Advanced Cloud Security for AWS, Azure, & Google Cloud

Name: Advanced Cloud Security for AWS, Azure, & Google Cloud
Rating: 4.6 (30 reviews)

How to secure cloud operations with hands-on tactics using native tools and CIS, ISO, and NIST compliance frameworks

Role Play

Created bySTARWEAVER GROUP, Paul Siegel, Luca Berton

Last updated 4/2026

English

ArabicGerman

What you'll learn

Differentiate the security responsibilities of the cloud provider vs. the customer across IaaS, PaaS, and SaaS service models within cloud operations
Configure IAM roles, security groups, and VPC firewalls across AWS, Azure, and Google Cloud to enforce least-privilege access
Deploy and operationalize cloud-native security services (e.g., AWS GuardDuty, Azure Defender, Google Cloud SCC) to detect threats and manage incident response.
Map application and infrastructure workloads to CIS Benchmarks, ISO/IEC 27001, and the NIST Cybersecurity Framework, producing audit-ready evidence artifacts

Course content

15 sections • 58 lectures • 5h 34m total length

Intro Video to Course4:07
Introduction to the course, key topics to be covered, and call to action.
Welcome to the Course: Course Overview3:15

Introduction to Section3:40
Introduction to the section, key topics to be covered, and call to action.
Identify IaaS, PaaS, and SaaS Services9:30
Learners will explore foundational cloud service models through real-world examples and plain-language definitions, enabling them to identify what components they must secure in different deployment scenarios across AWS, Azure, and GCP.
Compare Cloud Providers and Launch Core Services5:50
A guided tour of AWS, Azure, and GCP consoles where learners will launch common services (VMs, databases, SaaS apps) and compare how each maps to the IaaS, PaaS, or SaaS model, reinforcing shared responsibility understanding.
Multi-Cloud Zero Trust Architecture6:20
A comprehensive overview of Zero Trust and Confidential Computing concepts across AWS, Azure, and Google Cloud, exploring theoretical frameworks and architectural principles for secure multi-cloud environments.
Service-Model Cheat-Sheet0:17

Recognize the Components of a Virtual Machine8:03
An introduction to virtual machines (VMs), explaining compute resources like CPU, memory, and OS images, so learners can choose and configure secure base infrastructure.
Explore Database and Object Storage Options11:46
Learners will distinguish between structured (RDS) and unstructured (S3/Blob) cloud storage, with a focus on performance, access control, and use cases.
Visualize Cloud Networking and Firewall Concepts8:41
This session covers subnets, IP ranges, and firewalls using real-world analogies, then explains why “0.0.0.0/0” is dangerous and how to scope secure network access.
Glossary: Compute-Storage-Network0:19

Explain Shared Responsibility Using Pizza-as-a-Service7:42
A fun visual analogy to illustrate which security tasks belong to the cloud provider and which are owned by the user a critical concept in any cloud model.
Create a Least-Privilege IAM User9:34
Learners will create a read-only user using IAM tools, learning how to reduce risk by limiting permissions to only what’s needed for a task.
Enable Multi-Factor Authentication (MFA) on an Account6:17
Learners will strengthen access controls by enabling MFA for IAM users, practicing secure configuration steps using AWS Console.
Step-by-Step IAM Setup0:18
Building a Shared Responsibility Matrix in the Cloud0:11
Apply Shared Responsibility and Set Up IAM Basics

Introduction to Section3:02
Introduction to the section, key topics to be covered, and call to action.
Launch a Secure OS Image from a Trusted Source9:15
Learners will select an official or LTS image (e.g., Ubuntu/CentOS) that aligns with CIS Benchmarks and understand the importance of image provenance.
Enable Automatic Patching and Logging10:18
This video walks learners through activating OS-level updates and basic logging features like CloudWatch or Log Analytics, building a foundation for secure operations.
Configure SSH Key-Based Access and Disable Passwords9:46
Learners will generate and apply SSH keys, disable password authentication, and understand deny-overrides to prevent unauthorized VM access.

Explain Port Rules with Real-World Analogies8:05
Explains how inbound and outbound port rules work using a door-and-bouncer analogy, setting learners up to make informed firewall decisions.
Build a Web-Only Security Group12:10
Learners will create a security group allowing only HTTP and HTTPS traffic (ports 80/443), simulating a real-world web application firewall.
Validate Security Group Rules Using cURL and Analyzer Tools7:38
Demonstrates how to use curl and AWS Reachability Analyzer to confirm the firewall is blocking all but web traffic, reinforcing secure access configuration.
Security-Group Starter Template0:19

