FCSS Public Cloud Security cheat sheet

Shared responsibility split: provider secures security OF the cloud (facilities, physical hosts, managed-service hypervisor, managed-service patching); customer secures security IN the cloud (identity, data, guest OS, customer-configured network controls, customer workloads).

Responsibility boundary shifts by service model: IaaS leaves guest OS, runtime, and patching to the customer; PaaS moves OS/runtime patching to the provider but keeps data, identity, and configuration with the customer; SaaS leaves configuration, identity, and data classification with the customer.

FortiGate VM in a public cloud is always customer-managed: the customer owns licensing, firmware updates, policy, HA design, and the security posture of the virtual appliance itself.

Identity is the primary control plane in public cloud: root/global-admin accounts should be protected with hardware MFA, and long-lived access keys replaced by short-lived role assumption or workload identity federation.

Compliance inheritance is partial: provider attestations (SOC 2, ISO 27001, PCI) cover provider infrastructure only; customer must produce own evidence for workloads, logging, and access control.

Data residency and sovereignty are customer responsibilities; region selection, encryption key custody (BYOK/HYOK), and cross-border replication choices must be documented in the risk register.

Cloud-native logging is opt-in: audit trails (CloudTrail, Azure Activity Log, GCP Cloud Audit Logs), VPC flow logs, and storage access logs are not universally on by default and must be enabled per account/subscription/project.

Blast-radius principle: separate accounts/subscriptions/projects per environment and workload tier so a compromised credential or misconfiguration is contained by an account boundary rather than a VPC boundary.

VPC (AWS/GCP) and VNet (Azure) are regional or global logical boundaries with no inherent inter-network routing; connectivity requires peering, transit gateway, or hub-and-spoke attachments.

Subnets are zonal (AWS/Azure) or regional (GCP); public vs private is determined by route table entries and attached internet gateway/NAT, not by a subnet checkbox alone.

Security groups / NSGs are stateful and attach to ENIs or subnets; NACLs are stateless and evaluated in numbered order, so both directions and ephemeral ports must be explicitly allowed.

Route table longest-prefix match decides the next hop; a more specific /32 or /24 route overrides a broader /16, which is how traffic is steered into a FortiGate or inspection VPC.

Hub-and-spoke with a transit gateway or VNet peering centralizes inspection: spokes route 0.0.0.0/0 or inter-spoke prefixes to the hub, and the hub FortiGate performs policy and returns traffic to the correct spoke attachment.

Asymmetric routing breaks stateful firewalls: if return traffic bypasses the FortiGate, sessions are dropped; fix by ensuring both directions traverse the same firewall interface pair or by enabling asymmetric routing handling.

Private connectivity options: AWS PrivateLink, Azure Private Link/Private Endpoint, and GCP Private Service Connect keep service traffic off the public internet and are preferred for PaaS data-plane access.

Overlapping CIDR is the most common peering blocker; design address plans up front or front overlapping ranges with the FortiGate doing NAT between spokes.

FortiGate VM images are published per cloud marketplace per region and per license model (BYOL vs on-demand/pay-as-you-go); the license type determines whether FortiCare and FortiGuard updates are bundled.

Instance sizing maps to throughput and session counts: vCPU/memory tiers gate IPsec and SSL inspection throughput, so size from the FortiGate VM datasheet rather than from the cloud instance family alone.

NIC-to-port mapping is fixed by the image: typically port1 is the management/outside interface and additional NICs map to port2, port3, etc.; interface roles must match the cloud route tables.

Management access should use a dedicated interface or a restricted source range; public admin exposure on port1 should be limited to a bastion or replaced by a site-to-site tunnel or SD-WAN overlay.

HA in public clouds uses FGCP over unicast on a dedicated heartbeat path or cloud-native HA APIs; floating or secondary IPs must be reassigned on failover, and cloud route tables or load balancers must be updated to point at the new active unit.

Autoscaling / HA cluster (auto-scale) deployments require external orchestration (cloud-native APIs or FortiGate Cloud / FortiManager) to sync configuration and license new instances, because cloud instances cannot rely on L2 broadcast for FGCP discovery.

Licensing and registration: BYOL requires applying a license file tied to the instance; on-demand instances register to FortiCare automatically, and FortiManager/FortiCloud can centralize firmware and policy pushes.

