Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Grant an EKS pod IAM access to S3
IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials. secure workload identity. hardcoding keys or sharing the node profile.
Multi-stage Docker builds
A build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface. separating build tooling from runtime. shipping compilers and source.
Securely supplying secrets to an app
Never hardcode credentials, inject them as environment variables or pull from a secrets manager, and rotate them. secrets management hygiene. committing the database URI to source control or baking it into the image.
The cloud shared responsibility model
The provider secures the cloud (hardware, OS, runtime), you secure what runs in it (code, data, config, access). the security boundary in PaaS. assuming the provider secures your code, data, or IAM.
Architecting for HIPAA or PCI DSS compliance
Isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs. building auditable, compliant data handling.
Centralized logging and threat detection across accounts
Organization-wide trails ship logs to a locked-down central security account, store in immutable append-only storage, and aggregate threat detection findings centrally with least-privilege… multi-account security architecture.
Dynamic database credential rotation for microservices
A secrets manager issues short-lived per-service credentials, services authenticate by workload identity and fetch or refresh secrets without restart, leases expire and rotate automatically. dynamic secrets and zero-downtime rotation.
Shared responsibility model across service tiers
Provider secures the cloud infrastructure; you secure what you put in it; the line shifts with abstraction. For OS patching, you patch IaaS VMs but the provider patches a managed database OS. who secures what at each service tier.
Automating a no-public-IP governance rule
Use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts. preventive policy-as-code governance.
Service-managed vs customer-managed vs BYOK keys
Service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance. key management control versus burden.
Granting a VM scoped storage access without static keys
Attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket. workload identity over static secrets. storing access keys in config or environment variables.
Security Groups vs NACLs
A security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet. layered network access controls. thinking NACLs are stateful or that security groups support explicit deny rules.
IAM Role vs IAM User
A user is a fixed identity with long-lived credentials for a person; a role is assumable with temporary credentials for workloads or cross-account access. identity model and credential hygiene.
Public and private subnet VPC design
Web server in a public subnet routed to an internet gateway, database in a private subnet with no inbound from the internet, NAT for outbound. core VPC networking. placing the database in a public subnet or relying only on.
Serving user images securely from object storage
Store images in a private bucket, serve via a CDN with origin access control, use signed URLs for private content. object storage plus secure delivery.
R8 shrinking, obfuscation, and optimization
Shrinking removes unused code/resources, obfuscation renames symbols to short opaque names, optimization inlines and simplifies; shrinking also strips unreachable code that could be exploited. what R8 does and why.
Why store auth tokens in Keychain, not UserDefaults?
UserDefaults is an unencrypted plist readable from backups and on jailbroken devices; use Keychain Services, which stores encrypted items with access control; save with SecItemAdd and read with… secure credential storage.
Client-side vs server-side event tracking
Client captures UI intent but loses data to ad blockers and tampering; server is trustworthy for transactions but blind to UI interactions. judgment on tracking placement.
Image signing with Cosign vs trusting a digest
A digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission. integrity vs authenticity.
What makes a process a container to the kernel
Namespaces isolate and cgroups limit, but also capabilities, seccomp filters, mount/pivot_root for the rootfs, and SELinux/AppArmor labels. container internals beyond the basics.
Method-aware authorization with Istio policy
An ALLOW policy on user-service granting frontend's principal POST plus the users path, another granting all principals GET; deny is implicit once any ALLOW exists. identity- and method-scoped authz.
How a service mesh enables automatic mTLS
The control plane issues short-lived workload certificates, sidecars present them, both sides verify identity and encrypt the channel. identity and the data-plane handshake.
Managing secrets in a GitOps workflow
Never commit plaintext; encrypt with Sealed Secrets or SOPS, or reference an external store via External Secrets Operator. secrets in declarative pipelines. base64-encoding a Secret and calling it secure.
ConfigMap vs Secret
ConfigMaps hold non-sensitive plain config; Secrets hold sensitive data, base64-encoded and treated specially (RBAC, optional encryption at rest). Config-versus-sensitive-data separation.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.