Unit 01 of 02
Cloud Security Model
Measuring how many items a single misconfigured item can reach in rented infrastructure: the item that can be written to the audit list under a given service model and the item that stays in the gap, the item reachable directly and through role chaining from a leaked identity, the walk that a network path closes off, the type of data exposed by publicly reachable storage items, the effect of key ownership on the radius, and the item caught at the template level versus the item visible only at runtime.
Published Updated
Lessons
- 01 Cloud Service Models and Responsibility Translating the shared-responsibility boundary into an audit list: 21 items that can be misconfigured are classified across three service models, the items that can be automatically audited drop from 15 to 12 and 7 while the items left outside the audit list rise from 6 to 9 and 14, the share of seed weight goes from 35% to 51% and 66%, unowned items rise from 0 to 2 and 4, and the 28-unit blind spot that no list can read stays fixed across all three models. 14 min read
- 02 Identity and Access Management Turning the blast radius into a number: in an access graph of 10 identities and 18 items, a walk is run from a single leaked service account — against 2 directly reached items, 7 more are added through chaining, reaching a total of 9 items, with a 4.5x factor and a depth of 3. Without the assumption edge at all, the widest radius would be 4 instead of 9. Four audits are run on the same graph: removing one trust edge brings the radius down to 4 and stops 4 legitimate jobs a day, while multi-step verification does not lower the radius at all. 14 min read
- 03 Network Isolation Intersecting the permission radius with the network path: the same 9-item walk drops to 6 from outside, 8 from the workload network, and 2 from the management network. Moving 10 items with no legitimate outside access to a private endpoint brings the outside radius down from 6 to 4 and stops zero legitimate jobs; pulling the threshold to 50 a day zeroes out the outside radius and stops 101 outside accesses a day. The workload network column stays at 8 across all four audits. 14 min read
- 04 Storage Exposure Two separate measures of a publicly open storage item: 7 of 13 object groups are open, with 61,697 records and 6 of 7 data types readable. Closing public access at the bucket level closes 9,260 personal records but leaves the spread radius at 10; closing the 47-record configuration item brings the radius down from 10 to 5 and stops 9 legitimate accesses a day. Closing all public access costs 8,655 accesses a day. 14 min read
- 05 Key and Secret Management Key ownership's effect on the blast radius is run in three modes: under a provider key, the leaked identity reads 16 items; under a customer-managed key, still 16; under a customer-held key, 11. Taking a single key permission out of the chain drops managed mode from 16 to 6 and held mode from 11 to 3, and stops 1 legitimate operation a day. Reading the secret store adds 4 identities to the walk. 14 min read
- 06 Infrastructure as Code Security The wrong items found in the previous five lessons are put back into the template set and run through a rule set: 4 of the 11 wrong items are caught before deployment, closing 23 of a total 34-unit radius share (68%); 5 items resolve only while running; 2 items have no value in the template to read. The rule set falsely flags 3 legitimate items; disabling the rule erases both the false flag and the real finding. 10 min read