Cloud-init or bootstrap configuration injects the initial admin password, management route, and FortiManager registration so the appliance is manageable without console access.

CNAPP converges CSPM, CWPP, CIEM, IaC scanning, and container/Kubernetes protection; posture findings are only useful when mapped to a remediation owner and a control framework.

CSPM evaluates configuration against benchmarks (CIS Foundations Benchmarks, provider Well-Architected and security best practices); findings are scored by severity and exposure path, not by count alone.

CIEM focuses on effective permissions: it detects unused permissions, privilege escalation paths, and cross-account trust, which is distinct from CSPM's resource-configuration checks.

CWPP covers runtime workload protection: vulnerability and patch state, malware/EDR, file integrity, and process behavior on VMs and containers.

IaC scanning shifts left: Terraform, CloudFormation, and ARM/Bicep templates are checked pre-deploy for public buckets, open security groups, unencrypted volumes, and missing logging.

Attack path analysis links a public exposure to a sensitive identity to a data store; prioritizing these chains reduces alert fatigue compared with flat misconfiguration lists.

Posture drift is continuous: baselines must be re-evaluated after every deployment, and auto-remediation (event-driven functions or policy-as-code) closes the gap between detection and fix.

Agentless and agent-based scanning trade off depth vs. coverage: agentless snapshots catch OS/package CVEs broadly, agents catch runtime behavior and in-memory threats.

East-west inspection patterns: gateway load balancer (AWS GWLB, Azure Gateway Load Balancer) with GENEVE encapsulation transparently steers traffic to FortiGate appliances without changing spoke route tables.

Ingress inspection: an internet-facing load balancer or public FortiGate pair terminates or forwards traffic; egress inspection routes 0.0.0.0/0 from private subnets through the firewall for FQDN filtering and TLS inspection.

TLS inspection requires certificate distribution to endpoints or a trusted internal CA; without it, SNI-based and category-based filtering is the fallback for encrypted traffic.

Automation surfaces: FortiGate REST API, FortiManager JSON-RPC API, and cloud-native event sources (EventBridge, Azure Monitor/Event Grid, Cloud Functions) drive dynamic address groups and policy updates.

Dynamic objects close the loop: cloud connectors or SDN connectors populate firewall address objects from tags or instance metadata, so policy follows workloads as they scale.

Logging pipeline: FortiGate logs to FortiAnalyzer or a SIEM via syslog/CEF; VPC flow logs and cloud audit logs are correlated with firewall logs to reconstruct an incident timeline.

Change safety: configuration backups, FortiManager revision control, and staged policy installs prevent a bad push from severing management access to remote cloud instances.

Health and failover monitoring should include cloud-native metrics plus FortiGate HA status; alerting on HA split-brain and license expiry prevents silent inspection bypass.

Shared responsibility split: provider secures security OF the cloud (facilities, physical hosts, managed-service hypervisor, managed-service patching); customer secures security IN the cloud (identity, data, guest OS, customer-configured network controls, customer workloads).

Responsibility boundary shifts by service model: IaaS leaves guest OS, runtime, and patching to the customer; PaaS moves OS/runtime patching to the provider but keeps data, identity, and configuration with the customer; SaaS leaves configuration, identity, and data classification with the customer.

FortiGate VM in a public cloud is always customer-managed: the customer owns licensing, firmware updates, policy, HA design, and the security posture of the virtual appliance itself.

Identity is the primary control plane in public cloud: root/global-admin accounts should be protected with hardware MFA, and long-lived access keys replaced by short-lived role assumption or workload identity federation.

Compliance inheritance is partial: provider attestations (SOC 2, ISO 27001, PCI) cover provider infrastructure only; customer must produce own evidence for workloads, logging, and access control.

Data residency and sovereignty are customer responsibilities; region selection, encryption key custody (BYOK/HYOK), and cross-border replication choices must be documented in the risk register.

Cloud-native logging is opt-in: audit trails (CloudTrail, Azure Activity Log, GCP Cloud Audit Logs), VPC flow logs, and storage access logs are not universally on by default and must be enabled per account/subscription/project.

