CloudSec-Pro flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Shared responsibility model

A division of security duties between cloud provider and customer. The provider secures the physical infrastructure and managed service internals; the customer secures data, identities, configuration, and workloads.

Service control policy

An AWS Organizations policy that sets the maximum permissions for accounts in the organization. It grants nothing on its own and overrides identity policy allows with an explicit deny.

Permission boundary

A managed policy that caps the maximum permissions an IAM principal can have. It never grants permissions; it only restricts what identity policies can allow.

Confused deputy

A flaw where a service is tricked into acting on behalf of one customer for another. Cross-account role trust policies mitigate it using an ExternalId and principal conditions.

Envelope encryption

A two-tier scheme where a data key encrypts the data and a KMS key encrypts the data key. Only the wrapped data key is stored with the ciphertext.

Crypto-shredding

Destroying the encryption key so ciphertext becomes permanently unrecoverable. Used to satisfy erasure requests without deleting every copy of the data.

Customer-managed key

An encryption key the customer creates, controls, and rotates, with its own key policy and audit trail. It enables independent revocation unlike provider-managed keys.

Stateful security group

A virtual firewall that allows only permit rules and automatically permits return traffic for established connections. All attached rule sets are evaluated as a union.

Stateless network ACL

A subnet-level filter that evaluates rules in numbered order and requires explicit rules for both directions. Return traffic must be separately allowed.

VPC gateway endpoint

A route-table target that provides private access to services such as S3 and DynamoDB without internet or NAT. It can enforce endpoint-only bucket access policies.

PrivateLink

A mechanism that exposes services through interface endpoints backed by elastic network interfaces inside your VPC, keeping traffic off the public internet.

Landing zone

A preconfigured multi-account environment with centralized identity, guardrails, logging, and network topology. It standardizes baseline security before workloads are deployed.

Control inheritance

The principle that a provider's compliance certification covers only its layer. Customers must still evidence their own controls for inherited requirements.

Residual risk

The risk remaining after controls are applied, calculated as inherent risk reduced by control effectiveness. It must be documented with an owner and expiry.

Policy-as-code

Security rules expressed in machine-readable form and enforced automatically in pipelines or at admission. Preventive policies block provisioning; detective policies only report.

Image signing

Cryptographically signing container images so admission controllers can verify provenance and integrity. It prevents deployment of tampered or unapproved images.

SBOM

A software bill of materials listing components and versions in an artifact. It enables fast identification of exposure when a new dependency vulnerability is disclosed.

IaC drift

A difference between deployed infrastructure and its declared source of truth. Drift detection flags manual console changes that bypass reviewed pipelines.

Serverless execution role

The IAM role a function assumes at runtime. It should be scoped per function to specific resources rather than shared with wildcard permissions.

CloudTrail data events

Audit records for resource-level operations such as S3 object reads and Lambda invocations. They are disabled by default and incur additional cost.

Log archive account

A dedicated account that centralizes logs with write-once retention and restricted delete permissions. It preserves evidence even if a workload account is compromised.

MTTD and MTTR

Mean time to detect and mean time to respond. These operational metrics measure detection coverage and incident response efficiency rather than alert volume.

Quarantine isolation

A containment technique that replaces a compromised instance's security groups or network policy to block all traffic while preserving it for forensic analysis.

CSPM

Cloud security posture management continuously scans configurations against benchmarks and reports misconfigurations, public exposure, and policy violations across accounts.

CIEM

Cloud infrastructure entitlement management analyzes effective permissions, identifies excessive or unused access, and supports rightsizing of roles and service accounts.

CWPP

Cloud workload protection platform secures running compute through vulnerability scanning, runtime behavioral detection, and file integrity monitoring on hosts and containers.

Exploitability prioritization

Ranking findings by exposure and known exploitation rather than raw CVSS. Internet-facing assets with actively exploited flaws are remediated first.

Secret scanning

Detecting credentials committed to code or configuration. Effective handling requires immediate revocation and rotation, not just an alert.

Break-glass role

A highly privileged emergency account used when normal access fails. It requires MFA, alerting on use, and post-use credential rotation and review.

Access review

A periodic attestation that each principal still needs its assigned permissions. Unused or excessive entitlements identified by CIEM analysis are removed.

Policy exception

A documented, time-bound approval to deviate from a security baseline with compensating controls. Expiry is mandatory or the exception becomes permanent risk.

Zero trust

An architecture that authorizes every request based on identity and context rather than network location. Service-to-service calls use mutual TLS and workload identities.