Skip to content
sec/atlas
knowledge base · cloudsec

Cloud security, mapped.

An interactive map of cloud security: identity, network, workloads, posture, cryptography and detection: what each piece does, where it lives and how it connects.

$ click a card for details · ctrl+k to search

learning map

Topics are laid out by level, from foundations to advanced. Arrows point from a prerequisite to what builds on it. Select a topic to preview it, or follow the highlighted next step.

Your next step

0 of 11 studied
start this topic

01 Foundations

The ideas everything else builds on.

02 Practitioner

Apply the controls and make them work in practice.

03 Advanced

Design, scale and operate at depth.

  • studied
  • ready to study
  • prerequisites missing

cloud security cycle

From asset inventory to incident response: the control lives in every phase. Each chip opens the matching topic.

  1. 01inventory

    assets and owners mapped

    account and service mappingasset / owner inventorydata classification

    gate: every asset has an owner and a classification

  2. 02protect

    identity, network and data under control

    least privilegesegmentation and microsegmentationkeys and envelopesvaults and rotationRBAC and admissionsigned, immutable images

    gate: no static secrets · least-privilege IAM

  3. 03detect

    visibility and posture monitored

    continuous postureruntime and workloadsignals and alerts

    gate: drift and anomalies become alerts within minutes

  4. 04respond

    from alert to containment

    runbooks and automationcredential isolationpreserved forensics

    gate: MTTR below the threshold · lessons flow back into the inventory

topics

IAM - identity and access
Identity is the new perimeter: cloud security starts with knowing who every workload, every human and every service is, and limiting exactly what each one can touch.
technique· stage: proteger
Network - segmentation and zero-trust
The cloud network is programmable: VPCs, subnets, security groups and application firewalls draw the perimeter application by application, instead of waiting for the datacenter edge.
technique· stage: proteger
Kubernetes - secure runtime
A Kubernetes cluster is a distributed operating system: RBAC, admission controllers and policies govern what each pod can do, mount and expose.
practice· stage: proteger
Containers - images and supply chain
Layered images inherit privileges: CVE scanning, signing and a rootless runtime shrink the surface the container hands to the host.
practice· stage: proteger
CSPM - cloud posture
Cloud Security Posture Management scans each account's configuration against baselines (CIS, PCI, NIST) and flags drift before it becomes an incident.
practice· stage: detectar
CWPP - workload protection
Cloud Workload Protection Platform watches what happens inside the VM, container and serverless function: syscalls, connections and processes, at execution time.
practice· stage: detectar
Secrets - vaults and rotation
API keys, database tokens and secrets leave the repository and move to vaults with automatic rotation, short-lived identity and centralized audit logging.
technique· stage: proteger
KMS & crypto - keys and envelopes
Cloud encryption starts at the KMS: whoever has access to the key decides what is 'encrypted'. Without governing keys, 'encrypted at rest' is just a checkbox in the console.
technique· stage: proteger
Logging & detection - signals and alerts
Cloud detection starts with logs: CloudTrail, VPC flow logs, IAM audit and DNS become correlated signals that feed the SIEM, managed detection and response automation.
technique· stage: detectar
Zero-trust - trust model
Zero-trust replaces the perimeter with policy: every request is authenticated, authorized and logged, regardless of whether the origin is internal or external.
concept
Cloud incident response
Detecting is not enough: when the alert fires, it is the speed and quality of containment that decide whether it becomes a scare or a headline.
practice· stage: responder