Phase 07 - Cloud, Kubernetes, SaaS, and Compliance Engineering

Duration: 12 weeks (Months 14-16)
Objective: design, deploy, assess, detect, and recover a secure multi-tenant cloud platform.

Deep guides: WARMUP.md derives cloud security from identity and control-plane policy; HITCHHIKERS-GUIDE.md covers landing zones, Kubernetes hardening, policy tests, seeded attacks, and credential incident response.

Required Theory

Shared responsibility, organization/resource hierarchy, IAM evaluation, federation, service accounts, workload identity, least privilege, separation of duties, break glass, and access reviews.
VPC/VNet design, segmentation, private endpoints, DNS, egress, ingress, load balancing, WAF, service mesh, and zero-trust architecture.
KMS/HSM concepts, secrets, storage/object ACLs, data classification, backups, recovery, and cryptographic deletion limits.
Kubernetes API, RBAC, service accounts, admission, Pod Security Standards, network policy, secrets, etcd, node/runtime security, image policy, multi-tenancy, Gatekeeper/Kyverno, and mesh.
Terraform/OpenTofu, state security, modules, CI/CD, policy as code, CSPM/CNAPP concepts, cloud logging, detections, and incident response.
Engineering interpretation of FedRAMP, PCI DSS, HIPAA, SOC 2, ISO 27001, privacy, evidence, inherited controls, and continuous monitoring.

12-Week Lab Sequence

Deploy one provider fully in a dedicated sandbox. Model equivalent AWS/Azure/GCP controls without incurring three-provider cost.

Week	Labs	Deliverable
1	secure organization/landing zone	account/project hierarchy, MFA/federation, guardrails, budgets
2	IAM least privilege	permission inventory, custom roles, access review, break-glass drill
3	network architecture	public/private/data/admin zones, private services, controlled egress
4	KMS, secrets, storage	envelope encryption, rotation, access logs, backup/restore test
5	Kubernetes baseline	private cluster/local equivalent, RBAC, PSS, node and API hardening
6	workload hardening	non-root/read-only, limits, probes, network policy, workload identity
7	admission policy	OPA/Gatekeeper or Kyverno policies with unit and integration tests
8	software supply chain	private registry, scanning, SBOM, signing, admission verification
9	logging/detection	cloud control-plane, IAM, network, K8s audit, workload and data events
10	cloud IR	leaked credential, public storage, suspicious pod, and key-compromise playbooks
11	IaC scanner/policy	custom Terraform checks and CI policy pack with exceptions
12	compliance assessment	control mapping, evidence index, gaps, POA&M/remediation roadmap

Runnable lab portfolio

These cover transitive identity privilege, unsafe pod/runtime configuration, and the complete requirement-to-implementation-to-test-to-evidence lifecycle. The provider labs then apply those principles to distinct AWS, Google Cloud, and Azure identity, organization, data, logging, Kubernetes, incident-response, and recovery controls.

Capstone - Secure Multi-Tenant SaaS Platform

Use IaC to deploy Aegis Transit Cloud with:

identity federation, least-privilege admin and workload identities;
segmented networking and private data services;
hardened Kubernetes workloads and admission policy;
secrets and KMS-backed encryption with rotation;
signed images, SBOMs, provenance, and controlled deployment;
centralized immutable-enough logs, alerts, dashboards, and tested playbooks;
backup, restore, regional/service failure assumptions, and recovery exercise;
tenant-isolation threat model and security design review;
authorized assessment report and executive remediation summary;
deep mapping to one framework and comparative mapping to the other four.

Measures

No long-lived cloud keys in code, CI, images, or developer files.
IAM graph has no unexplained wildcard privilege or unintended trust path.
Policy tests block all seeded unsafe manifests and permit documented safe fixtures.
Restore meets declared RPO/RTO in the exercise.
At least 10 cloud/K8s detections have fixtures, owner, severity, and response action.
Compliance evidence links a requirement to implementation, test, artifact, owner, and frequency.

Tools and Sources

Cloud CLIs and architecture/security docs, Terraform/OpenTofu, kind/k3d for local repetition, Kubernetes, Trivy, Syft/Cosign, Checkov/tfsec, OPA/Conftest/Gatekeeper or Kyverno, Falco concepts, cloud-native logging, Prowler/ScoutSuite-style assessment tools used only in owned accounts.

Read provider Well-Architected/security foundations, Kubernetes docs, NSA/CISA hardening guidance, NIST 800-53/207 concepts, PCI/HIPAA source requirements, AICPA SOC 2 trust-services criteria concepts, ISO 27001 control-system concepts, and CSA Cloud Controls Matrix.

Evaluation Checklist

Trace human and workload access from identity provider to resource policy.
Explain preventive, detective, responsive, and recovery controls for a cloud risk.
Assess Kubernetes tenant boundaries without assuming namespaces are sufficient.
Rotate a compromised identity/key and prove old access fails.
Translate a compliance statement into a tested engineering control and evidence plan.
Brief executives on the top three risks, cost, sequence, and residual exposure.

Common Mistakes and Interview Questions

Mistakes: deploying three clouds shallowly, public control planes by default, cluster-admin service accounts, plaintext Terraform state, network policy without a compatible enforcer, scan-only compliance, untested backups, and alerting without ownership.

Questions: design a secure landing zone; prevent cross-tenant access; respond to leaked CI credentials; harden a multi-tenant K8s platform; compare workload identity approaches; map one PCI/HIPAA/FedRAMP requirement into implementation and evidence; prioritize a cloud assessment.

Portfolio and Stretch

Publish sanitized IaC, policy tests, diagrams, control map, detections, and recovery report. Stretch: IAM graph analyzer, multi-cluster design, service-mesh identity, confidential-computing review, chaos/security experiments, or automated evidence collection with freshness checks.

Security Engineer