tadata
Back to home

Cloud Security Architecture: Layers, Models, and Practices

#cloud#security#architecture#compliance

Cloud security is not a product you buy -- it is an architecture you build. Understanding the shared responsibility model, defense-in-depth layers, and identity-centric security is fundamental to any cloud deployment.

The Shared Responsibility Model

The boundary between provider and customer responsibility varies by service type:

LayerIaaSPaaSSaaS
Physical securityProviderProviderProvider
Network infrastructureProviderProviderProvider
Hypervisor / host OSProviderProviderProvider
Guest OSCustomerProviderProvider
Runtime / middlewareCustomerProviderProvider
ApplicationCustomerCustomerProvider
DataCustomerCustomerCustomer
Identity & accessCustomerCustomerCustomer
Client-side encryptionCustomerCustomerCustomer

Key insight: data and identity are always your responsibility, regardless of service model.

Network Security

VPC Architecture

  • Public subnets -- only for load balancers and bastion hosts
  • Private subnets -- application servers, databases, internal services
  • Isolated subnets -- no internet access, for sensitive data processing
  • VPC endpoints -- access cloud services without traversing the internet

Security Controls

ControlPurposeProvider Examples
Security GroupsInstance-level firewall (stateful)AWS SG, GCP Firewall Rules
Network ACLsSubnet-level firewall (stateless)AWS NACL, Azure NSG
WAFApplication-layer protectionAWS WAF, Cloud Armor, Azure WAF
DDoS protectionVolumetric attack mitigationAWS Shield, Cloud Armor, Azure DDoS
Private LinkPrivate connectivity to servicesAWS PrivateLink, GCP Private Service Connect

Identity and Access Management

IAM is the most critical security layer in the cloud. Misconfigured IAM is the leading cause of cloud breaches.

Core principles:

  • Least privilege -- grant only the permissions needed for the task
  • No long-lived credentials -- use IAM roles, workload identity, not access keys
  • MFA everywhere -- enforce multi-factor authentication for all human users
  • Federation -- centralize identity with SSO (Okta, Azure AD, Google Workspace)
  • Service accounts -- separate identity for each service, no shared credentials

Identity Architecture

PatternDescriptionUse Case
SSO + SAML/OIDCFederate corporate identity to cloudHuman access
Workload IdentityCloud-native identity for servicesService-to-service
Cross-account rolesAssume roles across AWS accountsMulti-account architectures
Just-in-time accessTemporary elevated permissionsBreak-glass scenarios

Encryption

At Rest

  • Default encryption -- all major providers encrypt storage by default
  • Customer-managed keys (CMK) -- you control the key in KMS, provider encrypts
  • Client-side encryption -- encrypt before sending to the cloud (highest control)

In Transit

  • TLS everywhere -- enforce TLS 1.2+ for all connections
  • Mutual TLS (mTLS) -- both client and server authenticate (service mesh)
  • Certificate management -- use ACM (AWS), Certificate Manager (GCP), or Let's Encrypt

Security Posture Management

Continuously assess and remediate security configurations:

Tool CategoryExamplesWhat It Does
CSPMPrisma Cloud, AWS Security Hub, WizDetect misconfigurations across accounts
CWPPAqua, Sysdig, FalcoRuntime workload protection
CIEMErmetic, CloudKnoxIdentity permission analysis
IaC scanningCheckov, tfsec, BridgecrewCatch issues before deployment
Secret scanningGitGuardian, TrufflehogDetect leaked credentials in code

Compliance Frameworks

FrameworkFocusCommon In
SOC 2Security controls and processesSaaS companies
ISO 27001Information security managementEnterprise
GDPRData protection (EU)Any company handling EU data
HIPAAHealth information protectionHealthcare
PCI DSSPayment card dataE-commerce, finance

Resources