Identity, Secrets, Networks, Data Protection, Monitoring, and Compliance on AWS and Azure

Read before you buy: the PDF here is a free sample — the first 20 pages of the 477-page book (payments, sales and reviews on this demo site are sample data). Get the full e-book at thenexbooks on Gumroad.

Secure your cloud the right way — from one over-privileged account to a monitored, audit-ready environment.

In the cloud, every server, database, bucket, firewall rule, and permission is just an API call away. That makes the cloud fast — and it means one overly broad policy, one leaked access key, or one storage bucket opened "just for a test" can expose data to the whole internet. The cloud also gives you excellent security tools, but there are hundreds of settings and services, and knowing which ones matter, how they fit together, and in what order to tackle them is the hard part.

This book teaches cloud security step by step on both Amazon Web Services and Microsoft Azure. Instead of touring services, you follow one company as it grows up, and every control is introduced at the moment it solves a real problem — with the reasoning behind it, so you can make good decisions in your own environment.

What's inside

• Shared responsibility, the threats that matter, and the principles behind every decision: least privilege, defense in depth, Zero Trust, and blast radius
• Threat modeling a real cloud application with data flow diagrams and STRIDE
• Structuring AWS Organizations and Azure management groups, landing zones, root user protection, service control policies, and Azure Policy
• Identity done right: IAM, IAM Identity Center, Microsoft Entra ID, SAML and OIDC federation, single sign-on, and joiner-mover-leaver processes
• Writing least-privilege IAM policies and Azure RBAC role assignments, with a policy linter you build yourself in Python
• Workload identity without secrets: IAM roles, managed identities, and OIDC federation for GitHub Actions
• Phishing-resistant MFA, Conditional Access, break-glass accounts, access reviews, permission boundaries, and privilege escalation paths (and how to block them)
• Cryptography essentials, AWS KMS and Azure Key Vault, envelope encryption, field-level encryption, and HMAC webhook verification
• Secrets management, rotation, and secret scanning with regular expressions and entropy
• Locking down S3 and Azure Blob Storage, databases, backups, and sensitive data with a practical classification scheme
• Networks: VPC and VNet design, security groups, NSGs, private endpoints, egress control, TLS, WAF, and DDoS protection
• Hardening VMs, containers, and serverless functions, and securing CI/CD pipelines and the software supply chain
• Logging and detection with CloudTrail, VPC Flow Logs, Azure Monitor, GuardDuty, Defender for Cloud, Microsoft Sentinel, KQL, and custom alerts
• Incident response playbooks, evidence handling, and a minute-by-minute case study of a leaked access key
• Posture management and safe auto-remediation, and CIS, NIST CSF 2.0, ISO/IEC 27001, SOC 2, and PCI DSS explained in plain language
• Governance that works: policies, tagging, exceptions, risk registers, audit evidence, and a 12-month security roadmap

One running example, start to finish. You secure Tallyfern, a fictional startup offering online invoicing and payment links to freelancers. Its web app runs on AWS — containers, a PostgreSQL database, storage buckets for invoices and receipts, a job queue, and a CI/CD pipeline — with staff identities in Microsoft Entra ID and a reporting workload on Azure. It starts with one shared admin account, secrets in environment files, and a public test bucket, and ends with a structured organization, least-privilege identities, encrypted data, private networks, a hardened pipeline, working detection, a handled incident, and a SOC 2-ready governance program. Every account, role, policy, and resource name stays consistent across all 28 chapters.

Current and honest. The book covers AWS and Azure as offered at the time of writing and flags renamed, changing, and preview features. It contains no invented breach statistics, costs, or compliance claims, and it explains frameworks accurately without promising certification. You never need to deploy anything to follow along: policies are validated JSON, and the Python scripts, OpenSSL commands, and log analysis run on your own computer. All content is defensive. Every chapter includes step-by-step explanations, policies, commands, scripts, Tips, Notes, Warnings, exercises, and Key Takeaways, and the appendices give you a cheat sheet, ready-to-adapt templates, a production security checklist, and a glossary.

Format: PDF, 477 pages (A4), linked table of contents and bookmarks. English. First Edition, 2026. Published by thenexbooks. This book is independent and is not affiliated with, sponsored by, or endorsed by Amazon Web Services, Microsoft, GitHub, the Center for Internet Security, NIST, ISO, the AICPA, or the PCI Security Standards Council.

Table of Contents

Part I — Foundations

• Ch 1 · Cloud Security in Context: Shared Responsibility, Threats, and Tallyfern
• Ch 2 · Core Principles: Least Privilege, Defense in Depth, and Zero Trust
• Ch 3 · Threat Modeling a Cloud Application
• Ch 4 · Organizing the Cloud: AWS Organizations, Azure Management Groups, and Landing Zones
• Ch 5 · Secure Baselines and Guardrails: Root Protection, SCPs, and Azure Policy

Part II — Identity and Access

• Ch 6 · Identity Fundamentals: IAM, Microsoft Entra ID, and Federation
• Ch 7 · Writing Least-Privilege Policies: AWS IAM JSON and Azure RBAC
• Ch 8 · Workload Identity: IAM Roles, Managed Identities, and OIDC Federation
• Ch 9 · Strong Authentication: MFA, Single Sign-On, Conditional Access, and Break-Glass Accounts
• Ch 10 · Governing Access: Reviews, Permission Boundaries, and Privilege Escalation Paths

Part III — Secrets and Data Protection

• Ch 11 · Cryptography Essentials for Cloud Engineers
• Ch 12 · Key Management: AWS KMS, Azure Key Vault, and Envelope Encryption
• Ch 13 · Secrets Management: Storage, Rotation, and Secret Scanning
• Ch 14 · Protecting Object Storage: Amazon S3 and Azure Blob Storage
• Ch 15 · Protecting Databases and Sensitive Data: Encryption, Classification, and Backups

Part IV — Network and Workload Security

• Ch 16 · Network Foundations: VPCs, VNets, Subnets, and Segmentation
• Ch 17 · Controlling Traffic: Security Groups, NSGs, Firewalls, and Private Endpoints
• Ch 18 · Securing the Edge: TLS, Load Balancers, WAF, and DDoS Protection
• Ch 19 · Compute and Container Security: VMs, Containers, and Serverless
• Ch 20 · Securing CI/CD and the Software Supply Chain

Part V — Detection and Response

• Ch 21 · Logging That Matters: CloudTrail, Azure Monitor Logs, and Flow Logs
• Ch 22 · Threat Detection: GuardDuty, Defender for Cloud, Sentinel, and Custom Alerts
• Ch 23 · Incident Response in the Cloud: Preparation, Playbooks, and Evidence
• Ch 24 · Incident Case Study: The Leaked Access Key

Part VI — Posture, Governance, and Compliance

• Ch 25 · Cloud Security Posture Management: Findings, Benchmarks, and Auto-Remediation
• Ch 26 · Compliance Frameworks Explained: CIS, NIST CSF, ISO 27001, SOC 2, and PCI DSS
• Ch 27 · Governance in Practice: Policies, Tagging, Exceptions, Risk, and Evidence
• Ch 28 · Putting It All Together: Tallyfern's Security Program and Roadmap

Appendices
A · Cloud Security Cheat Sheet
B · Templates and Reference
C · Production Security Checklist
D · Glossary

Book details