Cloud & IAM Security
Identity → policy → action → resource. Machine identities, short-lived credentials, and the full lifecycle of a secret from creation to revocation.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Cloud security is identity and policy first, then reachable networks, resource policies, secrets, encryption and evidence.
An IAM decision binds a principal, action, resource and conditions; a wildcard in any dimension expands blast radius.
People, services, CI/CD, agents and automation need separate identities so access can be scoped, attributed and revoked independently.
A workload exchanges its identity for a temporary credential that expires, reducing the useful lifetime of theft and eliminating manual rotation.
A secret should not live everywhere: applications retrieve or receive narrowly scoped values from a controlled system with audit and rotation.
Create → store → distribute → use → rotate → revoke → audit: weakness in any stage determines the effective protection.
A committed .env file or secret baked into an image turns version control and every image copy into credential stores.