Cloud Security & DevSecOps Engineering

Multi-Cloud IAM Zero-Trust, Pipeline CI/CD Scanning, Falco eBPF & Runtime Hardening

6 modules, 28 lessons: Multi-Account Cloud Architecture & Isolation; Cloud Identity & Zero-Trust Governance; CI/CD Security & Shift-Left Automation; Container & Kubernetes Runtime Defense; Infrastructure as Code & Policy-as-Code; Cloud Detection, Encryption & Compliance.

Advanced · 4 hours · 28 lessons · 127 labs

Who it is for

Advanced level.

For cloud, platform and DevOps engineers who want to secure multi-account cloud estates, pipelines and Kubernetes clusters, and prove it with policy and evidence.

What you don't need yet:

What helps:

Before you start:

Take first:

Take next:

Learning paths:

Nobody needs to know everything before they start. Each course builds on the one before, so a learning path takes you there step by step.

Labs

127 labs, 68 of them graded: you write the code, it runs, and graded labs check the result. The outline lists each lesson's labs.

What is free

Start free: First module free with an account. Pro: Every course, lab, handbook, practice exam and certificate.

Course outline

Multi-Account Cloud Architecture & Isolation

  1. Shared Responsibility Model & Cloud Threat Landscapes (3 labs): You can say which security tasks stay with you in each cloud service model, audit a real security group export for admin ports open to the internet, and check bucket regions against a data residency rule.
  2. AWS Organizations, Account Hierarchies & Azure Management Groups (3 labs): You can lay out an AWS organisation or Azure management group tree so each account limits blast radius, and work out which accounts an organisation path condition will let in.
  3. Service Control Policies & Guardrail Architecture (5 labs): You can predict whether a service control policy stack allows an API call by applying explicit deny first and then the allow-at-every-level rule, and design guardrails that enforce data residency without locking out your own platform team.
  4. Security Landing Zones & Centralized Egress Inspection (4 labs): You can describe the baseline a security landing zone gives every new account, review Kubernetes control plane and kubelet flags against CIS benchmark expectations, and explain what a centralised domain allow list really inspects and how it can be bypassed.
  5. Cloud Network Isolation: VPC Peering & PrivateLink (4 labs): You can trace a packet through peered VPC route tables, spot CIDR overlaps that block peering, and choose between peering and PrivateLink by what each one exposes.

Cloud Identity & Zero-Trust Governance

  1. Cloud IAM Architecture & Permission Boundaries (4 labs): You can evaluate an AWS IAM request in the real order, spot conditions that fail open, and cap role creation with a permissions boundary.
  2. Workload Identity Federation: Eliminating Static Keys (6 labs): You can replace stored cloud keys with OIDC federation and write a trust policy that only the intended pipeline can satisfy.
  3. Cross-Account AssumeRole Chains & Temporary STS (6 labs): You can design cross-account role trust that resists the confused deputy, predict when STS refuses a hop, and trace a role chain through CloudTrail.
  4. Least Privilege Enforcement & CIEM Architecture (5 labs): You can measure the gap between granted and used permissions, generate a right-sized policy from CloudTrail, and flag privilege escalation paths.
  5. Zero-Trust Network Access & IdP Federation (4 labs): You can explain how a zero-trust broker decides each request from identity, group and device, and deprovision a user through SCIM so access ends mid-session.

CI/CD Security & Shift-Left Automation

  1. Shift-Left Security Principles & Automated Pipeline Gates (3 labs): You can design pull request gates that block new security errors and map each pipeline control to a change management process.
  2. Pre-Commit Secret Scanning with Gitleaks & Entropy (5 labs): You can write a gitleaks rule that combines a token pattern with an entropy floor, enforce it in a pre-commit hook, and respond correctly when a secret reaches git history.
  3. Static Application Security Testing with Semgrep (5 labs): You can explain why syntax-aware SAST beats text matching, read and write a Semgrep rule for SQL built from strings, and route findings through an owned asset inventory.
  4. Software Composition Analysis with Trivy (5 labs): You can match pinned dependencies against OSV advisory ranges, gate a Trivy report with severity thresholds and expiring waivers, and place composition analysis within the four Cs of cloud native security.
  5. Supply Chain Security: SBOMs & Cosign Signing (5 labs): You can produce and query CycloneDX SBOMs, sign and verify an image digest the way cosign does, and roll out signature enforcement as a controlled change.

Container & Kubernetes Runtime Defense

  1. Container Hardening: Distroless & Rootless (4 labs): You can build a distroless, non-root image and prove from process status and ID maps what an attacker inside it can and cannot do.
  2. Kubernetes Pod Security Standards: Baseline & Restricted (5 labs): You can label a namespace for Pod Security Admission, predict which pods Baseline and Restricted will reject, and roll enforcement out without breaking workloads.
  3. Kubernetes NetworkPolicies & Microsegmentation (5 labs): You can write default-deny NetworkPolicies with the egress a namespace really needs, and predict from the YAML alone which pod-to-pod connections they allow.
  4. Runtime Anomaly Detection with Falco & eBPF (3 labs): You can write and tune Falco rules that turn container syscalls into alerts, and explain how a behavioural baseline and drift detection catch what signature rules miss.
  5. Securing the Kubernetes Control Plane & Node Components (5 labs): You can audit API server and kubelet settings against CIS-style checks, and turn on and verify encryption at rest for Secrets in etcd.

Infrastructure as Code & Policy-as-Code

  1. Static IaC Scanning: Linting Terraform with Checkov (4 labs): You can read Checkov findings on a Terraform file, explain the logic behind a check such as CKV_AWS_24, wire the scan's exit code into a pipeline gate, and add a custom YAML check.
  2. Policy-as-Code Architecture: OPA & Rego Syntax (4 labs): You can read a Rego policy, predict its decision for a given input including undefined results, and query a decision service so that the caller fails closed.
  3. Enforcing OPA Guardrails on Terraform Plan Payloads (5 labs): You can read a Terraform plan's JSON, map data types and classifications to protection methods, and write plan guardrails that enforce classification, encryption at rest and safe replacements.
  4. Continuous IaC Drift Detection & State Protection (4 labs): You can detect drift between Terraform state and live cloud resources, handle plan exit codes correctly in a scheduled job, find secrets stored in state, and harden a remote state backend.

Cloud Detection, Encryption & Compliance

  1. CloudTrail Logging, Integrity Validation & Athena (6 labs): You can design a CloudTrail trail whose logs survive an intruder, prove with signed digests whether a log file was altered, query the archive with Athena, and write and read a Kubernetes API server audit policy.
  2. Threat Detection with GuardDuty & Anomaly Analytics (5 labs): You can read a GuardDuty finding, reproduce the evidence behind it from CloudTrail, explain what an anomaly baseline flags and misses, and route findings with an EventBridge pattern that does not drop the quiet ones.
  3. Envelope Encryption & Data Protection with KMS (5 labs): You can explain and carry out envelope encryption, work out whether a principal may use a KMS key from its key policy and IAM policies, and choose rotation, encryption context and deletion settings knowing what each one protects against.
  4. Cloud Security Posture Management & Remediation (5 labs): You can write posture controls against real AWS Config configuration items, decide which failures to fix automatically and which to hand to a person, and build remediation with exceptions, ownership and a blast radius limit.

Certification courses