Belajar Security Architect - Cloud Security Architecture
Mempelajari multi-cloud security design, shared responsibility model, cloud control planes, dan merancang arsitektur keamanan cloud yang scalable
#Pendahuluan
Setelah di episode 6 kita mempelajari network security architecture, pada episode ini kita dalami cloud security architecture — bagaimana mendesain keamanan di lingkungan cloud yang dinamis dan scalable. Cloud mengubah fundamental cara kita berpikir tentang keamanan: tidak ada perimeter, shared responsibility, dan programmability.
Mengapa cloud security architecture penting? Karena 95% cloud breaches melibatkan kesalahan konfigurasi, bukan vulnerability kode. Arsitektur cloud yang baik memastikan security built-in dari awal, bukan added on setelah deployment.
#Shared Responsibility Model
| Layer | AWS/Azure/GCP Responsible | Customer Responsible |
|---|---|---|
| Physical | Data center, hardware | - |
| Infrastructure | Hypervisor, network | - |
| Platform | OS, managed services | Configuration |
| Application | - | Code, config, data |
| Data | - | Classification, encryption |
Warning
Shared responsibility adalah sumber kebingungan terbesar di cloud security. Customer sering mengira cloud provider handle semua security — padahal tidak. Pastikan tim memahami batas tanggung jawab masing-masing.
#Multi-Cloud Security
#Konsisten di Multi-Cloud
| Challenge | Solution |
|---|---|
| Different IAM models | Abstraction layer (OPA, custom) |
| Different network models | Overlay network, service mesh |
| Different logging formats | Normalization (OCSF, ECS) |
| Different compliance | Policy-as-code (Terraform, OPA) |
#Cloud-Native Security Controls
| AWS | Azure | GCP | Fungsi |
|---|---|---|---|
| Security Hub | Defender for Cloud | SCC | Posture mgmt |
| GuardDuty | Sentinel | Chronicle | Detection |
| IAM | Entra ID | IAM | Identity |
| KMS | Key Vault | KMS | Encryption |
| WAF | WAF | Cloud Armor | App protection |
#Cloud Control Planes
#Control Plane Security
| Control Plane | Risiko | Mitigasi |
|---|---|---|
| Management console | Credential compromise | MFA + conditional access |
| API | Unauthorized API calls | IAM policies + monitoring |
| CLI | Misused commands | Audit logging |
#Data Plane Security
| Layer | Security |
|---|---|
| Compute | Instance hardening, patching |
| Storage | Encryption, access policies |
| Network | Security groups, NACLs |
| Database | Encryption, audit logging |
#Cloud Security Design Patterns
#Pattern 1: Landing Zone
Landing zone adalah environment cloud yang sudah terkonfigurasi dengan security baseline.
#Pattern 2: VPC Architecture
| Component | Fungsi |
|---|---|
| Transit Gateway | Central hub |
| VPC | Isolated network |
| PrivateLink | Service access |
| VPN/Direct Connect | On-prem connectivity |
Tip
Mulai cloud security dari landing zone yang terkonfigurasi dengan benar. Ini memberikan foundation yang aman untuk semua workload. AWS Control Tower, Azure Landing Zones, dan GCP Blueprint adalah starting point yang baik.
#Cloud Security Posture Management (CSPM)
| Tool | Platform | Keunggulan |
|---|---|---|
| Prowler | AWS | Comprehensive, open-source |
| ScoutSuite | Multi-cloud | Multi-cloud |
| CloudSploit | Multi-cloud | CI-friendly |
| Checkov | IaC | Pre-deployment scanning |
prowler aws --compliance cis_2.0_aws#Penutup
Inti yang harus dibawa pulang:
- Shared responsibility: pahami batas tanggung jawab customer vs provider.
- Multi-cloud: gunakan abstraction layer untuk konsistensi.
- Control plane: protect management console, API, CLI.
- Landing zone: security baseline sebelum workload deployment.
- CSPM: continuous compliance monitoring.
Di episode 8 selanjutnya kita akan membahas application & data security architecture — secure app design patterns, data protection, dan encryption strategy.