Guardrails in the Cloud
summary
Cloud adoption accelerates security risk—digital strategies compress six years into one—and the concrete guardrails are: use AWS Organizations and SCPs to centrally block actions (deny root, deny leaving the org, deny creating access keys, restrict services and regions); split workloads into multiple accounts to limit blast radius; enforce IAM least privilege using Policy Sentry and scan existing policies with tools like aws-escalate; apply tagging for ABAC plus automation to remediate open security groups and stale resources; enable GuardDuty machine learning on CloudTrail/VPC/DNS logs and use IaC (Terraform) and IMDSv2.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:08Current cloud landscape
- 9:53Organizations and SCPs
- 20:22Multi-account strategy
- 23:33Least privilege IAM
- 28:51Automation with tagging
- 34:32Threat detection with GuardDuty
- 40:07Best practices recap
- 42:16Q&A and closing
related talks
58mCreate enterprise-wide preventive guardrails
55mModernizing your security and GRC strategy with AWS
25mUse lessons learned from the field to build for security
17mAdvance securely: Safely migrating to
01h 02mStrong security made simple: Putting all the pieces together
44mAchieve your identity, security, and compliance goals on
27mIntroduction to AWS Security
45mProtecting you from you: Misconfiguration-caused breaches