Blast-radius principle: separate accounts/subscriptions/projects per environment and workload tier so a compromised credential or misconfiguration is contained by an account boundary rather than a VPC boundary.

VPC (AWS/GCP) and VNet (Azure) are regional or global logical boundaries with no inherent inter-network routing; connectivity requires peering, transit gateway, or hub-and-spoke attachments.

Subnets are zonal (AWS/Azure) or regional (GCP); public vs private is determined by route table entries and attached internet gateway/NAT, not by a subnet checkbox alone.

Security groups / NSGs are stateful and attach to ENIs or subnets; NACLs are stateless and evaluated in numbered order, so both directions and ephemeral ports must be explicitly allowed.

Route table longest-prefix match decides the next hop; a more specific /32 or /24 route overrides a broader /16, which is how traffic is steered into a FortiGate or inspection VPC.

Hub-and-spoke with a transit gateway or VNet peering centralizes inspection: spokes route 0.0.0.0/0 or inter-spoke prefixes to the hub, and the hub FortiGate performs policy and returns traffic to the correct spoke attachment.

Asymmetric routing breaks stateful firewalls: if return traffic bypasses the FortiGate, sessions are dropped; fix by ensuring both directions traverse the same firewall interface pair or by enabling asymmetric routing handling.

Private connectivity options: AWS PrivateLink, Azure Private Link/Private Endpoint, and GCP Private Service Connect keep service traffic off the public internet and are preferred for PaaS data-plane access.

Overlapping CIDR is the most common peering blocker; design address plans up front or front overlapping ranges with the FortiGate doing NAT between spokes.

FortiGate VM images are published per cloud marketplace per region and per license model (BYOL vs on-demand/pay-as-you-go); the license type determines whether FortiCare and FortiGuard updates are bundled.

Instance sizing maps to throughput and session counts: vCPU/memory tiers gate IPsec and SSL inspection throughput, so size from the FortiGate VM datasheet rather than from the cloud instance family alone.

NIC-to-port mapping is fixed by the image: typically port1 is the management/outside interface and additional NICs map to port2, port3, etc.; interface roles must match the cloud route tables.

Management access should use a dedicated interface or a restricted source range; public admin exposure on port1 should be limited to a bastion or replaced by a site-to-site tunnel or SD-WAN overlay.

HA in public clouds uses FGCP over unicast on a dedicated heartbeat path or cloud-native HA APIs; floating or secondary IPs must be reassigned on failover, and cloud route tables or load balancers must be updated to point at the new active unit.

Autoscaling / HA cluster (auto-scale) deployments require external orchestration (cloud-native APIs or FortiGate Cloud / FortiManager) to sync configuration and license new instances, because cloud instances cannot rely on L2 broadcast for FGCP discovery.

Licensing and registration: BYOL requires applying a license file tied to the instance; on-demand instances register to FortiCare automatically, and FortiManager/FortiCloud can centralize firmware and policy pushes.

Cloud-init or bootstrap configuration injects the initial admin password, management route, and FortiManager registration so the appliance is manageable without console access.

CNAPP converges CSPM, CWPP, CIEM, IaC scanning, and container/Kubernetes protection; posture findings are only useful when mapped to a remediation owner and a control framework.

CSPM evaluates configuration against benchmarks (CIS Foundations Benchmarks, provider Well-Architected and security best practices); findings are scored by severity and exposure path, not by count alone.

CIEM focuses on effective permissions: it detects unused permissions, privilege escalation paths, and cross-account trust, which is distinct from CSPM's resource-configuration checks.

CWPP covers runtime workload protection: vulnerability and patch state, malware/EDR, file integrity, and process behavior on VMs and containers.

IaC scanning shifts left: Terraform, CloudFormation, and ARM/Bicep templates are checked pre-deploy for public buckets, open security groups, unencrypted volumes, and missing logging.

Attack path analysis links a public exposure to a sensitive identity to a data store; prioritizing these chains reduces alert fatigue compared with flat misconfiguration lists.

Posture drift is continuous: baselines must be re-evaluated after every deployment, and auto-remediation (event-driven functions or policy-as-code) closes the gap between detection and fix.

Agentless and agent-based scanning trade off depth vs. coverage: agentless snapshots catch OS/package CVEs broadly, agents catch runtime behavior and in-memory threats.

