Cloud Security

The provider secures the hardware, hypervisor and, depending on the service model, the operating system and application. The customer always keeps responsibility for its data, identities and access, and the configuration of the services it uses.

Providers heavily protect their own infrastructure, so attackers target the customer side: public storage buckets, leaked long-lived access keys, over-broad permissions, metadata service abuse via SSRF and missing logs. None of these require breaking the provider.

The control plane is the management API that creates and configures resources and permissions. The data plane is the use of a resource, such as reading an object. Control-plane actions are logged by default on AWS, Azure and GCP; data reads usually are not.

Create a dedicated account that holds nothing of value, enable MFA on the owner login, set a low budget alert before creating resources, use short-lived sign-in credentials instead of permanent keys, tag lab resources and delete them after each session.

Run aws sts get-caller-identity. It needs no special permissions and returns the account ID, user ID and ARN of the principal behind your current credentials, so you always know which identity and account you are working in.