Cloud Fundamentals Capstone
Reconstruct cloud attack paths, rank account control gaps, and deliver a testable remediation plan.
Brief
Northwind Freight exports its production cloud account before a customer assurance review. The export contains an administrator credential used last night, an internet-facing database, an anonymously readable shipment archive, and an audit stream with object reads disabled. The operations lead calls the account secure because its storage is encrypted. You must turn this conflicting evidence into an ordered recovery project, not a count of red settings.
Treat the export as a snapshot, not proof of the whole quarter. Join identity permissions, network routes, resource policies, key configuration and logging scope by account and resource identifiers. Separate confirmed exposure from missing evidence; then name the owner, containment deadline, durable change and closure test for each confirmed gap. In the two labs you will write the remediation artefact and triage a follow-up export against an explicit severity rubric.
Encryption cannot undo an authorised anonymous read; a quiet log cannot prove that no read occurred.
Reconstruct effective access before assigning severity
An identity policy grants actions, but effective access also depends on resource policies, explicit denials, session conditions and credential state. A machine principal with account-wide administration and a 210-day credential creates a large blast radius even if human administrators use MFA. Human MFA does not automatically protect an application credential. Inspect last-use time, allowed actions and resources, then replace persistent secrets with short-lived, narrowly scoped workload sessions where supported.
Network reachability is a path calculation. A listener on TCP 5432, a public address, an internet route and an ingress rule from 0.0.0.0/0 together expose an IPv4 database service; one permissive rule alone does not establish that path. Check IPv6 separately: ::/0 is not covered by an IPv4 restriction. A private address alone also does not prove isolation when gateways or forwarding paths exist. Map both directions and test the intended application path before cutting a production connection.
For least-privilege and segmentation controls, retain the identity-policy export, route and firewall snapshots, collection time and a negative connection test from outside the trust boundary. Ask: can the same principal still change its own permissions, and can an untrusted client still reach the database listener? Configuration intent without those tests is incomplete closure evidence.
Separate confidentiality safeguards from access decisions
Object storage access can be decided by container policy, object-level grants and account guardrails. Inspect all three. If an anonymous request can fetch a shipment manifest, encryption at rest does not stop disclosure: the service decrypts for a request its policy permits. Contain by blocking public access and removing permissive grants, then repeat an unauthenticated read against an existing object; an absent object is a poor negative test because it might fail for the wrong reason.
Default encryption generally governs new writes. Enabling it today does not establish that yesterday's objects were encrypted, nor that old replicas and snapshots inherited the change. Inventory existing data, key identifiers and key access policies; rewrite or re-encrypt legacy objects where necessary, testing application reads and recovery first. TLS protects data in transit and is a separate assertion from encryption at rest. A key policy that permits every application principal to decrypt undermines separation of duties even with strong algorithms.
Evidence for confidentiality includes a complete object inventory with encryption metadata, access-policy diffs and positive authorised plus negative anonymous read results. Record inventory coverage, not just a sample screenshot. An auditor asking whether all retained shipment files are protected needs the population and exceptions, not merely the new-write default.
Make logging useful without pretending it is prevention
Management events record changes such as granting a role or altering a storage policy. Object-read data events answer a different question: who fetched which object and when? An enabled management trail cannot substitute for disabled object reads. Enable the required data-event scope on sensitive stores, validate the account and region coverage, and generate a harmless synthetic read whose event can be located by principal, object and timestamp.
Send logs to a separately administered destination with restricted deletion and a retention lock where required. For this capstone, policy requires at least 90 days of searchable management and sensitive object-read events. An exporter can show 90 configured days while ingestion has been failing for a week; test delivery and alert on freshness as well as configuration. New collection cannot recreate missing historic events, so retain the gap and investigate with available secondary evidence without claiming completeness.
The detective control's evidence is a delivered test event, coverage list, retention setting and deletion-denial test under a workload identity. Ask who can disable the source or erase the destination. Separation of administration makes an attacker work harder to conceal activity, but it does not make logging a substitute for closing public access.
Turn findings into a sequenced remediation contract
Order work by exploitability, data impact and blast radius rather than cosmetic policy compliance. An anonymously readable sensitive archive needs immediate containment; a broad active administrator credential needs urgent revocation and investigation. A disabled object-read stream increases uncertainty but does not itself expose data. A missing cost tag is not a confidentiality incident. Explain the rubric and dependencies so a second reviewer can reproduce the order.
Give each change an accountable role, deadline in hours, validation method and rollback constraint. Remove anonymous access before rewriting a million objects. Establish a replacement workload session and test one job before revoking the old credential, unless active compromise requires immediate revocation. Restore detection alongside containment where feasible. A rollback must not silently restore anonymous grants; route service failures through an approved, time-limited restricted-access exception instead.
Close a finding only after a fresh export and behavioural tests confirm the change. Preserve before-and-after artefacts with account, scope, timestamps and an integrity digest, plus the change approval and residual-risk decision. A ticket marked done proves workflow completion, not control operation. Assign daily drift checks to the platform owner and require exceptions to carry a risk owner and expiry; this connects technical remediation to ongoing governance.
This room is the track's final project. Every lab below is one step of a single deliverable - clear them all and the Cloud Fundamentals track is complete.
Next on your path · Application Fundamentals
How Applications Work
Trace a browser request, distinguish method guarantees, and test session and access-control claims against HTTP evidence.
Community
Discussion & writeups
Share how you approached the room or ask where you got stuck. Never paste task answers or full lab solutions: write the reasoning, not the key.
Loading discussion…