Cloud Security Operations, Automation, and DevSecOps
This domain tests secure delivery and operations at scale: infrastructure as code, policy as code, CI/CD controls, and automated response.
Core rules
- Shift left: scan IaC, dependencies, containers, and secrets in pull requests; block merges on high-severity findings.
- Enforce guardrails with organization policies, SCPs, and Azure Policy rather than manual review alone.
- Secure the pipeline: least-privilege deployment roles, short-lived credentials, protected branches, and artifact signing.
- Detect drift with CSPM and reconcile through the pipeline; automate remediation only with safeguards and audit trails.
- Use SOAR for repetitive containment, but require approval for destructive actions.
Worked example
A Terraform change makes an object bucket public. The pipeline runs IaC scanning and an OPA policy that denies public ACLs; the merge is blocked. If a manual console change later makes it public, CSPM detects drift and opens a ticket; auto-remediation removes the public policy and logs the action. Reasoning: prevention at the pipeline plus detection at runtime covers both code and console paths.
Traps
- Relying on manual reviews for every change.
- Over-privileged CI/CD roles and long-lived cloud keys.
- Ignoring IaC state files, which can contain secrets.
- Automating destructive response without approval or rollback.