East-west inspection patterns: gateway load balancer (AWS GWLB, Azure Gateway Load Balancer) with GENEVE encapsulation transparently steers traffic to FortiGate appliances without changing spoke route tables.

Ingress inspection: an internet-facing load balancer or public FortiGate pair terminates or forwards traffic; egress inspection routes 0.0.0.0/0 from private subnets through the firewall for FQDN filtering and TLS inspection.

TLS inspection requires certificate distribution to endpoints or a trusted internal CA; without it, SNI-based and category-based filtering is the fallback for encrypted traffic.

Automation surfaces: FortiGate REST API, FortiManager JSON-RPC API, and cloud-native event sources (EventBridge, Azure Monitor/Event Grid, Cloud Functions) drive dynamic address groups and policy updates.

Dynamic objects close the loop: cloud connectors or SDN connectors populate firewall address objects from tags or instance metadata, so policy follows workloads as they scale.

Logging pipeline: FortiGate logs to FortiAnalyzer or a SIEM via syslog/CEF; VPC flow logs and cloud audit logs are correlated with firewall logs to reconstruct an incident timeline.

Change safety: configuration backups, FortiManager revision control, and staged policy installs prevent a bad push from severing management access to remote cloud instances.

Health and failover monitoring should include cloud-native metrics plus FortiGate HA status; alerting on HA split-brain and license expiry prevents silent inspection bypass.

Shared responsibility split: provider secures security OF the cloud (facilities, physical hosts, managed-service hypervisor, managed-service patching); customer secures security IN the cloud (identity, data, guest OS, customer-configured network controls, customer workloads).

Responsibility boundary shifts by service model: IaaS leaves guest OS, runtime, and patching to the customer; PaaS moves OS/runtime patching to the provider but keeps data, identity, and configuration with the customer; SaaS leaves configuration, identity, and data classification with the customer.

FortiGate VM in a public cloud is always customer-managed: the customer owns licensing, firmware updates, policy, HA design, and the security posture of the virtual appliance itself.

Identity is the primary control plane in public cloud: root/global-admin accounts should be protected with hardware MFA, and long-lived access keys replaced by short-lived role assumption or workload identity federation.

Compliance inheritance is partial: provider attestations (SOC 2, ISO 27001, PCI) cover provider infrastructure only; customer must produce own evidence for workloads, logging, and access control.

Data residency and sovereignty are customer responsibilities; region selection, encryption key custody (BYOK/HYOK), and cross-border replication choices must be documented in the risk register.

Cloud-native logging is opt-in: audit trails (CloudTrail, Azure Activity Log, GCP Cloud Audit Logs), VPC flow logs, and storage access logs are not universally on by default and must be enabled per account/subscription/project.

Blast-radius principle: separate accounts/subscriptions/projects per environment and workload tier so a compromised credential or misconfiguration is contained by an account boundary rather than a VPC boundary.

VPC (AWS/GCP) and VNet (Azure) are regional or global logical boundaries with no inherent inter-network routing; connectivity requires peering, transit gateway, or hub-and-spoke attachments.

Subnets are zonal (AWS/Azure) or regional (GCP); public vs private is determined by route table entries and attached internet gateway/NAT, not by a subnet checkbox alone.

Security groups / NSGs are stateful and attach to ENIs or subnets; NACLs are stateless and evaluated in numbered order, so both directions and ephemeral ports must be explicitly allowed.

Route table longest-prefix match decides the next hop; a more specific /32 or /24 route overrides a broader /16, which is how traffic is steered into a FortiGate or inspection VPC.

Hub-and-spoke with a transit gateway or VNet peering centralizes inspection: spokes route 0.0.0.0/0 or inter-spoke prefixes to the hub, and the hub FortiGate performs policy and returns traffic to the correct spoke attachment.

Asymmetric routing breaks stateful firewalls: if return traffic bypasses the FortiGate, sessions are dropped; fix by ensuring both directions traverse the same firewall interface pair or by enabling asymmetric routing handling.

Private connectivity options: AWS PrivateLink, Azure Private Link/Private Endpoint, and GCP Private Service Connect keep service traffic off the public internet and are preferred for PaaS data-plane access.

