Learn hub
Cloud security, defined
Neutral, educational definitions of the terms that matter most in cloud access and operational safety. Each page is written to be cited, not to sell.
Core concepts
- What is a cloud guardrail?A cloud guardrail is a policy or control that limits what actions can happen in a cloud environment, without stopping developers from working.
- What is a destructive action?A destructive action is any cloud operation that deletes, disables, or permanently damages live systems or data. The defining characteristic is that the effect is hard or impossible to reverse.
- What is an over-permissioned identity?An over-permissioned identity is a cloud user, role, or service account that holds more permissions than it needs for the work it actually does. Industry research finds this applies to most cloud identities.
- What is blast radius?Blast radius is the maximum damage one compromised or mistaken identity can cause in a cloud environment. Smaller blast radius means a single bad action affects fewer systems.
- What is intent-based detection?Intent-based detection reads a sequence of actions to understand what a session is trying to accomplish, rather than matching individual commands against a list of known-bad patterns.
- What is least privilege?Least privilege means giving an identity only the permissions it needs for its current task, and nothing more. It is the foundational principle behind modern cloud access control.
- What is the four-eyes principle?The four-eyes principle requires a second person to review and approve a sensitive action before it happens. No single person can execute a high-risk change alone.
Access patterns
- What are short-lived credentials?Short-lived credentials are access keys or tokens that expire automatically after a defined window, typically minutes to hours. Expiry replaces the need to remember to revoke.
- What are zero standing privileges?Zero standing privileges (ZSP) means no identity holds permanent access to production systems. Credentials exist only for the duration of a specific, approved task.
- What is break-glass access?Break-glass access is emergency access to a system that bypasses normal approval controls, intended for incidents where waiting for approval would cause more harm than acting immediately.
- What is just-in-time (JIT) access?Just-in-time access means granting cloud credentials only when someone needs them, for a specific task, and revoking them automatically when the window closes.
- What is privileged access management (PAM)?Privileged access management is the practice and tooling for controlling, monitoring, and auditing access to critical systems. Traditionally built for enterprises with on-prem infrastructure.
Native-cloud reference
- AWS IAM roles vs users vs Identity CenterIAM users are long-lived identities with permanent credentials. IAM roles are assumable identities that issue temporary credentials. AWS IAM Identity Center is the recommended way to manage human access to AWS today.
- What are AWS service control policies (SCPs)?Service control policies are AWS Organizations-level guardrails that set the maximum permissions available to any identity in a member account, regardless of what IAM allows.
- What are Azure resource locks?Azure resource locks are management-layer controls that prevent a resource from being deleted or modified, independent of what RBAC permissions a user holds.
- What are GCP project liens?A GCP project lien is a restriction placed on a Google Cloud project that prevents it from being deleted until the lien is explicitly removed.
- What is AWS termination protection?Termination protection is a flag on AWS EC2 instances and CloudFormation stacks that prevents accidental deletion. It must be explicitly disabled before the resource can be terminated.