Cloud Security Guides

The AWS Well-Architected Security Pillar is a structured framework for evaluating and improving the security posture of workloads running on AWS. It defines eleven security questions — organised across seven best practice areas — that cover the full range of security decisions an architect must make: identity, detection, network protection, data security, incident response, and application security. A workload that answers all eleven questions with evidence-backed “yes” responses is, by definition, a well-secured workload. ...

Cloud identity and access management (IAM) is the system of controls that determines who can access what in a cloud environment — governing authentication, authorisation, and privilege for every human user, workload, and service that interacts with cloud resources. It is not a supporting discipline within cloud security; it is the foundation on which everything else rests. There is no network boundary to cross, no physical server room to enter. The only thing standing between an attacker and your cloud resources is whether they can obtain and use valid credentials. ...

Cloud incident response is the organised process of detecting, containing, investigating, and recovering from security incidents in cloud environments — and then learning from them. It differs from traditional incident response in important ways: there are no physical servers to seize, logs are ephemeral unless explicitly preserved, infrastructure can be destroyed and rebuilt in minutes, and the blast radius of a compromised cloud identity is global rather than local. These differences make cloud IR both more powerful in some respects and more dangerous in others. More powerful because automation can contain incidents faster than any human response. More dangerous because evidence disappears and attackers can move at machine speed. ...

Cloud network security is the set of controls that govern how traffic moves into, out of, and between resources in a cloud environment — covering ingress and egress filtering, network segmentation, private connectivity, traffic inspection, and detection of anomalous network behaviour. It is structurally different from traditional network security: there is no physical perimeter, no hardware firewall appliance to configure, and no cable you can pull. Instead, the network itself is software-defined, provisioned via API, and controlled through policies attached to virtual constructs. That shift eliminates some traditional attack vectors and introduces entirely new ones. ...

Cloud threat detection is not a product you buy — it is a discipline you build. The cloud gives you access to more security signal than any on-premises environment could generate, but that abundance is also the problem. Without deliberate architecture, you drown in logs while the attacks that matter go undetected. This guide covers what cloud threat detection actually requires: the signal sources, the threat categories worth instrumenting, the native and third-party tooling landscape, and the architectural decisions that determine whether your detection programme catches real attacks or generates expensive noise. ...

DevSecOps is the integration of security practices into the software development and delivery lifecycle — shifting security left from a deployment-gate activity into the development process itself, so that vulnerabilities, misconfigurations, and policy violations are caught at the point where they are cheapest to fix. In a cloud-native environment, where infrastructure is code, the same shift-left principle applies to the configuration of cloud resources: a misconfigured S3 bucket in a Terraform file is a security defect, and like all defects, it is orders of magnitude cheaper to fix in code review than in production. ...

AWS IAM Identity Centre: centralised workforce access done right If you are still issuing long-term IAM user credentials to engineers in a multi-account AWS estate, you are carrying a risk that regulators and your own incident response team will eventually force you to address. AWS IAM Identity Centre (formerly AWS Single Sign-On) is the answer, and as of June 2026 it has matured to the point where it is the only defensible choice for human access to AWS. This guide covers the architecture, the configuration decisions that matter, the quotas that will bite you at scale, and the mistakes I see repeated across nearly every organisation I work with. ...

AWS CloudTrail configuration best practices: a practitioner’s guide If you’re running workloads in AWS and haven’t spent deliberate time on CloudTrail configuration, you’re flying blind. In the event of a breach, your incident response team will feel that painfully. CloudTrail is your AWS audit trail: every API call, every console action, every SDK invocation flows through it. Get the configuration wrong and you lose the forensic evidence you need when regulators, insurers, or a compromised account demand answers. I’ve responded to enough AWS security incidents to know that the organisations that suffer most are almost never missing a firewall rule. They’re missing logs. This guide covers the configuration decisions that actually matter in production. ...

AWS compliance and governance: a practitioner’s guide for 2026 If you run workloads in AWS for a UK-regulated organisation – FCA-supervised financial services, NHS, central government, or any data-intensive enterprise – then AWS compliance and governance is not a project you complete once and file away. It is a continuous operational discipline. Most incidents I see investigated stem from the customer side: identity misuse, misconfiguration, exposed workloads. Not platform failures. That matters because it means the controls are largely in your hands. ...

AWS KMS key management best practices: a production-grade guide If you are running regulated workloads in AWS — whether that is FCA-supervised financial services, NHS data, or any system handling UK GDPR-classified personal data — your encryption story is only as strong as your key management posture. KMS key management is not optional configuration hygiene. It is the difference between a defensible audit trail and an irrecoverable data loss event. ...