Cloud Security Fundamentals: IAM, RBAC, PoLP, and more…
Cybersec Café #74 - 07/01/25
We’re no longer “moving toward” the cloud. We’re already here.
Modern infrastructure lives in the cloud, and with that shift, understanding cloud security fundamentals is no longer optional for security practitioners.
It’s essential.
At its core, cloud computing is an on-demand, self-service model. Users can provision compute, storage, and services with just a few clicks. It essentially eliminates the need for heavy upfront hardware investment, enables agility, and supports a pay-as-you-go model that aligns cost with usage.
Cloud services typically come in three main flavors:
Infrastructure as a Service (IaaS): Provisioning and managing raw compute and storage resources.
Platform as a Service (PaaS): Deploying and scaling applications without managing the underlying infrastructure.
Software as a Service (SaaS): Consuming ready-to-use software over the internet.
The cloud-native architecture changes the game. Unlike on-prem environments, security in the cloud is a shared responsibility: cloud providers secure the infrastructure, but it’s on you to secure your data and applications.
Let’s walk through the key principles you need to know to build a secure and scalable foundation in the cloud.
Cloud Security Basics
What is IAM?
IAM, short for Identity and Access Management, refers to the framework of policies and technologies used to ensure that the right individuals and services have access to the right resources.
To grasp IAM, you need to first understand the differences between Authentication and Authorization:
Authentication is the process of verifying identity. It typically uses a username/password combo, MFA, or biometrics and looks to answer the question: “Who are you?”
Authorization determines what an identity can do. It dictates what resources they can access, what actions they’re allowed to perform, and looks to answer the question: “What are you allowed to do?”
IAM systems manage both of these functions and include several types of identities to help define a secure and scalable access model.
Users: Individual identities (human users) that can be assigned direct access.
Groups: Collections of users that make permission management easier by applying policies as scale.
Roles: Temporary identities that can be assumed by users or services, ideal for least-privilege, time-bound access.
Service Accounts: Non-human identities used by applications or automated processes to access resources.
Root Account: The god-mode entity. Avoid using this unless you’re in an emergency situation, and make sure you have proper alerting and monitoring. Leverage Service Accounts in its place.
At the core of IAM are policies. Typically written in JSON, policies define what actions are allowed or denied on which resources. Policies are attached to identities and evaluated by the cloud provider every time a request is made to determine if access should be granted.
Without strong IAM practices, everything else starts to fall apart.
What is RBAC?
Role-Based Access Control (RBAC) is a security model that governs access to resources based on a user’s role within an organization.
Instead of assigning permissions directly to individual users, RBAC assigns them to roles like Admin, Developer, or Read-Only. Users then get assigned these roles, making access management simpler, cleaner, and more scalable.
This method also has several “built-in” advantages:
Reduced risk of unauthorized access.
Streamlined permissions management.
Enhanced auditability for compliance.
Skipping RBAC, especially early on in your cloud journey, creates unnecessary risk. You may struggle to limit access cleanly, experience the nightmares of managing one-off permissions, or experience overly-permissive or conflicting access creep in over time.
So don’t wait. Think about RBAC from day one and save yourself the future tech debt.
What is PoLP?
The Principle of Least Privilege (PoLP) is a foundational security concept and practice that says users, systems, applications, and processes should only have the minimum level of access necessary to perform their functions or tasks.
In layman’s terms: you only get the permissions you need.
PoLP is crucial in cloud environments because of how dynamic and distributed they are. The more access you hand out, the larger your attack surface becomes.
By instilling the PoLP across your environment, you reduce risk of:
Insider Threat: Only those who absolutely need access to sensitive data or systems have it, minimizing the damage a rogue or compromised insider can do.
Lateral Movement: If an attacker compromises a single account, PoLP prevents them from pivoting freely across the environment.
In practice, PoLP means applying fine-grained policies, scoped roles, and tight permissions to everything from standard users, to service accounts, to admin roles.
What is IaC?
Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure using code instead of manual processes.
Rather than clicking through a UI or running ad-hoc commands, you define your infrastructure in configuration files - bringing consistency, repeatability, and scalability to your cloud deployments.
IaC dramatically reduces the risk of misconfigurations by making infrastructure changes auditable, version-controlled, and testable.
Beyond reliability, it unlocks engineering benefits like CI/CD integration, change control, code reviews, and standardized templates.
Popular IaC tools include Terraform, OpenTofu, and ansible.
Prepare for a career in Cybersecurity, one sip at a time with The Security Sip. With rapidly evolving threats and technologies, many struggle to gain the right skills and experience to break into the cybersecurity industry. This course is designed to transform beginners into industry-ready professionals over 12 sections, 85 modules, and 155 exercises. Check it out!
Logging and Monitoring in the Cloud
With the scale and complexity of modern cloud environments, building a comprehensive logging and monitoring strategy is crucial.
A well-structured approach will not only allow you to detect and respond to security incidents quickly, but also gives you visibility into baseline behaviors, user activity, and system configurations (see Tuning Detections isn’t Hard Unless You Make it Hard for more).
