Cloud Security & IAM
Identity and Access Management controls who can do what in your cloud account. Learn least privilege, roles, policies and the habits that prevent most cloud breaches.
The Shared Responsibility Model
The provider is responsible for security of the cloud — physical data centers, hardware and the hypervisor. You are responsible for security in the cloud — your data, identities, configurations and application code.
Most real-world cloud breaches come from misconfiguration (public buckets, overly broad permissions, leaked keys), not from provider failures.
IAM Building Blocks
AWS IAM and its equivalents in other clouds are built from a small set of concepts:
- Users — Individual people or programs with long-lived credentials.
- Groups — Collections of users that share permissions.
- Roles — Identities assumed temporarily by users, services or other accounts. Preferred over long-lived keys.
- Policies — JSON documents that allow or deny actions on resources.
A Least-Privilege Policy
Grant exactly the actions and resources needed — nothing more. This policy lets a service read objects from a single folder of one bucket:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadReportsOnly",
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::my-company-data/reports/*"
}
]
}Security Checklist
Apply these habits to every cloud account:
- Enable multi-factor authentication on the root and all human users.
- Never use the root account for daily work.
- Use roles instead of access keys wherever possible.
- Store secrets in a secrets manager, never in source code.
- Encrypt data at rest and in transit.
- Turn on audit logging (CloudTrail, Activity Log) and review it.
- Block public access on storage buckets by default.
Key Takeaways
- You secure what you put in the cloud; the provider secures the underlying platform.
- Prefer roles with temporary credentials over long-lived access keys.
- Write policies with the minimum actions and resources required.
- MFA, encryption and audit logging are non-negotiable basics.
Contact Us
Have a question or feedback? Fill out the form below or reach us directly at support@nvaitraining.com