Enable Encryption at Rest Using Managed Keys6:56
Learners will turn on KMS-backed encryption for RDS and S3 and understand why encrypted data at rest is essential for compliance and security.
Prevent Public Access to Buckets6:08
Guides learners through enabling S3 public-access blockers, explaining how misconfigured buckets lead to data leaks and compliance issues.
Set Up Backup and Snapshot Schedules7:22
Learners will schedule automated snapshots and backups, ensuring data resilience in case of deletion or breach.
Storage Safety Checklist0:19
Designing a Secure Cloud Architecture with Compute, Network, and Storage Control0:09
Protect Data in Databases and Storage Buckets

Introduction to Section3:05
Introduction to the section, key topics to be covered, and call to action.
Activate Guard Duty, Azure Defender, or Google SCC6:45
Learners will activate one or more no-cost security tools in their sandbox account and understand the role of each in detecting suspicious activity.
Interpret Sample Security Findings7:54
Learners will explore real alerts (e.g., port scanning, reconnaissance) and learn how to read and react to each alert severity and source.
Triage Low-Severity and False Positive Alerts9:33
This session trains learners to differentiate between info-level alerts, medium threats, and false positives, reducing noise in detection systems.

Enable Logging for Cloud API Activity6:27
Shows how to activate CloudTrail or its equivalents, ensuring full visibility into all account activity for forensic readiness.
Search Logs for Risky Events (e.g., Delete/Stop)7:22
Learners will filter logs for delete or terminate actions using predefined queries, laying the foundation for security monitoring.
Export Logs for Retention and Audit8:17
Covers how to export logs to S3 or blob storage for long-term retention, compliance, or SIEM ingestion.
Log Query Cheat-Sheet0:45

Revoke Compromised Access Keys Immediately7:34
Learners will identify and deactivate compromised IAM credentials as part of a rapid containment process.
Capture a Snapshot for Forensic Analysis10:03
This session teaches how to preserve VM state by creating an image or volume snapshot before taking further action.
Complete a Post-Mortem Using a Simple Template8:05
Learners complete a 5-question IR template to analyze the root cause, impact, and remediation steps after a mock incident.
One-Page IR Checklist0:30
Responding to a Cloud Security Incident with Detection and Forensics0:09
Respond to Incidents with Minimal Tools

Requirements

Learners should have a basic understanding of networking and virtualization, along with some experience using at least one major cloud platform such as AWS, Azure, or Google Cloud. While deep cloud security knowledge isn't required, learners should be comfortable navigating cloud consoles and launching basic resources.

Description

The Advanced Cloud Security for AWS, Azure, & Google Cloud specialization is designed to provide beginners with a practical, security-first understanding of how to deploy, harden, and validate cloud-based environments across AWS, Microsoft Azure, or Google Cloud. Through this program, learners will gain hands-on experience identifying common cloud misconfigurations such as exposed virtual machines, open storage buckets, overly permissive access policies, and unmanaged credentials and understand how these issues can rapidly escalate into real-world breaches.

Following a structured, step-by-step curriculum, each module utilizes free-tier services, simple checklists, and guided walkthroughs to help learners build confidence while securing foundational cloud components. Participants will learn how different cloud service models (IaaS, PaaS, and SaaS) impact security decisions, how the shared-responsibility model defines the division of security responsibilities between the provider and the customer, and which built-in protections can reduce risk significantly.

The specialization emphasizes practical cloud security controls such as identity and access management basics, secure networking defaults, storage access restrictions, logging and monitoring essentials, and baseline hardening for compute instances. Learners will also practice reviewing configurations with an audit mindset, documenting security evidence, and validating improvements through repeatable checks.

By the end of this program, learners will have tested a cloud virtual machine against the CIS Benchmark, collected and exported audit-ready evidence into a structured folder, and created a printable ten-control security checklist for use in future cloud projects. This specialization prepares aspiring cloud practitioners, IT professionals, and security newcomers to secure real environments responsibly, communicate security posture clearly, and develop habits to consistently reduce cloud security risk through repeatable operational practices.

Who this course is for:

This course is designed for cloud engineers, DevOps engineers, security analysts, and solution architects seeking to strengthen their practical skills in securing cloud operations. It’s ideal for anyone who is responsible for building, operating, or reviewing cloud infrastructure and looking for a hands-on, security-first approach to securing cloud workloads.

Advanced Cloud Security for AWS, Azure, & Google Cloud

What you'll learn

Explore related topics

Course content

Course Introduction2 lectures • 7min

Understand Cloud Service Models (IaaS, PaaS, SaaS)5 lectures • 26min

Classify Compute, Storage, and Networking Resources4 lectures • 29min

Apply Shared Responsibility and Set Up IAM Basics5 lectures • 24min

Harden a Virtual Machine Before Use4 lectures • 32min

Control Network Access with Security Groups and Firewalls4 lectures • 28min

Protect Data in Databases and Storage Buckets5 lectures • 21min

Detect Threats Using Built-In Security Tools4 lectures • 27min

Investigate Cloud Activity with Logs4 lectures • 23min

Respond to Incidents with Minimal Tools5 lectures • 26min

Requirements

Description

Who this course is for: