SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillscloud-infrastructure-security

cloud-infrastructure-security

Deployment & operations

View repository

Updated 10-16 06:52

About this skill

Cloud & Infrastructure Security Skill | Cloud Infrastructure Security

Ensure cloud infrastructure, CI/CD pipelines, and deployment configurations follow security best practices and comply with industry standards.

Applicable Scenarios

  • Deploy applications to cloud platforms (AWS, Vercel, Railway, Cloudflare)
  • Configure IAM roles and permissions
  • Set up CI/CD pipelines
  • Implement Infrastructure as Code (Terraform, CloudFormation)
  • Configure logging and monitoring
  • Manage secrets in cloud environments
  • Configure CDN and edge security
  • Implement disaster recovery and backup strategies

Cloud Security Checklist

1. IAM and Access Control

Principle of Least Privilege

# ✅ 正確：最小權限
iam_role:
  permissions:
    - s3:GetObject  # 只有讀取權限
    - s3:ListBucket
  resources:
    - arn:aws:s3:::my-bucket/*  # 特定 bucket

# ❌ 錯誤：過度寬鬆的權限
iam_role:
  permissions:
    - s3:*  # 所有 S3 動作
  resources:
    - "*"  # 所有資源

Verification Steps

  • Do not use the root account in production environments
  • Enable MFA for all privileged accounts
  • Service accounts use roles, not long-term credentials
  • IAM policies follow least privilege
  • Conduct regular access reviews
  • Unused credentials have been rotated or removed

2. Secrets Management

Cloud Secrets Manager

// ✅ 正確：使用雲端 secrets manager
import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManager({ region: 'us-east-1' });
const secret = await client.getSecretValue({ SecretId: 'prod/api-key' });
const apiKey = JSON.parse(secret.SecretString).key;

// ❌ 錯誤：硬編碼或僅在環境變數
const apiKey = process.env.API_KEY; // 不輪替，不審計

Verification Steps

  • All secrets are stored in a cloud secrets manager
  • Automatic rotation is enabled for database credentials
  • API keys are rotated at least quarterly
  • No secrets in code, logs, or error messages
  • Secret access audit logging is enabled

3. Network Security

VPC and Firewall Configuration

# ✅ 正確：限制的安全群組
resource "aws_security_group" "app" {
  name = "app-sg"

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"]  # 僅內部 VPC
  }

  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # 僅 HTTPS 出站
  }
}

# ❌ 錯誤：對網際網路開放
resource "aws_security_group" "bad" {
  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]  # 所有 port，所有 IP！
  }
}

Verification Steps

  • Databases are not publicly accessible
  • SSH/RDP ports are restricted to VPN/bastion
  • Security groups follow least privilege
  • Configure Network ACLs
  • Enable VPC flow logs

4. Logging and Monitoring

CloudWatch/Logging Configuration

// ✅ 正確：完整的日誌
const logSecurityEvent = async (event: SecurityEvent) => {
  await cloudwatch.putLogEvents({
    logGroupName: '/aws/security/events',
    logStreamName: 'authentication',
    logEvents: [{
      timestamp: Date.now(),
      message: JSON.stringify({
        type: event.type,
        userId: event.userId,
        ip: event.ip,
        result: event.result,
        // 永不記錄敏感資料
      })
    }]
  });
};

Verification Steps

  • CloudWatch/logging is enabled for all services
  • Log failed authentication attempts
  • Audit administrator actions
  • Configure log retention periods (90+ days for compliance requirements)
  • Configure alerts for suspicious activity
  • Logs are centralized and tamper-proof

5. CI/CD Pipeline Security

Secure Pipeline Configuration

# ✅ 正確：安全的 GitHub Actions workflow
name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read  # 最小權限

    steps:
      - uses: actions/checkout@v4

      # 掃描 secrets
      - name: Secret scanning
        uses: trufflesecurity/trufflehog@main

      # 依賴審計
      - name: Audit dependencies
        run: npm audit --audit-level=high

      # 使用 OIDC，非長期 token
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
          aws-region: us-east-1

Verification Steps

  • Use OIDC instead of long-term credentials
  • Perform secrets scanning in the pipeline
  • Dependency vulnerability scanning
  • Container image scanning (if applicable)
  • Enforce branch protection rules
  • Require code review before merging
  • Enforce signed commits

6. Cloudflare & CDN Security

Cloudflare Security Configuration

// ✅ 正確：帶安全標頭的 Cloudflare Workers
export default {
  async fetch(request: Request): Promise<Response> {
    const response = await fetch(request);

    const headers = new Headers(response.headers);
    headers.set('X-Frame-Options', 'DENY');
    headers.set('X-Content-Type-Options', 'nosniff');
    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
    headers.set('Permissions-Policy', 'geolocation=(), microphone=()');

    return new Response(response.body, {
      status: response.status,
      headers
    });
  }
};

Verification Steps

  • WAF enabled with OWASP rules
  • Configure rate limiting
  • Enable Bot protection
  • Enable DDoS protection
  • Configure security headers
  • Enable SSL/TLS strict mode

7. Backup and Disaster Recovery

Automated Backups

# ✅ 正確：自動 RDS 備份
resource "aws_db_instance" "main" {
  allocated_storage     = 20
  engine               = "postgres"

  backup_retention_period = 30  # 30 天保留
  backup_window          = "03:00-04:00"
  maintenance_window     = "mon:04:00-mon:05:00"

  enabled_cloudwatch_logs_exports = ["postgresql"]

  deletion_protection = true  # 防止意外刪除
}

Verification Steps

  • Configure automated daily backups
  • Backup retention meets compliance requirements
  • Point-in-time recovery enabled
  • Backup testing conducted quarterly
  • Disaster recovery plan documented
  • RPO and RTO defined and tested

Pre-Deployment Cloud Security Checklist

Before any production cloud deployment:

  • IAM: Do not use the root account, enable MFA, least-privilege policies
  • Secrets: All secrets in a cloud secrets manager and rotated
  • Network: Security groups restricted, no public databases
  • Logging: CloudWatch/logging enabled and retention configured
  • Monitoring: Anomaly alerts configured
  • CI/CD: OIDC authentication, secrets scanning, dependency auditing
  • CDN/WAF: Cloudflare WAF with OWASP rules enabled
  • Encryption: Data encrypted at rest and in transit
  • Backups: Automated backups and tested recovery
  • Compliance: Meets GDPR/HIPAA requirements (if applicable)
  • Documentation: Infrastructure documented, runbooks established
  • Incident Response: Security incident plan in place

Common Cloud Security Misconfigurations

S3 Bucket Exposure

# ❌ 錯誤：公開 bucket
aws s3api put-bucket-acl --bucket my-bucket --acl public-read

# ✅ 正確：私有 bucket 並指定存取
aws s3api put-bucket-acl --bucket my-bucket --acl private
aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json

RDS Public Access

# ❌ 錯誤
resource "aws_db_instance" "bad" {
  publicly_accessible = true  # 永遠不要這樣做！
}

# ✅ 正確
resource "aws_db_instance" "good" {
  publicly_accessible = false
  vpc_security_group_ids = [aws_security_group.db.id]
}

Reference Resources

Remember: Cloud misconfigurations are the leading cause of data breaches. A single exposed S3 bucket or an overly permissive IAM policy can compromise the entire infrastructure. Always follow the principles of least privilege and defense in depth.