Infrastructure and Cloud Security
Section focus: Infrastructure and Cloud Security.
Best use: start with the section map below, then move into the deeper pages that match your role or stack.
Design note: this index was refreshed to act as a cleaner GitBook landing page instead of a plain directory listing.
Start with these pages
| Page | Why open it first |
|---|---|
| AWS IAM and Role Design | High-value page inside Infrastructure and Cloud Security. |
| AWS IAM Snippet Pack | High-value page inside Infrastructure and Cloud Security. |
| ☁️ Cloud Security Across AWS, Azure, and GCP | High-value page inside Infrastructure and Cloud Security. |
| 🟧 AWS Security Baseline and Top Misconfigurations | High-value page inside Infrastructure and Cloud Security. |
| 🟦 Azure Security Baseline and Top Misconfigurations | High-value page inside Infrastructure and Cloud Security. |
| 🟨 GCP Security Baseline and Top Misconfigurations | High-value page inside Infrastructure and Cloud Security. |
| 🧱 Terraform Security Scanning and Checkov | High-value page inside Infrastructure and Cloud Security. |
| 🛡️ Security as Policy for Terraform and Infrastructure as Code | High-value page inside Infrastructure and Cloud Security. |
| 🔐 Mozilla SOPS: age, KMS, and GitOps-Friendly Secret Workflows | High-value page inside Infrastructure and Cloud Security. |
| 🛡️ AWS WAF — Practical Baseline for Managed Rules, Rate Limits, and Logging | High-value page inside Infrastructure and Cloud Security. |
| 🔐 Internal PKI for Microservices — mTLS, Certificate Automation, and Trust Distribution | High-value page inside Infrastructure and Cloud Security. |
| 🔑 AWS and Azure KMS / HSM Key Management Patterns | Practical patterns for key hierarchy, envelope encryption, rotation, usage separation, and KMS/HSM operations. |
| ☁️ Cloud Environment Security — IAM, Network, Storage, Service Configurations, Visibility, Posture, and Blast Radius | High-value page inside Infrastructure and Cloud Security. |
| 🧱 Apache, NGINX, Kafka, Redis, MySQL, MariaDB, and RabbitMQ Hardening | Practical hardening map across web, messaging, cache, and database layers, including privileged-user oversight. |
| 🗄️ Database Activity Monitoring, Immutable Logging, and Privileged Session Management | Practical control model for database evidence, WORM storage, and admin-session oversight. |
Related sections
Intro: This section ties identity, infrastructure as code, cloud posture, Linux, and secret management into one operator-friendly track. The goal is to keep the narrative anchored in repeatable controls and repeatable failure modes.
What this page includes
- IAM and cloud posture across AWS, Azure, and GCP
- Terraform scanning and policy-as-code
- Linux and automation baselines
- cross-links into new architecture, identity, and detection sections
☁️ Core pages in this section
- AWS IAM and Role Design
- AWS IAM Snippet Pack
- ☁️ Cloud Security Across AWS, Azure, and GCP
- 🟧 AWS Security Baseline and Top Misconfigurations
- 🛡️ AWS WAF — Practical Baseline for Managed Rules, Rate Limits, and Logging
- 🔐 Internal PKI for Microservices — mTLS, Certificate Automation, and Trust Distribution
- 🔑 AWS and Azure KMS / HSM Key Management Patterns
- ☁️ Cloud Environment Security — IAM, Network, Storage, Service Configurations, Visibility, Posture, and Blast Radius
- 🧱 Apache, NGINX, Kafka, Redis, MySQL, MariaDB, and RabbitMQ Hardening
- 🗄️ Database Activity Monitoring, Immutable Logging, and Privileged Session Management
- 🟦 Azure Security Baseline and Top Misconfigurations
- 🟨 GCP Security Baseline and Top Misconfigurations
- 🔗 Attack Paths and Misconfigurations
- 🧱 Terraform Security Scanning and Checkov
- 🛡️ Security as Policy for Terraform and Infrastructure as Code
- 🧱 Infrastructure as Code Maturity and Test Strategy
- Terraform Snippet Pack
- 🧱 Terraform Top 10 Misconfigurations
- 🐧 Linux Base Image and Host Security Baseline
- 🤖 Ansible Security Baseline and Top 10 Misconfigurations
- 🤖 Ansible for EC2 Host Security: 7 High-Value Tasks That Actually Matter
- 🐧 Linux Host Security: Top 10 Misconfigurations and a Fast Audit Playbook
- 🔐 Secret Management on HashiCorp Vault
- 🔐 Mozilla SOPS: age, KMS, and GitOps-Friendly Secret Workflows
- Vault Installation, HA, and Automation Pack
- 🛰️ Cloud Auditing by API and Configuration State
- 🛰️ Cloud Audit Cookbook by Provider
- 🔎 Semgrep for Cloud Security and Infrastructure as Code
Cross-links
- CI/CD and Software Supply Chain Security
- Container and Kubernetes Security
- 🪪 Identity and Platform Access
- 🏗️ Secure Architecture Patterns
Author attribution: Ivan Piskunov, 2026 - Educational and defensive-engineering use.