Separate provider and customer security responsibilities.
Secure images, workload identities, and cloud policy.
Limit metadata, network, and storage exposure.
Cloud security is shared responsibility: the provider secures parts of the platform while the customer configures identities, data, workloads, and applications. Containers isolate processes but are not a complete security boundary; image provenance, runtime privileges, host security, and orchestration policy matter.
Prefer short-lived workload identity over embedded keys. Restrict metadata services, storage policies, management planes, and administrative roles. Infrastructure as code makes changes reviewable, but state files and pipeline credentials need protection.
Exercises
Map shared-responsibility boundaries for a managed database.
Harden a container deployment.
Threat-model infrastructure-as-code credentials.
Self-check
Are containers equivalent to virtual machines?
What is workload identity?
Why protect infrastructure state?
Self-Check Quiz
1. Who configures customer cloud access policies?
AnswerThe customer is responsible for its identities, policies, data, and workload configuration within the provider's model.
2. Why run containers as non-root?
AnswerTo reduce the privileges available if the application process is compromised.
Homework
Design a secure cloud deployment for an API.
Specify image, identity, network, storage, and pipeline controls.
Explain one shared-responsibility assumption.
Sample answerUse signed minimal images, non-root read-only workloads, scoped workload identities, private data services, network policy, secret management, protected state, policy-as-code, logging, and deployment verification. The provider may secure infrastructure, but the customer remains responsible for data access policy and application vulnerabilities.