Cloud Computing Tutorial · Identity and Security · Lesson 10 of 24
A Cloud Security Baseline
The guardrails every cloud account needs from day one: audit logs, threat detection, MFA, guardrails and secure defaults.
Day-one checklist
| Control | AWS | Azure | Google Cloud |
|---|---|---|---|
| Audit log of every API call | CloudTrail (organisation trail to a locked log account) | Activity Log + diagnostic settings | Cloud Audit Logs |
| Threat detection | GuardDuty | Microsoft Defender for Cloud | Security Command Center |
| Configuration rules | AWS Config, Security Hub | Azure Policy, Defender for Cloud | Organization policies, Security Command Center |
| Guardrails across accounts | Service control policies | Management group policies | Organization policies |
| Block public storage | S3 Block Public Access (account level) | Disallow blob public access | Public access prevention |
| Root/global admin protection | MFA on root, no root keys | MFA + Privileged Identity Management | MFA + super admin controls |
Secure defaults to turn on
- MFA for every human; SSO instead of local users.
- No public storage buckets unless explicitly reviewed (static websites go behind a CDN).
- Encryption by default for disks and databases; TLS everywhere.
- Budgets and cost anomaly alerts (unexpected cost is often the first sign of compromise).
- Separate accounts or subscriptions for production, with guardrails applied centrally.
account = {"cloudtrail_org_trail": True, "guardduty": False, "root_mfa": True, "root_access_keys": False,
"s3_block_public_access": False, "default_ebs_encryption": True, "budget_alerts": False}
required = {"cloudtrail_org_trail": True, "guardduty": True, "root_mfa": True, "root_access_keys": False,
"s3_block_public_access": True, "default_ebs_encryption": True, "budget_alerts": True}
failures = [k for k, want in required.items() if account[k] != want]
for k in required:
print(f"{'FAIL' if k in failures else 'ok '} {k}")
print(f"{len(required) - len(failures)}/{len(required)} controls in place")
Output
ok cloudtrail_org_trail FAIL guardduty ok root_mfa ok root_access_keys FAIL s3_block_public_access ok default_ebs_encryption FAIL budget_alerts 4/7 controls in place
Test yourself
Which AWS service records every API call made in an account?
CloudWatch MetricsCloudTrailGuardDutyTrusted Advisor
Show answer
Answer: CloudTrail
CloudTrail is the audit log; GuardDuty analyses it (and other sources) for threats.