Cloud Security
Definition
Cloud security addresses attack surfaces unique to public cloud: globally shared resource namespaces, public control-plane APIs, and instance-level credential services. Three catastrophe patterns recur — resource hijacking, credential disclosure via SSRF, and auth-model gaps.
Core Ideas
Resource hijacking (dangling resources)
Global namespaces (e.g. S3 bucket names) are unique — delete a bucket and someone else can claim the name, hijacking any DNS still pointing to it. Mitigation: keep DNS and cloud resources in sync to avoid dangling references (see can-i-take-over-xyz).
SSRF against the metadata service
Cloud instances read config (SSH keys, IAM credentials) from an internal metadata service — AWS http://169.254.169.254/latest/meta-data/, GCP metadata.google.internal (needs a Metadata-Flavor header), Azure, Oracle, Alibaba, and Kubernetes all have equivalents. A Server-Side Request Forgery (via XML parsing, PDF/image conversion, proxying, uploads, or webhooks) can trick the server into fetching .../iam/security-credentials/[ROLE] and leaking credentials.
Mitigation: don’t put API keys in user-data scripts; IP-restrict credential use via IAM; proxy/whitelist access to the metadata service; alert on credentials used from unknown sources.
Auth-model gaps
Gaps in understanding cloud auth models create authorization holes. Mitigation: enforce MFA (e.g. via AssumeRole), use credential report and access advisor, and tighten VPC ACLs and S3 bucket policies.
Relationships
- JSON Web Token (JWT) — leaked tokens/credentials are a primary target
- OWASP Top 10 — SSRF and access-control failures are top web risks
- Kubernetes — cluster metadata and service endpoints are attack surfaces
- Agentic Cyber Attack — the July 2026 Hugging Face intrusion ran this playbook autonomously, at machine speed
- Phishing and Brand Trust — the human side: a trusted channel defeating a security-literate victim
- Cloud & AWS Infrastructure