Cloud-Native Security

​

The Cloud-Native Security Paradigm Shift

• Infrastructure model: Long-lived servers → Ephemeral functions and containers
• Access control: Network-based perimeters → Identity-based zero-trust access
• Application architecture: Monolithic applications → Distributed microservices
• Security enforcement: Immutable infrastructure with policy-driven controls
• Visibility: Comprehensive observability across distributed system behavior

​

Serverless and Function Security

​

Least Privilege IAM per Function

• Grant minimal IAM permissions required for specific function purpose
• Use separate execution roles per function (avoid shared roles)
• Scope permissions to individual resources (specific S3 buckets, DynamoDB tables, SQS queues)
• Avoid wildcard permissions that create excessive blast radius
• Implement resource-based policies for defense-in-depth

• Permission boundaries: Limit maximum assumable permissions to prevent privilege escalation
• Regular audits: Identify and remove unused permissions over time
• Dual authorization: Require both function execution role AND resource policy allowances

​

Event Source Protection

1. Access control: Restrict which principals can publish events via resource policies
2. Encryption: Protect event data in transit and at rest
3. Validation: Verify event authenticity and structure before processing
4. Rate limiting: Prevent resource exhaustion from event floods
5. Dead letter queues: Capture failed events for investigation without blocking processing

​

Secrets Management

1. Retrieve secrets at runtime from AWS Secrets Manager, Azure Key Vault, or Google Secret Manager
2. Avoid environment variables for sensitive data (visible to anyone with function read permissions)
3. Implement fine-grained access control with separate permissions for reading vs. managing secrets
4. Enable automatic rotation without function redeployment
5. Cache secrets within function execution contexts to reduce API calls
6. Set reasonable refresh intervals to balance security and performance

​

Managed Service Security

​

Private Connectivity

1. Disable public endpoints wherever possible
2. Deploy VPC-native services for databases and caches
3. Implement private endpoints for managed services
4. Apply service-specific firewall rules restricting access to specific IP ranges
5. Use IP allowlisting + authentication for defense-in-depth when public endpoints are required

​

Audit Logging and Monitoring

• Data access logs: Query patterns, object access, read/write operations
• Authentication logs: Login attempts, credential usage, MFA events
• Configuration changes: Schema modifications, permission updates, lifecycle policies
• Administrative operations: Service configuration, backup/restore, scaling events

1. Enable service-specific audit logs:
   • AWS CloudTrail for API calls
   • Amazon RDS audit logs for database queries
   • S3 access logging for object access
   • Azure Monitor for platform logs
2. Centralize log aggregation for cross-service correlation and long-term retention
3. Configure monitoring alerts for anomalous patterns indicating compromise or data exfiltration
4. Implement log retention policies meeting compliance requirements (GDPR, SOC 2, HIPAA)

​

Multi-Tenancy and Data Isolation

• Row-level security (RLS): Prevent cross-tenant data access through application vulnerabilities
• Column-level encryption: Protect sensitive fields with per-tenant encryption keys
• Per-tenant encryption keys: Enable cryptographic isolation with separate key management
• Network isolation: Dedicated VPCs or subnets per tenant

1. Classify data sensitivity using regulatory requirements and business impact
2. Match tenancy model to data classification (dedicated for PII/PHI, multi-tenant for public data)
3. Implement defense-in-depth with multiple isolation layers
4. Balance security requirements with cost constraints

​

Cloud-Native Application Protection Platform (CNAPP)

​

Integrated CSPM, CWPP, and CIEM

• Public storage buckets (S3, Blob Storage)
• Overly permissive security groups
• Disabled audit logging
• Unencrypted data stores
• Non-compliant resource configurations

1. Attack path analysis: Correlate configuration weaknesses + excessive permissions + vulnerable workloads
2. Risk-based prioritization: Focus remediation on highest-impact issues
3. Unified visibility: Single pane of glass across infrastructure, workloads, and identities
4. Automated remediation: Policy-driven fixes for common misconfigurations

​

Infrastructure-as-Code Scanning

• Unencrypted storage (S3, EBS, databases)
• Public network access (0.0.0.0/0 ingress rules)
• Missing audit logging
• Excessive IAM permissions (wildcard actions/resources)
• Non-compliant encryption algorithms
• Missing backup configurations

1. Integrate IaC scanning as CI/CD gates to prevent deployment of insecure infrastructure
2. Configure custom policies for organization-specific requirements (tagging, instance types, regions)
3. Provide developer feedback through pull request comments and IDE integrations
4. Set enforcement levels: Block critical issues, warn on medium/low severity
5. Track remediation metrics to measure security posture improvement

​

Drift Detection and Auto-Remediation

1. Classify drift severity:
   • Critical: Security group changes, IAM policy modifications → Immediate alert + manual review
   • High: Encryption settings, logging configuration → Approval workflow
   • Low: Tags, descriptions → Automatic remediation
2. Implement approval workflows for high-impact changes to prevent service disruptions
3. Track drift metrics by team/service to identify process issues requiring workflow improvements
4. Use drift as a signal for security incidents (unauthorized changes) vs. operational issues (emergency fixes)

