OWASP Cloud Security Basics
Cloud platforms rent computing power, storage, and databases by the hour. Teams launch services in minutes, and mistakes spread just as fast. Cloud security basics explain who protects what and which settings cause most real-world breaches.
The Apartment Building Comparison
A landlord secures the building: the front door, the roof, and the shared wiring. Each tenant locks their own apartment door and decides who gets a spare key. Cloud security divides duties the same way, under a rule called the shared responsibility model.
Shared Responsibility Model
+--------------------------------------------+ | YOU: data, accounts, access rules, | | application code, configuration | +--------------------------------------------+ | PROVIDER: physical buildings, hardware, | | network, virtualization layer | +--------------------------------------------+
The line moves depending on the service type. Virtual machines leave more duties with you, and fully managed services leave fewer. Customer duties never disappear.
Top Cloud Mistakes
| Mistake | Consequence |
|---|---|
| Public storage buckets | Anyone on the internet downloads private files |
| Overly broad permissions | One stolen key controls the entire account |
| No multi-factor authentication on admin accounts | Password theft grants full control |
| Open network ports | Databases and admin tools face the whole internet |
| Missing logging | Nobody notices the breach |
| Hard-coded keys in code | Keys leak through repositories |
Identity and Access Management
Identity and access management, or IAM, decides who can do what. Apply the principle of least privilege: grant the smallest set of permissions that lets a person or service finish its job. Use roles with temporary credentials for applications. Protect the root or owner account with strong multi-factor authentication and avoid using it for daily work.
Network Layers
Internet
|
↓
[ Load balancer + WAF ] public subnet
|
↓
[ Application servers ] private subnet
|
↓
[ Database ] private subnet, no internet route
Place only the entry point in the public zone. Keep application servers and databases in private zones. Use security groups or firewall rules that allow only the traffic each layer needs.
Data Protection
- Encrypt data at rest with provider-managed or customer-managed keys.
- Require TLS for data in transit.
- Block public access at the account level for storage services.
- Back up critical data and test restores.
Visibility and Detection
Turn on audit logging for every account and region from the first day. Send logs to a separate, protected location. Create alerts for risky events: new administrator accounts, disabled logging, and large data downloads.
Infrastructure as Code
Teams describe cloud resources in code files. Reviews and automated scanners catch dangerous settings, such as a public bucket, before deployment. Code also makes environments repeatable, which cuts manual mistakes.
Starter Checklist
- Enable multi-factor authentication for all human accounts.
- Remove unused accounts and access keys.
- Apply least privilege roles.
- Block public storage access unless a case demands it.
- Turn on logging and alerts.
- Scan configuration with a cloud posture tool on a schedule.
Key Takeaways
- The provider secures the cloud, and you secure what you put in it.
- Misconfiguration causes more cloud breaches than advanced attacks.
- Least privilege, MFA, and logging deliver the biggest gains.
- Private networks and encryption protect data in every layer.