More in DevOps & Cloud — page 48
Data Sovereignty: Your Data's Legal 'Citizenship'
Data sovereignty means data is subject to the laws of the country it's in; data residency is storing it there to comply. This is critical for apps in regions with strict laws like the EU's GDPR. The footgun is confusing residency with full legal compliance.
CSPM: A Single Pane of Glass for Cloud Security
A CSPM is a single pane of glass for your cloud security, continuously scanning all assets for misconfigurations. It unifies security data across multi-cloud environments, replacing disparate tools.
Zero Trust: Never Trust, Always Verify
Zero Trust assumes no user or device is safe by default, even on a 'trusted' corporate network. It's like needing a keycard for every door, not just the front gate. The biggest mistake is thinking you can buy a 'Zero Trust' product; it's a strategic.
DDoS Mitigation: Surviving Traffic Floods
DDoS mitigation acts like a smart bouncer, learning your app's normal traffic to block malicious floods. It's used for any public internet endpoint, filtering attacks at the network and transport layers (L3/L4).
Identity Federation: One Login for Many Services
Identity federation lets one trusted system vouch for a user's identity to many apps, like using a driver's license at multiple venues. This powers "Sign in with Google" and corporate SSO, but don't confuse it with simple user directory syncing.
Cloud Audit Trail: The 'Who Did What' Record
Think of a cloud audit trail as security camera footage for your infrastructure, recording who did what, where, and when. It's essential for investigating security incidents, proving compliance, and debugging operational issues.
Single Sign-On (SSO): One Login, Many Apps
Single Sign-On (SSO) lets you log in once to access multiple apps. Instead of juggling passwords for Slack and Jira, you authenticate with one central service. This simplifies corporate IT access management.
Web Application Firewall (WAF): Your App's HTTP Bodyguard
A Web Application Firewall (WAF) is a specialized bodyguard for your web app, inspecting all HTTP traffic for malicious requests. It blocks common attacks like SQL injection and XSS by matching traffic against known patterns.
Key Management Service (KMS): Don't Roll Your Own Crypto
A KMS is a secure vault for your cryptographic keys. Instead of storing secrets in code or config, you ask the KMS to perform cryptographic operations for you. It's used for encrypting database fields, signing data, and managing secrets for microservices.
Service Principal: Your App's Identity
A service principal is an application's identity in a specific security context, like a "robot user." It's the local instance that gets permissions, separate from the app's global blueprint. This is how CI/CD pipelines authenticate to cloud APIs.
Encryption in Transit: Protecting Data on the Move
Encryption in transit acts like a locked box for data moving across a network. It secures everything from website connections (HTTPS) to data moving between services inside a cloud network.
Multi-Factor Authentication (MFA): Defense in Depth for Logins
MFA adds a second layer of security on top of your password, like needing a key and a secret handshake. It's crucial for protecting sensitive accounts like email and banking from attackers who have stolen your password.
RBAC: Manage Permissions with Roles, Not Users
RBAC manages permissions by assigning users to roles (e.g., "editor"), not by giving permissions directly. This simplifies security in large systems like AWS IAM. The footgun is creating overly broad roles that grant excessive, unintended access.
CDN Edge Computing: Code at the Cache
CDN Edge Computing runs your code at the network edge, not just caches files. It's for low-latency tasks like A/B testing or auth checks. The footgun is treating it like a full backend; it's stateless and resource-constrained.
Global Server Load Balancing (GSLB): DNS for High Availability
Global Server Load Balancing (GSLB) uses DNS to route users to the best data center, not just the best server. It considers geography, health, and load to provide disaster recovery and lower latency.
Cloud Direct Connect: A Private Lane to the Cloud
Think of Direct Connect as a private fiber-optic highway from your datacenter to the cloud, bypassing the public internet. It's for stable, high-bandwidth needs like large data transfers where public internet performance is too unpredictable or insecure.
DNS Routing Policies: Directing Traffic with Intention
DNS routing policies are a control plane for your domain, directing users based on location, latency, or server health. Use them for disaster recovery (failover) or canary releases (weighted). The footgun: confusing geolocation with latency-based routing.
Load Balancer Health Checks: Don't Route to Dead Servers
A load balancer uses health checks to ask backend servers "Are you alive?" before sending them traffic. This is essential for any high-availability setup, preventing users from being routed to a crashed or unresponsive instance.
VPC Peering: Connect Private Networks Securely
VPC peering connects two virtual networks as if they were one, letting them talk over private IPs. Use it to share files or access resources between VPCs across accounts or regions without going over the public internet.
Network ACLs: A Stateless Firewall for Subnets
A Network ACL (NACL) is a firewall for an entire cloud subnet, checking traffic as it enters or leaves. It's used for broad, stateless rules, like blocking a malicious IP from all instances.