What Is Cloud Security? IAM, Shared Responsibility, and Cloud Threats Explained

Cloud security is the set of policies, controls, procedures, and technologies that protect cloud-based infrastructure, applications, and data. As organisations move workloads from on-premises data centres to AWS, Azure, Google Cloud, and other providers, they gain flexibility and scalability — but also take on new security responsibilities that differ fundamentally from traditional IT security.

The Shared Responsibility Model

The most important concept in cloud security. Every major cloud provider uses a shared responsibility model that divides security duties between the provider and the customer.

AWS Shared Responsibility Model (example)

| AWS is responsible for | Customer is responsible for | |---|---| | Physical security of data centres | Customer data | | Hardware and network infrastructure | Identity and access management (IAM) | | Hypervisor and virtualisation layer | Operating system patching (EC2) | | Managed service infrastructure (e.g. RDS engine) | Application-level security | | Global network backbone | network configuration-dynamic-host-configuration-protocol-explained) (security groups, NACLs) | | | encryption of data at rest and in transit | | | compliance-PCI-DSS-cybersecurity-compliance-frameworks-explained) with applicable regulations |

Security of the cloud (provider's job) vs security in the cloud (customer's job).

The most common cloud breaches happen because customers fail to properly configure the things they are responsible for — not because of provider failures.

Identity and Access Management (IAM)

IAM is the cornerstone of cloud security. It controls who (humans and machines) can do what, to which resources, under what conditions.

Core IAM Concepts

Principal: An entity that can make requests — an IAM user, role, group, or service account-Kerberos-directory-services-explained).

Policy: A document that defines permissions. In AWS, policies are JSON documents attached to principals:

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:aws:s3:::my-bucket/*"
}

Role: An IAM identity with permissions that can be assumed by a principal. Roles are used for cross-account access, EC2 instance permissions, Lambda function permissions, and more. Prefer roles over long-lived access keys.

Principle of least privilege: Grant only the minimum permissions required to perform a task. The single most impactful IAM security control.

IAM Security Best Practices

• Enable MFA-explained) on all human IAM accounts, especially root/admin
• Avoid long-lived access keys — use roles and short-lived tokens instead
• Delete the root account access key in AWS immediately after setup
• audit IAM permissions regularly — IAM Access Analyzer and tools like Cloudsplaining identify excessive permissions
• Use service control policies (SCPs) in AWS Organizations to set guardrails across all accounts

Top Cloud Security Threats

1. Cloud Misconfiguration

The leading cause of cloud breaches. Examples:

• S3 bucket with public read access containing sensitive data
• security group-Kerberos-directory-services-explained) allowing 0.0.0.0/0 inbound on [port-the-internets-core-protocol)-and-UDP-ports-explained) 22](/learning-center/what-is-a-port-tcp-and-udp-ports-explained) (SSH open to the internet)
• Database snapshot made publicly accessible
• IAM policy with wildcard permissions (Action: , Resource: )

Tools: AWS Config, Azure Policy, GCP Security Command Center, CSPM (Cloud Security Posture Management) tools like Wiz, Prisma Cloud, or Orca scan for misconfigurations continuously.

2. Insecure APIs

Cloud applications expose APIs that can be exploited if not properly secured — missing authentication, overly permissive CORS-security-headers-cors-CSP-HSTS-explained), no rate limiting-attack-distributed-denial-of-service-explained), or verbose error messages.

3. Compromised Credentials

Leaked or stolen IAM access keys, service account-Kerberos-directory-services-explained) credentials, or OAuth-explained) tokens. Attackers scan public GitHub repositories for hardcoded cloud credentials constantly.

Tools: AWS Secrets Manager, HashiCorp Vault, GitHub secret scanning.

4. Insufficient Logging and Monitoring

Without proper logging (AWS CloudTrail, Azure Monitor, GCP Cloud audit Logs), security incidents go undetected. Logs must be centralised, tamper-protected, and monitored for anomalies.

5. Data Exfiltration

Attackers with access to cloud storage or databases can exfiltrate large volumes of data quickly. Data Loss Prevention (DLP) controls and network egress monitoring are essential.

Container Security

Containers (Docker) package applications with their dependencies and run consistently across environments. Kubernetes orchestrates containers at scale.

Key Container Security Controls

Image security:

• Scan images for known CVEs using tools like Trivy, Snyk, or AWS ECR scanning
• Use minimal base images (Alpine, distroless) to reduce attack surface-cves-exploits-and-patch-management)
• Never run containers as root — use non-root users
• Sign images and enforce image signing policies

Runtime security:

• Implement Pod Security Standards in Kubernetes (restrict privileged containers)
• Use network policies to control pod-to-pod communication
• Enable runtime threat detection-security-operations-centre-SIEM-incident-response-explained) (Falco, Aqua Security)

Supply chain:

• Use only trusted base images from verified registries
• Pin image versions with digests, not just tags
• audit Dockerfile and Kubernetes manifests in CI pipelines

Serverless Security

Serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) run code without managing servers. New attack surface-cves-exploits-and-patch-management) considerations:

• Function permissions: Each function should have an IAM role with only the permissions it needs
• Dependency vulnerabilities: Serverless packages include third-party libraries — scan them for CVEs
• Injection attacks: Functions that process untrusted input are vulnerable to SQL injection, command injection
• Timeout and resource abuse: Without proper limits, functions can be abused for crypto mining or DDoS

DevSecOps: Shifting Security Left

DevSecOps integrates security into the CI/CD pipeline rather than adding it as a final gate before production:

Code → SAST (static analysis) → Build → Dependency scan → Test → 
Container scan → Deploy → DAST (dynamic scan) → Monitor

Key DevSecOps practices:

• Infrastructure as Code (IaC) scanning — scan Terraform/CloudFormation templates for misconfigurations before deployment (Checkov, tfsec)
• Secrets detection — block hardcoded credentials from entering version control (git-secrets, Gitleaks)
• SAST — static application security testing in CI (Semgrep, Checkmarx)
• DAST — dynamic testing against running applications (OWASP-web-application-attacks-explained) ZAP, Burp Suite)

Cloud Security Posture Management (CSPM)

CSPM tools continuously monitor cloud environments for misconfigurations and compliance-PCI-DSS-cybersecurity-compliance-frameworks-explained) violations. They:

• Compare current configuration against security best practices (CIS Benchmarks, NIST)
• Alert on publicly exposed resources
• Track compliance-PCI-DSS-cybersecurity-compliance-frameworks-explained) against GDPR, PCI-DSS, HIPAA, ISO 27001
• Provide remediation guidance

Enterprise CSPM tools: Wiz, Palo Alto Prisma Cloud, Microsoft Defender for Cloud, Orca Security.

Key Takeaways

• The shared responsibility model defines the boundary: cloud providers secure the infrastructure; customers secure their data, configuration, and access controls
• IAM is the most critical cloud security control — apply least privilege and use roles over long-lived keys
• Cloud misconfiguration (exposed S3 buckets, open security groups, wildcard IAM policies) is the top cause of cloud breaches
• Container security requires scanning images, enforcing non-root execution, and restricting network access between pods
• DevSecOps shifts security into the development pipeline — catching issues before they reach production
• CSPM tools provide continuous visibility into cloud security posture and compliance-PCI-DSS-cybersecurity-compliance-frameworks-explained)