Tech in Diagrams

Cloud Security Basics

Cloud security starts with identity: prove who is asking, then allow only what that identity needs.

Intermediate 5 min Cloud Computing
Independent layers, one protected workload
  • Allowed request
  • Keys & audit
  • Denied
LAYER 1 · IDENTITYUser or workloadA person, or an applicationwith its own machine identity.id: app-serviceWHO ARE YOU?AuthenticationMFA or a short-lived tokenproves the claim. Grants nothing.AUTHENTICATED · NOT PERMITTEDSecond identityAsks to delete customer data.No role grants that action.WHAT MAY YOU DO?AuthorisationLeast-privilege rolesSECRETS & KEYSManaged storeNever in code or images.TLS in transitLAYER 3 · NETWORK SEGMENTATIONProtected environmentnot reachable from the open internetWORKLOADApplicationRuns with its own identity and a narrow set of permissions.Patched and configured deliberately — no credentials in the code.LAYER 4 · ENCRYPTION AT RESTData storeDisks, backups and snapshots are encrypted with managed keys,so the storage media alone reveals nothing.LAYER 6 · VISIBILITYAudit logAllowed and refused, both kept.SHARED RESPONSIBILITY
Identity proves who is asking, permissions decide what they may do, and segmentation, encryption, secret management and audit each cover what the others cannot.

Hover identity, the authorisation decision, the boundary, the data store, secrets, audit or the responsibility rail to isolate related paths; click any component for a short explanation.

Common misconception

“"The provider secures everything."”

Providers secure the infrastructure. Customers remain responsible for identities, permissions, network rules, configuration and their own data — the shared responsibility model.

Next conceptMonitoring vs ObservabilityMonitoring watches for known problems; observability is being able to investigate ones you did not predict.