Cloud Security for Developers

Overview of the course, learning objectives and syllabus.

Where the cloud provider's security responsibility ends and yours begins -- and the incidents that result from misunderstanding the boundary.

How overprivileged IAM roles amplify small compromises into full account breaches, and why the platform credential chain eliminates the need for hardcoded keys.

A file processor service passes user input directly to a shell command. Exploit the command injection vulnerability to exfiltrate the workload's cloud identity credentials -- from Lambda environment variables on AWS and from the instance metadata service on Azure and GCP. Use those credentials from your own machine to demonstrate the full scope of access granted by an admin-level role. Then scope the identity to the minimum permissions the application actually requires.

The most common insecure patterns in Terraform configuration, why AI code generation reproduces them reliably, and how static analysis catches them before deployment.

How public subnets, permissive firewall rules, and the misunderstood boundaries of Kubernetes namespaces expose cloud resources -- and how SSRF turns a web vulnerability into credential theft via the instance metadata endpoint.

A link preview service accepts any URL the caller supplies and fetches it server-side. Exploit the SSRF vulnerability to reach the cloud instance metadata endpoint, retrieve the IAM role credentials, and use them outside the cloud environment. Then fix the two infrastructure misconfigurations that make the exploit dangerous: the metadata endpoint accepting unauthenticated requests, and the attached identity holding far more access than the application needs.

The two-layer access control model for object storage on all three platforms, how SAS tokens and presigned URLs are misconfigured, and what the Microsoft AI Research incident reveals about scope.

A documentation site was deployed on cloud object storage and access controls were disabled to resolve an Access Denied error during setup. A database credentials file was later uploaded alongside the public docs. Exploit the misconfigured storage to list the bucket contents and retrieve the credentials file without any authentication. Then fix the storage configuration to block all anonymous access.

Unauthenticated function triggers, overprivileged execution roles shared across multiple functions, event injection, and secrets stored in environment variables.

Which audit trails to enable, the difference between management and data events, how to isolate logs from the account they describe, and what cloud-native detection services add beyond manual alerting.