0 Cloud Security - kevwells.com

Cloud Security

Defend AWS and hybrid environments with strong identity, policy, and monitoring controls.

AWS core services for ops teams

by

Short version: Stand up networking, identity, logging, and a few platform services with explicit defaults and basic alarms. The minimal stack Service Use it for Baseline settings Alerting IAM & Identity Center Human access SSO groups → permission sets; no IAM users; MFA on; short admin sessions Alarm on root usage; failed console auth bursts … Read more

AWS IAM & Identity Center: permission sets, SSO, guardrails

by

Short version: Use Identity Center (SSO) for humans, IAM roles for workloads, and a handful of organization guardrails. Keep permission sets simple (ReadOnly, PowerUser-no-IAM, Admin), enforce MFA and sensible session lengths, and monitor root usage rather than trying to block it. 1) The shape that works Accounts: management, log-archive, security, and one per environment (dev/test/prod). … Read more

AWS Security Groups vs NACLs: how traffic actually flows

by

AWS Security Groups vs NACLs (2025): how traffic actually flows Last updated: 20 Aug 2025 Short version: Use Security Groups (SGs) for almost everything. They’re stateful, attach to ENIs/instances, and scale cleanly. Keep NACLs simple or neutral; use them for coarse subnet-level controls or as a quick kill-switch. What each thing does Property Security Groups … Read more

AWS CloudTrail vs CloudWatch vs Config: what to use and when

by

Short version: CloudTrail is your audit log of API activity, CloudWatch is telemetry + alerting (metrics/logs/events), and Config is resource inventory + compliance. You probably need all three, wired together sensibly. Who does what Goal CloudTrail CloudWatch Config Audit every API call (who/what/when/where) ✔️ — — Real-time alerts (errors, patterns, thresholds) via Logs → Metric … Read more

Securing Docker and Kubernetes

by

Why Containers Expand the Attack Surface Microservices speed delivery but multiply risk. Misconfigured Kubernetes clusters are a known goldmine for cryptojacking and data exfiltration. Core Hardening Steps Least privilege images – no root user. Signed images only – verify integrity. Secrets management – never hardcode creds in YAML. Network policies – enforce pod-to-pod traffic rules. … Read more