Security, Identity, and Compliance
Identity is the control plane
Most cloud breaches are authorization mistakes, not cryptography failures. Grant to groups, not individuals; bind roles to workloads through service identities rather than long-lived keys; scope permissions to specific resources; and use short-lived federated credentials. Separate duties so the person who writes infrastructure cannot also approve production access, and keep a break-glass path that is monitored and rotated.
Data protection and boundaries
Encrypt in transit and at rest, and manage keys separately from the data they protect. Rotation matters: know who can decrypt and how revocation works. Store secrets in a managed secret store with audit logging, never in source control, container images, or IaC variable files. Segment networks so that trust is explicit, restrict egress, and prefer private endpoints over public ones.
Compliance is not inherited wholesale
Under the shared responsibility model, a provider's certification covers the provider's service, not your configuration. Data residency, retention, subject-access requests, and audit-log immutability are your obligations. Know which data is regulated before designing storage location.
Traps candidates fall for
- Confusing authentication (who you are) with authorization (what you may do).
- Treating encryption at rest as sufficient while traffic crosses the public internet unencrypted.
- Leaving secrets in pipeline variables or Terraform state, where they persist indefinitely.
- Granting broad roles for convenience, then relying on review to catch it.
- Assuming compliance certification transfers to the workload you built.
Rule of thumb
Every permission should answer three questions: who, on exactly which resource, and until when. If any answer is "everyone", "all", or "forever", the grant is wrong.
Worked example
An analyst needs read access to one bucket for two hours. Correct: add the analyst to a federated group mapped to a read-only role scoped to that bucket, with a time-bound elevation and the grant recorded in audit logs. Incorrect: issuing a long-lived key with broad storage rights.