Cloud Security & AWS Concepts

Introduction to Cloud Security Paradigms

  • Cloud security represents a fundamental operational shift, moving application hosting, storage, networking, and compute workloads from local internal networks to remote third-party cloud providers.

  • Traditional Security Model (Perimeter Defense):

    • Focused heavily on securing a single network boundary using edge firewalls and intrusion prevention systems.

    • Operates on an implicit trust model: traffic inside the internal network perimeter is largely trusted, while external traffic is untrusted.

  • Modern Cloud Security Model:

    • Physical and network perimeters no longer exist, as cloud endpoints are globally accessible over the public internet.

    • Relies on identity-centric security, enforcing fine-grained authorization policies for every individual user and automated workload interaction regardless of network origin.

Cloud Service & Delivery Models

  • Cloud services are organized into three primary abstraction models, each defining a distinct allocation of operational responsibility between the customer and the provider:

    • Infrastructure as a Service (IaaS):

    • Provides bare compute resources, physical infrastructure, storage arrays, and virtual networking components.

    • Examples: Amazon EC2 (Elastic Compute Cloud), Virtual Private Servers (VPS).

    • Responsibilities: The cloud provider manages physical hardware, host virtualization, and physical network infrastructure. The customer is responsible for operating system installation, configuration, network rules, application security, and data protection.

    • Platform as a Service (PaaS):

    • Provides an execution environment where users supply application source code without managing underlying operating systems or virtual hardware.

    • Customer Responsibility: Focused primarily on code deployment, database scheme design, and application logic.

    • Software as a Service (SaaS):

    • Fully managed software applications accessed directly via web browsers or client APIs.

    • Examples: Google Docs, Google Sheets, Microsoft 365, enterprise webmail clients.

    • Customer Responsibility: Focused on end-user access management and user data policies.

  • Responsibility Gradient: Moving from SaaS to PaaS to IaaS progressively increases the configuration responsibility, security burden, and administrative control placed on the renting customer.

Cloud Administrative Plane Architecture

  • Control Plane Definition:

    • The umbrella term for the administrative interfaces and management tools used by system administrators to configure, manage, and provision cloud resources.

    • Includes administrative web management consoles, Command Line Interfaces (CLIs), Software Development Kits (SDKs), and direct backend administrative APIs.

  • Architectural Division:

    • Control Plane: Processes administrative commands, modifies service policies, provisions infrastructure, and manages authorization state.

    • Data Plane: Handles actual workload traffic, application execution, storage I/O, and data payload processing.

  • Control Plane Security Implications:

    • Because control plane endpoints are globally reachable via API calls, compromised administrative credentials or insecure control plane access allows complete infrastructure takeover.

Identity and Access Management (IAM)

  • Core Definition: IAM is the central governance framework in cloud environments responsible for evaluating authentication ("Who are you?") and authorization ("What actions are you explicitly permitted to perform?").

  • Non-Human Identities:

    • IAM applies equally to human users, system administrators, external software services, and non-human workload instances (e.g., virtual server instances executing background code).

  • Key IAM Constructs:

    • Identities: Entities capable of requesting actions against cloud resources.

    • Roles: Identity structures assigned to users or non-human workloads that grant temporary, specific sets of permission policies.

    • Policies: JSON-formatted policy documents defining explicit permissions (actions, resources, conditions, and effects).

  • Principle of Least Privilege:

    • The security practice of granting an identity or service strictly the minimum permissions required to execute its designated function.

    • Enforcing least privilege minimizes the "blast radius"—the maximum potential damage or scope of lateral movement achievable if a resource or account is compromised.

Practical AWS Demonstration: Storage and Least Privilege IAM Configuration

  • Amazon S3 (Simple Storage Service):

    • Scalable object storage service organized into logical containers called "buckets" used for shared file storage across infrastructure services.

  • Step 1: Bucket Creation and Data Ingestion

    • S3 Bucket Created: 726 demo bucket final (also referenced as 726demo bucket final).

    • Stored Target File: test file for bucket.txt.

  • Step 2: Policy and Role Creation

    • IAM Policy Created: Named read one file.

    • Policy Configuration:

    • Service Target: Amazon S3 (s3).

    • Action Permission: s3:GetObject (read permissions for S3 objects).

    • Resource Target: Restricted specifically to arn:aws:s3:::726 demo bucket final/test file for bucket.txt.

    • Action Scope: Implicitly denies all other actions (e.g., writing files, deleting objects, listing directory contents).

    • IAM Role Created: Named 726 demo role final.

    • Target Service Trust: AWS EC2 (ec2.amazonaws.com).

    • Attached Policy: read one file.

  • Step 3: Assigning Workload Identity and Verifying Privilege Scope

    • Role Attachment: Assigned 726 demo role final to an active AWS EC2 virtual server instance via its Security properties interface.

    • Access Verification (Read Operation):

    • Executing a read operation (cat command via AWS S3 CLI) on test file for bucket.txt successfully reads and outputs the file text to the terminal.

    • Access Restriction (Directory Listing Operation):

    • Executing a bucket listing command (ls command via AWS S3 CLI) fails with permission errors because s3:ListBucket was explicitly excluded from the role's policy.

