Lesson 5 — Cloud Security and Shared Responsibility

Shared responsibility

A split of security duties between provider and customer.

IAM

Identity and Access Management — who can do what to which resource.

Least privilege

Granting only the permissions strictly needed, for as short a time as possible.

Misconfiguration

An insecure setting, e.g. a public bucket — the top cause of cloud breaches.

Audit log

An immutable record of API actions used for detection and forensics.

A researcher emails: your school's exam scans are downloadable by anyone.

1. 1Contain: Block public access at the account level, not just on that one bucket.
2. 2Assess: Read the access logs: which objects were fetched, by which IPs, and when?
3. 3Attribute: Check the audit trail for the IAM identity that changed the policy, and why.
4. 4Prevent: Add a guardrail policy that denies public ACLs, plus an alert when one is attempted.
5. 5Report: Personal data exposed means a data-protection notification duty with a legal deadline.

json{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::school-results-2026/reports/*",
    "Condition": {
      "Bool": { "aws:SecureTransport": "true" }
    }
  }]
}

Read-only, one prefix of one bucket, HTTPS only. Compare with the tempting one-liner `"Action": "s3:*", "Resource": "*"` — which hands an attacker the whole account if the credential leaks.