​

Supply Chain Security

​

Image and Function Signing

1. Sign artifacts in CI/CD pipelines using build system credentials
2. Store signatures in registries alongside artifacts
3. Enforce signature verification via admission controllers (Kubernetes) or deployment policies
4. Rotate signing keys regularly with automated key management
5. Audit signature verification failures as potential supply chain attacks

• Prove artifacts were built through approved pipelines
• Detect tampering between build and deployment
• Prevent deployment of unsigned or invalidly signed artifacts

​

Provenance Attestations

• Source information: Repository URL, commit hash, branch
• Build parameters: Compiler flags, dependencies, build environment
• Security validations: SAST/DAST results, vulnerability scans, test coverage
• Builder identity: CI/CD system, build timestamp, builder credentials
• Cryptographic binding: Hash of source code → hash of artifact

1. Generate provenance during CI/CD builds using SLSA GitHub Generator or similar tools
2. Store attestations alongside artifacts in registries
3. Verify provenance before deployment using policy engines
4. Enforce minimum SLSA levels for production (recommend SLSA 3+)
5. Audit provenance for compliance and incident investigation

​

Registry Allowlisting

1. Allowlist approved registries:
   • Private registries (ECR, ACR, GCR, Harbor)
   • Approved public registries (Docker Hub verified publishers)
   • Internal artifact repositories (JFrog Artifactory, Nexus)
2. Implement image promotion workflows:
   • Scan public images for vulnerabilities
   • Sign approved images
   • Copy to private registry
   • Deploy only from private registry
3. Enforce registry policies via admission controllers or deployment gates

• OPA Gatekeeper for Kubernetes admission control
• Kyverno for Kubernetes policy management
• Cloud-native registry policies (ECR, ACR, GCR)

​

Runtime Policy Enforcement

• Prevent privileged containers: Block privileged: true in pod specs
• Restrict system calls: Allow only necessary syscalls via seccomp profiles
• Enforce network policies: Deny egress to public internet except approved endpoints
• Detect anomalous behavior: Alert on unexpected file modifications or network connections
• Require security contexts: Enforce non-root users, read-only root filesystems

​

Observability and Monitoring

​

Distributed Tracing

• Authentication context: User identity, session ID, authentication method
• Authorization decisions: Policy evaluation results, granted/denied permissions
• Data access patterns: Resources accessed, query parameters, response sizes
• Service dependencies: Call graphs revealing lateral movement paths
• Error conditions: Exceptions, failed authentications, authorization failures

​

Structured Logging

{
  "timestamp": "2025-10-19T14:32:15Z",
  "request_id": "req-abc123",
  "service": "payment-api",
  "level": "INFO",
  "user_id": "user-456",
  "event_type": "authorization_decision",
  "resource": "arn:aws:s3:::sensitive-bucket/data.csv",
  "action": "s3:GetObject",
  "result": "DENIED",
  "policy": "data-access-policy-v2",
  "reason": "insufficient_permissions"
}

• Authentication: Login attempts, MFA challenges, credential validation
• Authorization: Policy decisions, permission grants/denials, role assumptions
• Data access: Object reads/writes, query executions, export operations
• Configuration changes: IAM policy updates, security group modifications, encryption settings
• Error conditions: Exceptions, failed validations, rate limit violations

• ELK Stack (Elasticsearch, Logstash, Kibana)
• Splunk
• Datadog Logs
• AWS CloudWatch Logs
• Google Cloud Logging

​

Policy Decision Logging

• Security investigations: Reconstruct access patterns during incident response
• Compliance auditing: Demonstrate access controls for SOC 2, ISO 27001, HIPAA
• Policy debugging: Identify why access was unexpectedly granted or denied
• Anomaly detection: Detect unusual access patterns indicating compromise

​

Conclusion

​

References and Further Reading

​

Standards and Frameworks

• CNCF Security Technical Advisory Group - Cloud-native security whitepapers and best practices
• NIST SP 800-204 - Security Strategies for Microservices-based Application Systems
• OWASP Cloud-Native Application Security Top 10
• CIS Benchmarks - Cloud platform security configuration standards

​

Cloud Provider Security Guides

• AWS Security Best Practices
• AWS Serverless Security
• Azure Security Documentation
• Google Cloud Security Best Practices

​

Supply Chain Security

• SLSA Framework - Supply-chain Levels for Software Artifacts
• CNCF Software Supply Chain Best Practices
• Sigstore - Keyless signing for software artifacts
• in-toto - Supply chain integrity framework

​

Tools and Technologies

• CNCF Cloud Native Interactive Landscape - Comprehensive tool catalog
• Kubernetes Security Documentation
• OpenTelemetry - Observability instrumentation
• Open Policy Agent - Policy-based control