  • Step 4: Policy Modification and Permission Boundaries

    • Policy Amendment:

    • Added permission s3:ListBucket bounded to the resource 726 demo bucket final inside the read one file policy.

    • Permission Verification:

    • Executing the directory listing command (ls) now successfully lists the contents inside 726 demo bucket final.

    • Enforcing Object-Level Granularity:

    • A secondary test file was uploaded to 726 demo bucket final.

    • Running directory listing (ls) successfully shows the new secondary file.

    • Attempting to read the contents of the secondary file returns an HTTP 403 Forbidden error, confirming that read access remains strictly confined to test file for bucket.txt.

Event Monitoring, Alerting, and Forensic Audit Logging

  • Automated Monitoring Imperative:

    • Cloud environments require continuous automated event processing to detect anomalous state changes and alert administrators to policy tampering or suspicious activities.

  • Amazon Simple Notification Service (SNS):

    • A pub/sub messaging and notification service used to fan out notifications to endpoints such as email, SMS, or webhooks.

    • Topic Created: 726 policy change.

    • Subscription: Administrative email address subscribed to receive instant alerts.

  • Amazon EventBridge:

    • A serverless event bus service that routes operational events from cloud services to designated targets based on rules.

    • Rule Created: Named 726 rule final.

    • Custom Event Pattern: Matches S3 policy modification operations, specifically listening for put bucket policy events.

    • Target Action: Configured to trigger the 726 policy change SNS topic, instantly issuing an alert email to the administrator whenever an S3 bucket policy change event is detected.

  • AWS CloudTrail (Forensic Logging):

    • An audit logging service that captures a complete historical record of API calls, console actions, and system events within an AWS account.

    • Event Metadata: Captures detailed audit records including API caller identity, request timestamp, source IP address, parameters, and response elements.

    • Utility: Crucial for security investigations, breach forensics, compliance verification, and reconstructing compromise sequences.

Core Architectural Principles and Real-World Security Incidents

  • Blast Radius Control:

    • Binding constrained IAM policies to workloads ensures that if an EC2 instance is compromised via an application-level vulnerability, attackers cannot move laterally, create new administrative users, or access adjacent unauthorized buckets.

  • Root Account Protection and MFA:

    • Root accounts hold absolute permission over all resources within a cloud tenant account.

    • Multi-Factor Authentication (MFA) enforcement (such as hardware passkeys) is strictly mandatory on root accounts to prevent catastrophic account takeover.

  • Zero Trust Architecture:

    • Core Philosophy: "Never trust, always verify."

    • Rejects the concept of an internal trusted network zone.

    • Requires explicit identity verification, least privilege access enforcement, persistent state re-evaluation, and complete event logging for every interaction across the network.

    • Network segmentation serves as a secondary fallback barrier rather than the primary perimeter boundary.

  • Real-World Breach Case Study: Capital One Data Breach

    • Breach Vector: An attacker exploited a Server-Side Request Forgery (SSRF) vulnerability in a misconfigured, public-facing EC2 instance running a Web Application Firewall (WAF).

    • Failure Cause: The IAM role assigned to the EC2 instance possessed excessive, over-privileged permissions, allowing the instance to list and read all S3 storage buckets across the entire cloud deployment.

    • Consequence: Exfiltration of tens of millions of sensitive customer credit applications and financial records.

    • Mitigation Principle: Strict application of least privilege policies on workload identities prevents data exfiltration even if the hosting application is fully compromised.

Questions & Discussion

  • Question: Is there a third plane in cloud terminology besides the Control Plane and Data Plane?

    • Answer: In cloud architecture, the primary distinction is between the Control Plane (management, configuration APIs) and the Data Plane (payload, network traffic, storage I/O). In specific network architecture contexts, a Management Plane is sometimes distinguished, but control and data planes represent the primary cloud operational divisions.

  • Question: Does university Infosys / business school coursework cover cloud management and AWS certifications?

    • Answer: Information Systems modules cover cloud computing management, IAM concepts, and structured lecture materials aligned with industry cloud certification exams.

  • Question: How do student presentation teams coordinate contact information?

    • Answer: Teams utilize designated Canvas Presentation Team groups to access member rosters and coordinate group communication.

Course Assessment and Exam Framework

  • Historical Exam Resources:

    • Prior exam archives for course codes 0725 / 0726 are available via the library repository to provide structural benchmarks.

  • Three-Tiered Assessment Hierarchy:

    • Level 1 (Closed-ended Knowledge Checks):

    • Multiple-choice or direct identification questions testing foundational security concepts, specific definitions, and core architectural terms.

    • Level 2 (Single-Concept Application Scenarios):

    • Scenario-based questions requiring the application of a single security concept (e.g., configuring an IAM policy or selecting a monitoring tool) to resolve a target operational problem.

    • Level 3 (Multi-Concept Synthesis & System Design):

    • Complex, open-ended scenario questions requiring the synthesis of multiple security principles (e.g., combining zero trust, network segmentation, and log auditing) to design comprehensive defense architectures in novel context settings.

  • Recurring High-Priority Course Themes:

    • Chain of Trust models.

    • Network Segmentation strategies.

    • Zero Trust Network Architectures.

    • Principle of Least Privilege and IAM policy design.

    • Cloud continuous event monitoring and forensic log auditing.