Overlapping CIDR is the most common peering blocker; design address plans up front or front overlapping ranges with the FortiGate doing NAT between spokes.

FortiGate VM images are published per cloud marketplace per region and per license model (BYOL vs on-demand/pay-as-you-go); the license type determines whether FortiCare and FortiGuard updates are bundled.

Instance sizing maps to throughput and session counts: vCPU/memory tiers gate IPsec and SSL inspection throughput, so size from the FortiGate VM datasheet rather than from the cloud instance family alone.

NIC-to-port mapping is fixed by the image: typically port1 is the management/outside interface and additional NICs map to port2, port3, etc.; interface roles must match the cloud route tables.

Management access should use a dedicated interface or a restricted source range; public admin exposure on port1 should be limited to a bastion or replaced by a site-to-site tunnel or SD-WAN overlay.

HA in public clouds uses FGCP over unicast on a dedicated heartbeat path or cloud-native HA APIs; floating or secondary IPs must be reassigned on failover, and cloud route tables or load balancers must be updated to point at the new active unit.

Autoscaling / HA cluster (auto-scale) deployments require external orchestration (cloud-native APIs or FortiGate Cloud / FortiManager) to sync configuration and license new instances, because cloud instances cannot rely on L2 broadcast for FGCP discovery.

Licensing and registration: BYOL requires applying a license file tied to the instance; on-demand instances register to FortiCare automatically, and FortiManager/FortiCloud can centralize firmware and policy pushes.

Cloud-init or bootstrap configuration injects the initial admin password, management route, and FortiManager registration so the appliance is manageable without console access.

CNAPP converges CSPM, CWPP, CIEM, IaC scanning, and container/Kubernetes protection; posture findings are only useful when mapped to a remediation owner and a control framework.

CSPM evaluates configuration against benchmarks (CIS Foundations Benchmarks, provider Well-Architected and security best practices); findings are scored by severity and exposure path, not by count alone.

CIEM focuses on effective permissions: it detects unused permissions, privilege escalation paths, and cross-account trust, which is distinct from CSPM's resource-configuration checks.

CWPP covers runtime workload protection: vulnerability and patch state, malware/EDR, file integrity, and process behavior on VMs and containers.

IaC scanning shifts left: Terraform, CloudFormation, and ARM/Bicep templates are checked pre-deploy for public buckets, open security groups, unencrypted volumes, and missing logging.

Attack path analysis links a public exposure to a sensitive identity to a data store; prioritizing these chains reduces alert fatigue compared with flat misconfiguration lists.

Posture drift is continuous: baselines must be re-evaluated after every deployment, and auto-remediation (event-driven functions or policy-as-code) closes the gap between detection and fix.

Agentless and agent-based scanning trade off depth vs. coverage: agentless snapshots catch OS/package CVEs broadly, agents catch runtime behavior and in-memory threats.

East-west inspection patterns: gateway load balancer (AWS GWLB, Azure Gateway Load Balancer) with GENEVE encapsulation transparently steers traffic to FortiGate appliances without changing spoke route tables.

Ingress inspection: an internet-facing load balancer or public FortiGate pair terminates or forwards traffic; egress inspection routes 0.0.0.0/0 from private subnets through the firewall for FQDN filtering and TLS inspection.

TLS inspection requires certificate distribution to endpoints or a trusted internal CA; without it, SNI-based and category-based filtering is the fallback for encrypted traffic.

Automation surfaces: FortiGate REST API, FortiManager JSON-RPC API, and cloud-native event sources (EventBridge, Azure Monitor/Event Grid, Cloud Functions) drive dynamic address groups and policy updates.

Dynamic objects close the loop: cloud connectors or SDN connectors populate firewall address objects from tags or instance metadata, so policy follows workloads as they scale.

Logging pipeline: FortiGate logs to FortiAnalyzer or a SIEM via syslog/CEF; VPC flow logs and cloud audit logs are correlated with firewall logs to reconstruct an incident timeline.

Change safety: configuration backups, FortiManager revision control, and staged policy installs prevent a bad push from severing management access to remote cloud instances.

Health and failover monitoring should include cloud-native metrics plus FortiGate HA status; alerting on HA split-brain and license expiry prevents silent inspection bypass.