Cloud Security Assessment
Cloud assessments center on identity and configuration rather than hosts. Candidates must understand the shared responsibility model, IAM policy evaluation (explicit deny wins; least privilege; trust policies for role assumption), and the risk of overly permissive roles, wildcard actions, and long-lived access keys. Know storage exposure (public buckets, permissive bucket policies, missing encryption), network exposure (security groups open to the internet, public load balancers), and logging gaps (disabled audit trails).
Expect questions on metadata services and credential theft from workloads, and on privilege escalation via role chaining or passing a role to a compute resource. Understand that a public storage object is only a finding if it contains sensitive data or permits write-context matters. Traps include confusing a bucket ACL with a bucket policy, assuming encryption at rest prevents insider access, and treating a permissive policy as exploitable without a principal that can assume it.
Worked example: a role trust policy allows assumption by any principal in the account, and that role has broad permissions. Any compromised identity in the account can assume it, escalating privileges. Remediation is scoping the trust policy to specific principals and conditions and removing wildcard actions. Rule of thumb: in cloud, ask "who can assume or use this identity, and what can it reach?"-the effective permission set, not the nominal configuration, defines the risk.