CyberSecurity Deep Dive
by Sergey Okinchuk
Shifting LeftThe Shared Responsibility Model

Chapter Thirteen · Securing the Cloud

Cloud and Modern Infrastructure Security

Meridian runs in the cloud, and the intruder's easiest wins there aren't exotic exploits — they're misconfigurations: a public bucket, an over-privileged role, an exposed metadata endpoint. This chapter secures Meridian's cloud account and containers, kept vendor-neutral so the principles transfer to any provider.

5 topics

The cloud does not make security someone else's problem — it splits it, and the customer's half is where nearly every reported cloud breach happens. Those breaches are rarely exotic exploits; they are misconfigurations: a storage bucket left public, a role granted far more than it needs, a metadata endpoint an SSRF can reach. This chapter secures Meridian's cloud the way the data says it actually gets attacked.

Five topics, kept vendor-neutral so the principles transfer to any provider: the shared responsibility model, cloud IAM and misconfiguration, container and Kubernetes security, data protection and secrets, and the attack paths that chain misconfigurations to admin. It builds on the identity (Chapter 3), network (Chapter 4), and web (Chapter 6) foundations rather than repeating them.

Where cloud breaches actually happen — the customer side
Identity & access
over-privilege · leaked keys
Configuration
public storage · open access
Data & secrets
encryption · KMS · metadata

Topics in This Chapter

Topic 67
The Shared Responsibility Model
The cloud splits security rather than removing it: the provider secures the infrastructure, you secure what you put in it. Nearly every cloud breach happens on the customer's half — configuration and identity.
Shared Model
Topic 68
Cloud IAM and Misconfiguration
In the cloud, identity is the perimeter. An over-privileged role or leaked key is a key to the building. The dominant cloud attack path is misconfiguration, not exploit — applied least privilege to cloud IAM.
Cloud IAM
Topic 69
Container and Kubernetes Security
Containers and Kubernetes add their own attack surface. Minimize the image, drop privileges, isolate workloads, secure the control plane — with operational depth handed to the Docker and Kubernetes courses.
Containers / K8s
Topic 70
Data Protection and Secrets in Cloud
The most common cloud breach headline is "exposed storage bucket." Encrypt at rest and in transit, control who can read it, keep keys and secrets out of reach — and harden the metadata endpoint SSRF can hit.
Data Protection
Topic 71
Cloud-Native Attack Paths
Cloud breaches rarely come from one misconfig — they chain: SSRF to metadata to role credentials to over-privileged role to admin. Attack-path thinking turns a findings list into a real risk picture.
Attack Paths