Cloud Application Architecture and Design Security
Cloud application architecture and design security tests whether you can build a system whose security properties survive elastic scaling, multi-tenancy, and provider-managed infrastructure. The exam focuses on where trust boundaries fall, how data crosses them, and which controls belong to the provider versus the customer.
Core design rules
- Start from shared responsibility: the provider secures facilities, hypervisor, and managed-service control planes; you own identity configuration, data classification, network policy inside your virtual network, and application code.
- Threat-model before finalizing the diagram. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) maps onto cloud components: spoofing to missing workload identity, tampering to unsigned messages between services, elevation to over-broad instance roles.
- Apply least privilege to network paths, not just identities. Security groups are stateful and allow-only; network ACLs are stateless and support explicit deny. Place them so a compromised web tier cannot reach the database tier on the management port.
- Reduce blast radius by segmenting per environment and per tenant, and prefer separate accounts/subscriptions per environment over separate VPCs inside one account.
- Fail closed on authorization, but degrade gracefully on non-security dependencies so availability pressure never becomes an argument for disabling checks.
Worked example
A three-tier app has a public load balancer, an application tier in a private subnet, and a database in an isolated subnet. Where is the weakest link? The load balancer terminates TLS, but traffic to the application tier is plaintext HTTP inside the VPC; the application security group accepts 0.0.0.0/0 on port 8080 because an engineer once debugged from a laptop; the database accepts connections from the entire VPC CIDR rather than the application security group. The database rule is the strongest finding because it erases the segmentation the architecture claims to provide. Fix by referencing the application security group as source, restoring TLS to the app tier, and removing the wide rule through change control.
Traps
Assuming all intra-VPC traffic is trusted; forgetting that serverless functions still need egress control; treating encryption at rest as a substitute for authorization; and designing VPC-level isolation when the requirement was account-level isolation.