https://cloudsecdocs.com/

TL;DR

The Rationale

For the past few years, I've been collecting information as I was getting accustomed to DevOps concepts, Docker, Kubernetes, and the main cloud providers (AWS, GCP, and Azure). Now, I've decided to make these notes public for everyone to consult.

For (slightly) more details on how CloudSecDocs came to be, you can read the companion blog post: "Introducing CloudSecDocs.com".

Some sections are still work in progress

Just a FYI: for some topics I have further additional content which I haven't got to process and categorise yet. In particular, more material for the following topics will be added in the upcoming weeks/months:

• IAM: informations, best practices, and tutorials on AWS/GCP/K8s IAM
• Monitoring: everything related to security monitoring and alerting
• Incident response: think about containment, forensics, etc.
• Istio: how does it work and how to secure it

Additionally, I envision this website to integrate closely with CloudSecList, as every week I'll add the more interesting articles back here.

The Structure

This website is currently composed by 8 main sections (as shown in the table below), each containing my personal notes on that specific topic:

Disclaimer

As mentioned, these are my personal notes, collated and made available for everyone to reference. Hence, I would like to highlight some points:

• These notes might contain errors, so please always double-check what you are reading.
• These notes come from aggregating many different and amazing sources. I tried to explicitly put references to the original sources, but in case I missed something please do let me know and I'll amend it promptly.