GIAC Cloud Security Architecture and Design

Identity is the main control surface in cloud. You design roles and trust policies across providers, separate human from workload access, and scope permissions so that one stolen credential cannot reach everything.

• Roles, policies and how trust is expressed
• Cross-account and cross-subscription access
• Human access compared with workload access
• Least privilege design and permission boundaries
• Service principals and managed identities
• Reviewing and reducing excess permissions

You build A role and trust design that grants a team access across several accounts without shared long-lived keys.

Users and workloads should not need a new identity for every platform. You connect identity providers to clouds with SAML and OpenID Connect, design workload federation, and decide how sessions, groups and attributes flow between systems.

• SAML federation: assertions, trust and claims
• OpenID Connect and OAuth for cloud access
• Workload identity federation for pipelines and services
• Group and attribute mapping to roles
• Session lifetime and revocation
• Federation failure modes and break-glass access

You build A federation design that connects one identity provider to two cloud platforms, with diagrams of each trust step.

Access decisions should use context, not only a password. You design conditional access policies that weigh user, device and risk, and plan identity for customers, whose needs and threats differ from those of staff.

• Conditional access signals and policy design
• Device compliance and session controls
• Multifactor and phishing-resistant methods
• Customer identity and access management patterns
• Account recovery, fraud and abuse
• Testing policies before enforcement

You build A conditional access policy set for staff and a separate design for a customer identity service.

Networks in cloud are software, so design choices are quick to make and slow to undo. You consolidate shared services behind gateways and endpoints, run large estates on shared networks, and decide where traffic is inspected and by what.

• Hub-and-spoke and shared network patterns
• Gateways, private endpoints and service access
• Shared virtual networks and subnet design
• Cloud firewalls and layered filtering
• Load balancing and exposure of public services
• Traffic inspection and mirroring in cloud

You build A network architecture for a multi-account estate, with the inspection points and rule ownership marked.

Flat cloud networks turn one breach into many. You apply zero trust concepts to workloads and users and use micro-segmentation to limit lateral movement, balancing the policy effort against the protection gained.

• Zero trust architecture concepts for cloud
• Identity-based compared with network-based segmentation
• Micro-segmentation with security groups and tags
• Service-to-service authentication
• Rolling out segmentation without breaking applications
• Validating that segments hold

You build A segmentation design for a three-tier application, with the rules and a test plan that proves them.

Data is what the architecture exists to protect. You apply data security frameworks, defend storage and databases with access lists, encryption and monitoring, and design disaster recovery that fits the data’s value.

• Data security frameworks for cloud
• Securing object storage, databases and file services
• Access lists and policy for data stores
• Encryption at rest and in transit as design choices
• Monitoring access to sensitive data
• Backup, replication and disaster recovery design

You build A data protection architecture for three data stores of different sensitivity, with recovery targets.

Encryption is only as strong as the way its keys are handled. You design key hierarchies and management services for cloud, decide who controls keys, and plan rotation, access and recovery.

• Key management services and hardware-backed keys
• Customer-managed compared with provider-managed keys
• Key hierarchy and envelope encryption
• Separation of duties for key administration
• Rotation, revocation and recovery
• Multi-region and multi-cloud key strategy

You build A key management architecture, with key hierarchy, ownership and rotation plan.

Responders cannot investigate what was never collected. You design how cloud-native logs are staged, aggregated and forwarded, and how security operations teams gain access to the data without gaining access to the workloads.

• Cloud-native log sources and their gaps
• Central log accounts and staging
• Aggregation, normalization and forwarding
• Retention, integrity and cost
• Alerting design for cloud events
• Access for SOC and incident response teams

You build A logging architecture that collects from multiple accounts into one protected location, with SOC access rules.

Bring structure, identity, network, data, keys and logging into one design. You work from requirements to a reference architecture, justify each choice against alternatives, and document it so that other teams can reuse it.

• Collecting requirements and constraints
• Choosing patterns for identity and network
• Designing data, key and logging controls
• Handling differences between providers
• Documenting the design for reuse

You build A cloud security reference architecture with design decisions and the alternatives rejected.