HackBlue

Tools · Workbench

Cloud security

Tutorials on AWS IAM, S3 exposure, CloudTrail, GuardDuty, Azure and Entra ID basics, and least privilege you can verify.

  • 24 lessons
  • 4 h of reading
  • 7 topics
Start with lesson 1All workbenches

Cloud breaches are rarely clever. They are usually a public bucket, a key in a repository, or a role that can do far more than its job needs. These tutorials show how the permission systems work and how to audit your own account with the provider’s CLI.

Use a sandbox account with billing alerts turned on. Every command here is read-only or applies to resources you created for the lesson.

Foundations

1 lesson

  1. 01The cloud shared responsibility model explained with real examplesSee exactly which security tasks the provider handles and which stay with you for virtual machines, managed databases, and serverless functions.9 min

AWS IAM

5 lessons

  1. 01How AWS IAM policy evaluation works: explicit deny, allow, SCPs, and boundariesFollow the order AWS uses to decide whether a request is allowed, read a policy statement, and use the policy simulator to test a decision before it surprises you.12 min
  2. 02Least privilege in AWS with IAM Access Analyzer: unused access and generated policiesUse Access Analyzer to find resources shared outside your account, flag unused roles and permissions, and generate a policy from real CloudTrail activity.10 min
  3. 03How to secure the AWS root user: MFA, no access keys, and alertsLock down the AWS account root user with phishing-resistant MFA, delete its access keys, set alternate contacts, and alert on any root sign-in.9 min
  4. 04Find old and unused AWS access keys with the IAM credential reportGenerate the credential report, find keys older than 90 days or never used, rotate keys without downtime, and replace long-lived keys with roles.10 min
  5. 05AWS IAM roles and AssumeRole explained: trust policies and temporary credentialsUnderstand the two policies every role has, assume a role from the CLI, add an external ID and MFA condition, and read AssumeRole events in CloudTrail.10 min

S3 and storage

3 lessons

  1. 01S3 Block Public Access explained: the four settings and where to turn them onUnderstand each Block Public Access setting, enable it at the account level, and check buckets that still need a deliberate exception.9 min
  2. 02How to review an S3 bucket policy for public and cross-account accessRead a bucket policy line by line, spot Principal "*" and missing conditions, enforce TLS and organization-only access, and test with the policy checker.10 min
  3. 03Protect S3 data from deletion and ransomware: versioning, Object Lock, and KMSTurn on versioning, use Object Lock for immutable backups, pick SSE-S3 or SSE-KMS, and add MFA delete or a deny policy for deletions.10 min

Logging and detection

6 lessons

  1. 01How to set up AWS CloudTrail correctly: organization trail, validation, and protectionCreate a multi-region organization trail to a dedicated logging account, enable log file validation, protect the bucket, and decide which data events to add.10 min
  2. 02Investigating AWS CloudTrail logs: who did what, from where, with which credentialsRead a CloudTrail record field by field, follow an access key through its events, and answer the first questions of a cloud incident with the CLI and jq.11 min
  3. 03How to triage Amazon GuardDuty findings: severity, finding types, and first stepsRead a GuardDuty finding type name, map severity to response time, generate sample findings, and handle the most common credential and EC2 findings.10 min
  4. 04Find AWS security groups open to the internet on SSH, RDP, and databasesQuery security groups for 0.0.0.0/0 and ::/0 rules on sensitive ports, see which instances use them, and replace them with Session Manager or scoped rules.9 min
  5. 05What is IMDSv2 and how to enforce it on EC2Understand why the instance metadata service is a target for SSRF, how IMDSv2’s session tokens help, and how to require it on existing and new instances.9 min
  6. 06AWS Secrets Manager vs Parameter Store: storing application secrets safelyChoose between Secrets Manager and SSM Parameter Store SecureString, grant a role access to one secret, rotate a database password, and keep secrets out of code and environment files.9 min

Azure and Entra ID

6 lessons

  1. 01Microsoft Entra Conditional Access policies: a beginner walkthroughLearn how Conditional Access combines users, apps, conditions, and controls into if-then rules, and how to roll out MFA safely with report-only mode and break-glass accounts.11 min
  2. 02Investigating Entra ID sign-in logs: error codes, locations, and password spray patternsRead interactive and non-interactive sign-in logs, decode common result codes such as 50126 and 50053, and query them with KQL to spot password spraying.12 min
  3. 03Reviewing Azure RBAC role assignments: scopes, Owner sprawl, and custom rolesUnderstand how Azure role assignments combine a principal, a role, and a scope, and list who holds Owner or User Access Administrator across your subscriptions.10 min
  4. 04Just-in-time admin access with Entra Privileged Identity Management (PIM)Replace standing administrator rights with eligible assignments that require activation, justification, MFA, and optional approval, and audit who activated what.9 min
  5. 05Azure Storage account security: public blob access, shared keys, and SAS tokensCheck whether storage accounts allow anonymous blob access or shared key authorization, understand SAS token risk, and lock accounts down with Entra ID authorization.10 min
  6. 06Azure Activity Log and Microsoft Defender for Cloud: what to collect and reviewLearn what the Activity Log records, how it differs from resource logs and Entra logs, and how to use Defender for Cloud recommendations and secure score to prioritize fixes.10 min

Google Cloud

1 lesson

  1. 01Google Cloud IAM and service account keys: why to avoid them and what to use insteadUnderstand GCP IAM bindings and basic roles, find long-lived service account keys, and replace them with attached service accounts, impersonation, or Workload Identity Federation.10 min

Tools and posture

2 lessons

  1. 01Scanning your cloud account with Prowler: run, read, and prioritize findingsRun the open-source Prowler scanner against a sandbox AWS or Azure account with read-only access, read the output, and turn hundreds of findings into a short fix list.11 min
  2. 02Leaked cloud access key: a first-hour response checklistA calm, ordered checklist for when an access key or service account key shows up in a public repository: contain, scope with logs, remove persistence, and rotate.9 min