Security
Identity is the control plane
Cloud security starts with the shared responsibility model: the provider secures the cloud, and you secure what you put in it, though the split changes with IaaS, PaaS, and SaaS. Enforce least privilege with roles and policies, not long-lived access keys. Use MFA, federation, and SSO so identities live in a central provider. Separate human, service, and emergency accounts, and log administrative actions.
Protect data and networks
Classify data, then encrypt at rest and in transit with managed key services; control key rotation and access. Secrets belong in a secrets manager, not in code or images. Segment networks with subnets, security groups, and network ACLs. Security groups are stateful; NACLs are stateless and evaluate rules in order. Add WAF, DDoS protection, IDS/IPS where appropriate, and private endpoints for sensitive services.
Detect and respond
Vulnerability scanning, configuration benchmarks, cloud security posture management, and patch management reduce exposure. Centralize audit logs in a SIEM, set retention and legal hold, and rehearse incident response and forensics. Zero trust replaces treating the internal network as trusted with continuous verification.
Traps
Encryption at rest does not stop an authorized application from reading data. Sharing access keys breaks accountability. A default VPC or public storage bucket is a common exposure. MFA on the root account is non-negotiable.
Worked example
An application in account A must read a bucket in account B. Do not copy B's long-term keys into A. Create a role in B with a trust policy for A, grant only the needed bucket actions, and let A assume the role with short-lived credentials. Rule of thumb: deny by default, grant narrowly, and verify continuously.