, AWS, on-prem.
Cloud Armor
DDoS protection + WAF. Adaptive Protection uses ML to detect and block L7 attacks automatically.
VPC Service Controls
API-level perimeter — prevents data exfiltration even with valid credentials. Covers BigQuery, GCS, etc.
Binary Authorization
Policy enforcement for container images — only signed, approved images can deploy to GKE.
Cloud IDS
Network-based IDS powered by Palo Alto Networks threat signatures. Deployed as managed service.
// GCP IAM ATTACK PATHS
Service Account Key Theft
Leaked JSON key file → full service account access. Keys don't expire by default.
gcloud auth activate-service-account --key-file=stolen.json
gcloud projects list # enumerate access⚠ Fix: Use Workload Identity, disable key creation via Org Policy
Privilege Escalation via IAM
iam.serviceAccounts.actAs + compute.instances.create = project owner escalation.
gcloud compute instances create pwned --service-account=SA_EMAIL --scopes=cloud-platformMetadata Server Abuse
SSRF → GCP metadata server → service account token.
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
Header: Metadata-Flavor: GoogleOrg Policy Bypass
If you have resourcemanager.organizations.setIamPolicy, you can remove org policy constraints.
⚠ Monitor: AuditLog — SetOrgPolicy calls from non-admin accounts
// SHARED RESPONSIBILITY BY SERVICE MODEL
| Responsibility | IaaS (EC2/VM) | PaaS (RDS/App Svc) | SaaS (O365/Workspace) |
|---|---|---|---|
| Physical / DC | Provider | Provider | Provider |
| Hypervisor / Network | Provider | Provider | Provider |
| OS Patching | Customer | Provider | Provider |
| Runtime / Middleware | Customer | Provider | Provider |
| Application Code | Customer | Customer | Provider |
| Data Classification | Customer | Customer | Customer |
| IAM / Access Control | Customer | Customer | Customer |
| Network Config (SGs) | Customer | Customer | Provider |
// CSPM TOOL COMPARISON
| Tool | Multi-Cloud | CWPP | Best For |
|---|---|---|---|
| Wiz | AWS+Azure+GCP | Yes | Agentless, attack path analysis, graph-based |
| Prisma Cloud | AWS+Azure+GCP | Yes | Enterprise, code-to-cloud, compliance |
| Orca Security | AWS+Azure+GCP | Yes | Agentless, SideScanning technology |
| Defender for Cloud | AWS+Azure+GCP | Yes | Azure-native, free tier available |
| AWS Security Hub | AWS Only | No | AWS-native, aggregates GuardDuty/Inspector |
| GCP SCC | GCP Only | Partial | GCP-native, free standard tier |
// CWPP CAPABILITIES
Vulnerability Scanning
Scan VM images, container images, serverless functions for CVEs before and after deployment.
Runtime Protection
Detect and block malicious activity at runtime — process injection, crypto mining, reverse shells.
Container Security
Image scanning in CI/CD, admission control (OPA/Gatekeeper), runtime behavioural monitoring.
Serverless Security
Lambda/Cloud Function scanning — overprivileged roles, vulnerable dependencies, code injection.
// ESSENTIAL LOGS BY PLATFORM
| Log Type | AWS | Azure | GCP |
|---|---|---|---|
| API / Control Plane | CloudTrail | Activity Log | Cloud Audit Logs (Admin) |
| Data Access | S3 Access Logs, CloudTrail Data | Storage Diagnostics | Cloud Audit Logs (Data Access) |
| Network Flow | VPC Flow Logs | NSG Flow Logs | VPC Flow Logs |
| DNS | Route 53 Resolver Logs | Azure DNS Diagnostics | Cloud DNS Logs |
| Identity | IAM / CloudTrail | Entra Sign-in Logs | Cloud Audit Logs |
| Threat Detection | GuardDuty Findings | Defender Alerts | SCC Findings |
// LOGGING BEST PRACTICES
Never Disable CloudTrail
Use SCP/Org Policy to prevent StopLogging. Alert on any attempt.
⚠ Attackers disable logging as first step
Centralise to SIEM
Export all logs to Sentinel/Splunk/Chronicle. Don't rely on native consoles for detection.
Retention Policy
Minimum 90 days hot, 1 year cold. Regulatory: RBI requires 2 years for BFSI.
Cost Optimisation
Filter noisy S3 data access logs. Use log sampling for high-volume sources. Archive to S3/GCS.