Cloud Security FAQ
Q: Do I need a general security/InfoSec background before learning cloud security specifically, or can I start here directly?
A: Some general security foundation (see Prerequisites — CIA triad, least privilege, basic networking security concepts) is genuinely assumed, not taught from zero on this page. If you don't have that yet, a short general security fundamentals primer first will make everything here land faster — trying to learn "cloud-specific" security controls without the underlying security concepts they're implementing tends to produce checklist-following without real understanding of why each control matters.
Q: Is cloud security the same skill set as penetration testing / offensive security?
A: Related but distinct — this page covers defensive cloud security engineering (configuring controls, detection, incident response), not offensive methodology (actively finding and exploiting vulnerabilities as an attacker would). Real overlap exists and understanding attacker techniques genuinely makes you a better defender (this page's SSRF/metadata-service content is a good example — knowing how the attack works is what makes the defense make sense), but if your specific goal is offensive security as a career direction, that's a related, separate track worth pursuing more directly.
Q: How much of this transfers between AWS, Azure, and GCP, versus needing to relearn per provider?
A: The concepts transfer almost entirely — shared responsibility model, least privilege, defense in depth, detection vs. prevention are universal. The specific service names and configuration syntax don't transfer directly (AWS IAM policies vs. Azure RBAC vs. GCP IAM have different syntax and structure for implementing the same underlying least-privilege principle). Depth on one provider first, then learning a second provider's specific implementation of concepts you already understand, is significantly faster than trying to learn all three simultaneously from scratch.
Q: Is IMDSv2 relevant if I'm not using AWS?
A: IMDSv2 specifically is AWS's mechanism, but the underlying concept — requiring a token/authentication step before an instance's own metadata service reveals credentials, specifically to defeat simple SSRF exploitation — has direct equivalents on other providers (Azure and GCP both have their own metadata service protections with similar design goals). The specific configuration differs by provider; the underlying attack class and defense principle (see Intermediate) is the same.
Q: What's the single highest-leverage thing to actually fix first in a real cloud environment with unknown security posture?
A: Run a CSPM/audit tool (see Installation, Projects) and address the "immediate" triage category first (see Intermediate/Cheatsheet) — internet-facing exposure combined with sensitive data or high privilege. In practice, this usually surfaces a small number of genuinely urgent issues (a public storage bucket, an overly open security group, missing MFA on privileged accounts) rather than requiring you to address hundreds of findings before meaningfully reducing real risk — fixing the highest-leverage handful first, rather than working through a full list in order, gets you the largest risk reduction for the least initial effort.
Q: Does having strong cloud security knowledge require deep coding skill?
A: Not deep software engineering skill, but real scripting/automation comfort matters — writing and reading IAM policy JSON, using CLI tools for auditing (ScoutSuite, Prowler), and increasingly, understanding infrastructure-as-code (Terraform/CloudFormation) since that's often where misconfigurations originate before they're ever deployed. You don't need to be a software engineer, but "security person who can't touch a CLI or read a config file" is a real limitation in practice, not a viable long-term specialization in cloud security specifically.
Q: Cloud security certifications seem expensive and time-consuming — is hands-on practice alone enough to be job-ready?
A: For many roles, genuine hands-on skill (a real portfolio — see Projects) matters more day-to-day than a certification badge, but certifications remain a meaningfully stronger signal in this specific field than in some others (see Certification) — they're a common, explicit requirement or strong preference in many cloud security job postings, more so than in general software engineering roles. A reasonable approach: build hands-on skill first (it makes the certification exam genuinely easier, not just theoretically prepared-for), then pursue certification once you have that foundation, rather than treating them as mutually exclusive paths.