Securing the cloud, containers and the supply chain

Two ways into the same idea

Before You Start

The Core Idea

1Who is responsible for what?

The higher you climb from IaaS to SaaS the more layers the provider takes, but three things always stay with you: your data, your identities and your settings. Most published cloud incidents sit in these three.

2Identity is the new perimeter

In the cloud everything is an API, and every API is called with an identity. So an attacker holding a key for an identity with * owns the whole account. The rules: no permanent keys in code or on laptops (temporary roles instead), no wildcard in actions or resources, MFA for every human, and the root account locked away and unused. Automatic review catches what the eye misses:

Tools such as IAM Access Analyzer and CSPM do this for every policy in the account, every day.

import json

policy = json.loads("""{
  "Version": "2012-10-17",
  "Statement": [
    {"Sid": "ReadReports", "Effect": "Allow", "Action": ["s3:GetObject"],
     "Resource": "arn:aws:s3:::finance-reports/*"},
    {"Sid": "QuickFix", "Effect": "Allow", "Action": "s3:*", "Resource": "*"},
    {"Sid": "Admin", "Effect": "Allow", "Action": "*", "Resource": "*"},
    {"Sid": "PassAny", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*"}
  ]
}""")

def listify(x):
    return x if isinstance(x, list) else [x]

for st in policy["Statement"]:
    if st["Effect"] != "Allow":
        continue
    actions, resources = listify(st["Action"]), listify(st["Resource"])
    problems = []
    if "*" in actions:
        problems.append("CRITICAL every action: full admin")
    elif any(a.endswith(":*") for a in actions):
        problems.append("HIGH every action of a service")
    if "*" in resources:
        problems.append("HIGH every resource")
    if "iam:PassRole" in actions and "*" in resources:
        problems.append("HIGH can hand any role to a service: privilege escalation")
    print(f"{st['Sid']:<12}", "; ".join(problems) or "ok: narrow action and resource")

3Containers and Kubernetes

A container is not a virtual machine: they all share one kernel. A container running as root with special privileges may escape to the host and reach every other container. That is why Kubernetes set three levels: Privileged (no limits, for system tools only), Baseline (blocks the most dangerous settings) and Restricted (best practice, your target for every ordinary app). The level is enforced by a label on the namespace: pod-security.kubernetes.io/enforce: restricted.

A single Baseline violation is enough for the pod to be rejected in a namespace enforcing Baseline or Restricted.

pod = {   # a pod spec as the cluster sees it, simplified
    "name": "reports-api",
    "hostNetwork": True,
    "containers": [{
        "name": "api", "image": "registry.local/reports:latest",
        "securityContext": {"privileged": False, "runAsNonRoot": False,
                            "allowPrivilegeEscalation": True,
                            "capabilities": {"add": ["NET_ADMIN"]}},
    }],
}

def check(pod):
    out = []
    if pod.get("hostNetwork"):
        out.append(("baseline", "hostNetwork shares the node's network"))
    for c in pod["containers"]:
        sc = c.get("securityContext", {})
        if sc.get("privileged"):
            out.append(("baseline", f"{c['name']}: privileged container"))
        if sc.get("capabilities", {}).get("add"):
            out.append(("baseline", f"{c['name']}: adds {sc['capabilities']['add']}"))
        if not sc.get("runAsNonRoot"):
            out.append(("restricted", f"{c['name']}: may run as root"))
        if sc.get("allowPrivilegeEscalation", True):
            out.append(("restricted", f"{c['name']}: privilege escalation allowed"))
        if "ALL" not in sc.get("capabilities", {}).get("drop", []):
            out.append(("restricted", f"{c['name']}: capabilities not dropped"))
        if not sc.get("seccompProfile"):
            out.append(("restricted", f"{c['name']}: no seccomp profile"))
        if c["image"].endswith(":latest"):
            out.append(("advice", f"{c['name']}: pin the image by digest, not :latest"))
    return out

for level, msg in check(pod):
    print(f"[{level:<10}] {msg}")

On top of that: least-privilege RBAC (do not give cluster-admin to a service account), a NetworkPolicy that denies all traffic by default then allows only what is needed, secrets in a secrets manager rather than plain variables, and images from a trusted registry, signed and pinned by digest.

4The supply chain: every line you did not write

Your modern app holds hundreds of open-source packages, each a possible door. Three questions: what is in my software? (an SBOM: a component list in SPDX or CycloneDX, compared against vulnerability lists). Who built it, and how? (SLSA: levels proving the build ran on a trusted platform and was not altered). Is it the same thing I received? (signing with Sigstore and verifying before deploying).

Worked example

The task: a CSPM alert: a storage bucket holding customer database backups became public two hours ago, and the logs show the CI/CD role with s3:* on * changed the policy. What do you do now, and what do you change after?

The answer: Now: shut public access (Block Public Access at account level), preserve the CloudTrail logs and the bucket access logs as evidence, and search them: did anyone outside the company download anything in those two hours? If yes, it is a personal data breach to be reported (under the PDPL: within 72 hours). Root cause: the CI/CD role holds far more permission than it needs, and the change skipped review. After: narrow the role to the buckets and actions it needs, make infrastructure as code (Terraform) pass a policy check before merge, lock public access with an organisation policy no role can override, and make this CSPM alert reach an on-call person within minutes, not two hours.

Myth vs Reality

Where you meet it at work

Test your understanding

Quick review cards

Check Your Understanding