Cloud Security Reference
Cloud platforms, cloud-native architecture, and the attack and defense of managed infrastructure - AWS, Azure, GCP, Kubernetes, serverless, and Infrastructure as Code.
This category follows the two-track format: each file covers both the offensive (attack) and defensive (detection, hardening) side of the topic, with no suffix in the section headers.
CAUTION
Authorized use only. All material is provided for educational purposes and authorized testing.
See ../SECURITY.md for the full policy.
Subcategories
| # | Subcategory | Files | Focus |
|---|---|---|---|
| 01 | AWS | 5 | IAM, S3, EC2, pentesting and defense in AWS |
| 02 | Azure | 5 | Entra ID, Storage, VM security, attack paths |
| 03 | GCP | 5 | IAM, Cloud Storage, GCE, Google Cloud defense |
| 04 | Kubernetes-Cloud | 5 | Kubernetes attack surface, container escapes, GKE/EKS |
| 05 | Serverless | 4 | Lambda, Cloud Functions, container-based serverless |
| 06 | IaC | 5 | Terraform/CloudFormation, state files, CI/CD, policy as code |
Format
- Every file is written in the two-track format (Offensive / Defensive).
- Section skeleton: Overview, Reconnaissance / Enumeration, Common Attack Vectors, Exploitation Recipes, Post-Exploitation, Preventive Controls, Detection Controls, Verification, Certification Alignment, Production Notes, References.
- No
(AppSec)suffix in section headers - cloud and infrastructure sections are self-explanatory.
Certification Alignment
See CERTIFICATIONS.md for the mapping between subcategories and certification objectives.
Related
- INFRASTRUCTURE - on-premises infrastructure attack and defense
- NETWORKS - network fundamentals, protocols, devices
- AI - AI and LLM security
- DEVSECOPS - CI/CD, supply chain, secrets (planned)
Archive
Raw drafts are not stored. Final files live directly in the numbered subcategory folders.
License
Documentation in this directory is licensed under CC BY-NC 4.0 (see the root LICENSE). Source code (if any) is MIT.