Cloud Security Architecture

Cloud service models (IaaS, PaaS, SaaS) and deployment models (public, private, hybrid, multi-cloud), Shared responsibility model across providers (AWS, Azure, GCP), Cloud security principles (CIA triad extension, defense-in-depth), Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM), NIST SP 800-53 cloud controls, Threat landscape (misconfiguration, IAM abuse, data exfiltration).

Identity federation (SAML, OIDC, SCIM), Multi-factor authentication (MFA) enforcement, Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), AWS IAM policies/service control policies, Azure AD/Entra ID PIM, GCP IAM/service accounts, Least privilege principle, Break-glass accounts and privileged access workstations, Cloud Access Security Brokers (CASB).

Virtual Private Clouds (VPCs) and subnet segmentation, Hub-and-spoke/landing zone architectures, Network Access Control Lists (NACLs) and Security Groups, AWS Transit Gateway/VPC peering, Azure Virtual WAN/Hub-Spoke, GCP Shared VPC/VPC Peering, Web Application Firewalls (WAF), DDoS protection services, Zero Trust Network Access (ZTNA), Micro-segmentation strategies.

Data classification and labeling, Encryption at rest (server-side, client-side), Key Management Services (AWS KMS, Azure Key Vault, GCP KMS), Envelope encryption and customer-managed keys, Data Loss Prevention (DLP) policies, Secure object storage (S3 bucket policies, private endpoints), Database encryption (TDE, column-level), Data residency and sovereignty compliance.

Cloud Security Posture Management (CSPM), Infrastructure as Code (IaC) security (Terraform Sentinel, CloudFormation Guard), Logging and monitoring (CloudWatch, Azure Monitor, Cloud Logging), SIEM integration and centralized aggregation, Continuous compliance auditing (AWS Config, Azure Policy, GCP Organization Policies), DevSecOps integration (shift-left security), Incident response in cloud environments.