Cloud Platforms

Core Principles

1. Zero Trust: Never trust, always verify
2. Least Privilege: Minimum necessary permissions
3. Defense in Depth: Multiple layers of security
4. Infrastructure as Code: All infrastructure defined in code
5. Observability: Comprehensive logging, metrics, and tracing

Platform Selection

AWS Quick Reference

IAM Best Practices

# EKS Pod Identity (Recommended over IRSA)
resource "aws_eks_pod_identity_association" "app" {
  cluster_name    = aws_eks_cluster.main.name
  namespace       = "default"
  service_account = "app"
  role_arn        = aws_iam_role.app_pod_identity.arn
}

VPC Pattern

# Private subnets only - Zero Trust
resource "aws_subnet" "private" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.16.${count.index + 1}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = {
    Name = "private-subnet-${count.index + 1}"
    Type = "Private"
  }
}

Essential Services

• EKS: Managed Kubernetes
• Lambda: Serverless compute
• RDS/Aurora: Managed databases
• S3: Object storage
• CloudFront: CDN
• Secrets Manager: Secret storage

Azure Quick Reference

Managed Identity

resource "azurerm_user_assigned_identity" "app" {
  name                = "app-identity"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
}

Essential Services

• AKS: Managed Kubernetes
• Azure Functions: Serverless
• Azure SQL: Managed databases
• Blob Storage: Object storage
• Azure CDN: Content delivery
• Key Vault: Secret management

GCP Quick Reference

Workload Identity

resource "google_service_account" "app" {
  account_id   = "app-sa"
  display_name = "Application Service Account"
}

resource "google_project_iam_member" "app" {
  project = var.project_id
  role    = "roles/storage.objectViewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

Essential Services

• GKE: Managed Kubernetes
• Cloud Functions: Serverless
• Cloud SQL: Managed databases
• Cloud Storage: Object storage
• Cloud CDN: Content delivery
• Secret Manager: Secrets

Cloudflare Quick Reference

Workers

export default {
  async fetch(request, env) {
    const url = new URL(request.url);
    
    if (url.pathname === '/api/data') {
      const data = await env.MY_KV.get('key');
      return new Response(JSON.stringify({ data }), {
        headers: { 'Content-Type': 'application/json' }
      });
    }
    
    return new Response('Hello World');
  }
};

Essential Services

• Workers: Edge compute
• Pages: Static site hosting
• D1: SQLite database
• KV: Key-value storage
• R2: S3-compatible storage

Security Checklist

• IAM roles with least privilege
• Network segmentation (VPCs, security groups)
• Encryption at rest and in transit
• Secret management (not in code)
• Audit logging enabled
• Multi-factor authentication
• Regular security assessments

Detailed References

• AWS: See references/aws.md for EKS, IAM, networking
• Azure: See references/azure.md for AKS, identity
• GCP: See references/gcp.md for GKE, IAM
• Cloudflare: See references/cloudflare.md for Workers, Pages
• Identity protocols: See ../security-testing/references/identity-access.md for OIDC/PKCE and SAML/ADFS validation