Infrastructure & Cloud Security¶

# Network segmentation (VLANs, subnets)
# DMZ: Public-facing web servers
# Internal: Application servers
# Database: Data tier (no internet access)
# Management: Jump boxes, bastion hosts

# Firewall rules (iptables example)
# Default deny all traffic
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT  # (1)!

# Allow SSH from management network only
iptables -A INPUT -p tcp --dport 22 -s 10.0.1.0/24 -j ACCEPT

# Allow HTTPS from anywhere
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# AWS Security Groups (stateful firewall)
# Inbound rules (whitelist)
aws ec2 authorize-security-group-ingress \
  --group-id sg-123456 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0  # (2)!

# Network Access Control Lists (NACLs - stateless)
aws ec2 create-network-acl-entry \
  --network-acl-id acl-123456 \
  --ingress \
  --rule-number 100 \
  --protocol tcp \
  --port-range From=443,To=443 \
  --cidr-block 0.0.0.0/0 \
  --rule-action allow

# IAM Best Practices
# 1. No root account usage (use IAM users/roles)
# 2. MFA on all accounts
# 3. Least privilege (minimal permissions)
# 4. Use roles for EC2/Lambda (no hardcoded keys)

# IAM policy example (S3 read-only)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket/*",
        "arn:aws:s3:::my-bucket"
      ]
    }
  ]
}  # (1)!

# S3 bucket security
# Block public access (default)
aws s3api put-public-access-block \
  --bucket my-bucket \
  --public-access-block-configuration \
  "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"  # (2)!

# Enable bucket encryption
aws s3api put-bucket-encryption \
  --bucket my-bucket \
  --server-side-encryption-configuration \
  '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}'

# CloudTrail (audit logging)
aws cloudtrail create-trail \
  --name my-trail \
  --s3-bucket-name my-cloudtrail-bucket  # (3)!
aws cloudtrail start-logging --name my-trail

# GuardDuty (threat detection)
aws guardduty create-detector --enable  # (4)!

# Docker image scanning (Trivy)
trivy image nginx:latest  # (1)!
trivy image --severity HIGH,CRITICAL myapp:v1.0

# Dockerfile security best practices
FROM python:3.12-slim  # (2)!

# Create non-root user
RUN useradd -m -u 1000 appuser
USER appuser  # (3)!

# Copy only necessary files
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY --chown=appuser:appuser . .

# No secrets in image
# Use environment variables or secret managers

EXPOSE 8080
CMD ["python", "app.py"]

# Kubernetes Pod Security Standards
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true  # (4)!
    runAsUser: 1000
    fsGroup: 1000
  containers:
  - name: app
    image: myapp:v1.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true  # (5)!
      capabilities:
        drop:
        - ALL
    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"

# Zero Trust Access (BeyondCorp model)
# 1. Verify explicitly (never trust, always verify)
# 2. Least privilege access
# 3. Assume breach (limit blast radius)

# AWS IAM role assumption (no hardcoded credentials)
import boto3

# EC2/Lambda automatically uses instance profile
s3 = boto3.client('s3')  # No keys needed!  # (1)!
s3.list_buckets()

# Azure Managed Identity
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClient

credential = DefaultAzureCredential()  # (2)!
blob_client = BlobServiceClient(
    account_url="https://myaccount.blob.core.windows.net",
    credential=credential
)

# GCP Workload Identity
# Kubernetes service account -> GCP service account mapping
# No JSON key files needed

# Multi-factor authentication enforcement
# AWS IAM policy requiring MFA
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      }
    }
  ]
}  # (3)!

# AWS Config (compliance monitoring)
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "s3-bucket-public-read-prohibited",
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
    }
  }'  # (1)!

# Azure Policy (governance)
az policy definition create \
  --name 'require-encryption' \
  --rules '{
    "if": {
      "field": "type",
      "equals": "Microsoft.Storage/storageAccounts"
    },
    "then": {
      "effect": "audit",
      "details": {
        "type": "Microsoft.Storage/storageAccounts/encryptionSettings"
      }
    }
  }'

# GCP Security Command Center
gcloud scc assets list ORGANIZATION_ID \
  --filter="securityCenterProperties.resourceType=\"google.compute.Instance\""  # (2)!

# Open source CSPM (CloudSploit)
npm install -g cloudsploit
cloudsploit scan --cloud aws --config config.js  # (3)!

# Network Policies (Calico, Cilium)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress  # (1)!

---
# Allow only from specific namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-frontend
  namespace: backend
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: frontend  # (2)!
    ports:
    - protocol: TCP
      port: 8080

# RBAC (Role-Based Access Control)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]  # (3)!

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: ServiceAccount
  name: my-app
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# Admission Controllers (OPA Gatekeeper)
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-owner-label
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Namespace"]
  parameters:
    labels:
    - key: "owner"  # (4)!

# AWS Secrets Manager
aws secretsmanager create-secret \
  --name prod/db/password \
  --secret-string "MySecurePassword123!"  # (1)!

# Retrieve secret (application)
aws secretsmanager get-secret-value \
  --secret-id prod/db/password \
  --query SecretString \
  --output text

# HashiCorp Vault
# Start Vault dev server
vault server -dev

# Store secret
vault kv put secret/myapp/config \
  db_password="MySecurePassword123!" \
  api_key="abc123"  # (2)!

# Retrieve secret (application)
vault kv get -field=db_password secret/myapp/config

# Kubernetes Secrets (encrypted at rest)
kubectl create secret generic db-secret \
  --from-literal=password='MySecurePassword123!'  # (3)!

# External Secrets Operator (sync from Vault/AWS Secrets Manager)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: SecretStore
  target:
    name: db-secret
  data:
  - secretKey: password
    remoteRef:
      key: prod/db/password  # (4)!

## Zero Trust Principles

### 1. Verify Explicitly
- Multi-factor authentication (MFA) everywhere
- Device compliance checks (EDR agent installed, patched)
- Continuous authentication (re-verify periodically)

### 2. Least Privilege Access
- Just-in-time (JIT) access (time-limited permissions)
- Just-enough-access (JEA) (minimal permissions)
- Privileged Access Management (PAM) for admin

### 3. Assume Breach
- Micro-segmentation (limit lateral movement)
- Network traffic encryption (mTLS between services)
- Logging and monitoring (detect anomalies)

## Implementation (BeyondCorp/Zero Trust Access)

**Identity Provider (IdP):**
- Okta, Azure AD, Google Workspace  # (1)!
- SAML/OIDC for SSO

**Device Trust:**
- MDM (Mobile Device Management)
- Endpoint detection (CrowdStrike, SentinelOne)

**Access Proxy:**
- Google BeyondCorp, Cloudflare Access, Zscaler
- No VPN (direct access via proxy)  # (2)!

**Enforcement:**
- Context-aware policies (user + device + location)
- Continuous monitoring (anomaly detection)