Every major cloud provider offers its own flavor of audit logging services, but they all serve the same core purpose: capturing valuable operational data such as authentication events, access activity, resources changes, system and application logs, network traffic insights, and more.
They also have threat detection services meant to continuously monitor your accounts and identify potential threats, which produce logs of their own.
The good news? Nowadays, these logs are typically easy to integrate into your SIEM, even across multiple cloud accounts - exactly the architecture you’ll want for centralized monitoring and alerting.
But just keep in mind: cloud providers are great at scale, but log searchability, alerting, and real-time analysis usually isn’t their strong suit. But that’s where your SIEM thrives as that next, customizable layer.
So, before you start shipping your logs over at scale, make sure you’ve got some actionable detections in place so that your SIEM is ready to provide value.
Incident Response (IR) and Disaster Recovery (DR)
Incidents happen. And being prepared is what ensures rapid containment and smooth recovery.
But when you’re operating in the cloud, traditional incident response plans aren’t always enough. Cloud infrastructure introduces new variables (ephemeral resources, multi-region services, third-party dependencies) that standard IR playbooks may not account for. So, it’s critical to tailor your response plans to the specific complexities of your cloud environment.
The same goes for Disaster Recovery. Your DR strategy should focus on business continuity - restoring critical infrastructure, data, and applications quickly and efficiently after a disaster.
To do that well:
Build flexible and scalable recovery solutions. For mission critical systems, consider cross-region replication to protect against regional outages.
Automate backup creation and storage. Set a schedule for regular snapshots and backups, but automate where possible to reduce manual overhead and increase consistency.
Test your backups regularly. An untested backup is just a false sense of security. Validate that your backup and restore processes work as expected.
Store encrypted backups in separate regions or accounts. This adds a layer of protection, helping prevent unauthorized access to both production and backup data.
When done right, your cloud IR and DR strategies should scale with your environment, adapt to the technologies in play in your environment, and reduce your mean time to recover when things go sideways.
Security Controls
Security Controls are the backbone of enforcing policy in your cloud environment. They fall into three main categories, each serving a distinct purpose in your defensive strategy:
Preventative: These are measures designed to stop security incidents before they happen. Think IAM, RBAC, PoLP - all fundamental to Access Controls. But they also include network segmentation, firewalls, and intrusion prevention systems. Their job is to reduce risk at the gate.
Detective: These kick in after an event has occurred. Their purpose is to identify, log, and report suspicious or malicious activity. Think logging, monitoring, and alerting - your second line of defense when something slips through the cracks.
Corrective: These focus on limiting damage and restoring systems to a secure state after an incident. Think incident response plans, disaster recovery, patch management, and forensics. When the worst happens, corrective controls help you bounce back.
See how it all starts to fit together?
Cloud security isn’t about any single control. It’s about layering them so they work together to protect, detect, and respond.
Additional Best Practices
Encryption
Most cloud providers enable encryption by default, but you should still understand the basics:
Encryption at Rest: Secures data stored on disks, databases, and object storage.
Encryption in Transit: Protects data as it moves between systems, services, and users.
Use a Key Management System (KMS) to securely manage, rotate, and audit your encryption keys, Don’t just set it and forget it - make sure your key lifecycle is tightly controlled.
MFA
Enable Multi-Factor Authentication everywhere. Across all user accounts, admin interfaces, and especially privileged roles.
When possible, avoid SMS and opt for passwordless systems (i.e. biometrics combined with SSO and OTPs) or FIDO hardware.
Explore enabling adaptive MFA too based on user context like device, location, and behavior.
Tags and Labels
Define a consistent tagging strategy for your cloud resources.
It helps to establish clear ownership, track costs easier, and increase operational efficiency.
Automate tags wherever possible through IaC templates or provisioning workflows to maintain consistency across environments.
Secure Network Boundaries
If you have the bandwidth, apply network segmentation to break your infrastructure into isolated zones. This limits lateral movement in the event of a breach.
Tighten things further with:
Private subnets to reduce public exposure
Firewall rules to control ingress and egress traffic
Network ACLs and Security Groups that minimize open ports. (Avoid 0.0.0.0/0 at all costs, unless you’ve got a rock-solid business case!)
Every entry point in your network should be deliberate.
Just Scratching the Surface
The cloud is extremely complex, and while these are certainly some of the most useful fundamentals, we’re really just scratching the surface.
At its core, many of the key cloud security principles boil down to IAM, RBAC, and PoLP.
By applying the Principle of Least Privilege and typing permissions to well-defined roles, you avoid operational chaos and build a more secure environment with the legs to scale.
Mastering the cloud isn’t optional anymore, it’s essential for today’s security practitioners. So give it the attention that it deserves.
Securely Yours,
Ryan G. Cox
Just a heads up, The Cybersec Cafe's got a pretty cool weekly cadence.
Every week, expect to dive into the hacker’s mindset in our Methodology Walkthroughs or explore Deep Dive articles on various cybersecurity topics.
. . .
Oh, and if you want even more content and updates, hop over to Ryan G. Cox on Twitter/X or my Website. Can't wait to keep sharing and learning together!