Cloud Security Intro

Created: 15.05.2023

Storage

Compute

VM

AWS EC2 and GCP Cloud Compute.

Containers

Logs

API logs

AWS Cloudtrail, GCP Cloud Audit Logs. These logs usually go to dedicated storage (S3 for AWS or Cloud Storage for GCP). AWS logs are in json, GCP in protocol buffer format. GCP also streams the logs to Stackdriver Logging, while AWS - to Cloudwatch.

Monitoring

AWS Cloudwatch

Firewall

AWS and GCP: VPC flow logs

Threat Detection

AWS GuardDuty

Config Changes

AWS Config, GCP Cloud Asset Inventory.

You can track configurations of various resources here, compute instances, storage, roles, lambda functions etc.

In AWS, go to AWS Config -> Resources -> Choose the resource of interest (you may want to filter by type) -> Resource Timeline. This feature can be turned on and off for a resource, and the retention period can also be adjusted.

Encryption

At-rest

In-transit

Security

IAM

Firewall

AWS Security Groups, GCP

References

Expand… Something here