5.3 Security posture and the cloud threat model
You can list how a cloud account gets compromised and show that yours is defended against each.
Before:04. Networking in the CloudUnlocks:06. Containers & Kubernetes
The same thing, three names
One idea, sold under a different brand by each provider. Learn it once and you can read any job advertisement.
- On AWS
- CloudTrail + GuardDuty + Security Hub
- On Azure
- Defender for Cloud + Activity Log
- On Google Cloud
- Security Command Center + Cloud Audit Logs
Cloud accounts are compromised along a short list of paths — exposed storage, leaked keys, over-broad roles, unpatched images — and this topic is about defending each one deliberately and being able to show it. Logging every API call, tamper-evident audit trails, and vulnerability scanning are the standing machinery; posture tools sweep for the known mistakes. It sits mid-module because it assembles identity and secrets into an account-wide view. The confusion to drop is the exotic-attacker fantasy; the boring list above is how it actually happens.
Work through these
The real attack paths: exposed storage, leaked keys, over-broad roles, unpatched images
Cloud accounts are compromised in a small number of well-known ways: open storage, leaked credentials, permissions granted too broadly, and machines running unpatched software. Defending against the actual list beats defending against a vague sense of threat.
Logging every API call, and keeping those logs tamper-evident
Recording every action taken against the account, in a place the actor cannot edit, is what makes an investigation possible afterwards. Logs that can be deleted by an intruder are not evidence.
Vulnerability scanning and patch responsibility
Scanning finds known vulnerabilities, and who is responsible for applying the fix depends on where the shared responsibility line falls for that service. The scan is only useful if that question is answered.
Posture management tools and what they cannot see
Posture tools flag misconfiguration at scale, and what they cannot see is intent: a deliberately public container looks identical to an accidental one. Knowing the blind spot keeps the tool honest.
Sign in to keep your progress.
Free resources
We haven't checked most of these for screen reader use yet.
Links last checked 29 Aug 2026.
Stuck here?
Ask a mentor. A real person answers, and they can see exactly which topic you're on. Usually within a couple of working days.
Checking your session…
Topics shown in module order.