Security
Security in the cloud refers to the measures, protocols, and practices put in place to protect data, applications, infrastructure, and resources stored…
- Docker & Rancher Desktop Tutorials
Docker Image Security: Scan with Trivy and Harden Your Containers
Secure Docker images and containers: scan for vulnerabilities with Trivy or Docker Scout, pin base images, run as non-root, read-only, drop capabilities, manage secrets.
- Docker & Rancher Desktop Tutorials
Docker Multi-Stage Builds: Smaller and More Secure Images
Use Docker multi-stage builds to separate the build from the runtime: examples in Go and Node.js, build targets, distroless images and non-root users.
AWS Management and Governance
AWS Organizations
AWS Organizations lets you manage many AWS accounts centrally: organizational units, consolidated billing and service control policies to set guardrails.
AWS Security, Identity and Compliance
AWS WAF
AWS WAF is a web application firewall that filters HTTP requests with rules and managed rule groups to block SQL injection, XSS, bots and abusive traffic.
AWS Management and Governance
AWS CloudTrail
AWS CloudTrail records the API calls and account activity in AWS, so you can audit who did what, when and from where, and investigate security incidents.
- Terraform & OpenTofu Tutorials
AWS with Terraform Tutorial: Terraform Tools (20)
The essential tools for Terraform and OpenTofu: fmt, validate, TFLint, Trivy, Checkov, terraform-docs, Infracost and pre-commit hooks.
AWS Security, Identity and Compliance
AWS Certificate Manager (ACM)
AWS Certificate Manager (ACM) issues, stores and automatically renews free public TLS certificates for load balancers, CloudFront and API Gateway.
- Terraform & OpenTofu Tutorials
AWS with Terraform Tutorial: Terraform Backends (19)
Store the Terraform or OpenTofu state in an encrypted, versioned S3 bucket with native state locking, and migrate the local state to it.
AWS Security, Identity and Compliance
AWS Secrets Manager
AWS Secrets Manager stores, retrieves and automatically rotates database credentials, API keys and other secrets, encrypted with AWS KMS.
AWS Security, Identity and Compliance
AWS KMS
AWS Key Management Service (KMS) creates and controls the cryptographic keys that encrypt data in S3, EBS, RDS, Secrets Manager and many other AWS services.
AWS Networking and Content Delivery
AWS Network ACLs
A network access control list (NACL) is a stateless firewall that allows or denies traffic at the subnet level of an AWS VPC, using numbered rules.
AWS Networking and Content Delivery
AWS Security Groups
A security group is a stateful virtual firewall that controls the inbound and outbound traffic of AWS resources such as EC2 instances and databases.
Security
HashiCorp Vault
HashiCorp Vault is a secrets manager that stores, generates and encrypts credentials, tokens and keys with fine-grained access control and audit logs.
- Terraform & OpenTofu Tutorials
Install HashiCorp Vault with Docker: Secrets, Policies and Terraform
Run Vault in dev mode, store secrets in the KV engine, restrict access with policies and tokens, and read them from the CLI, curl and Terraform.
- Security
Checkov
Checkov is an open source static analysis tool that scans Terraform, Kubernetes and Dockerfile code for security and compliance misconfigurations.
- Terraform & OpenTofu Tutorials
AWS IAM Roles and Policies with Terraform and OpenTofu
How to create IAM roles, policies, instance profiles and assume-role trust relationships with Terraform or OpenTofu, following least privilege, with AWS examples.
- Terraform & OpenTofu Tutorials
Terraform and OpenTofu with GitHub Actions and AWS OIDC (No Access Keys)
Run Terraform or OpenTofu plan on pull requests and apply on merge with GitHub Actions, authenticating to AWS with OIDC and short-lived credentials.
- Terraform & OpenTofu Tutorials
AWS S3 Buckets with Terraform and OpenTofu: Secure Configuration
Create secure AWS S3 buckets with Terraform or OpenTofu: public access block, encryption with KMS, versioning, lifecycle rules and bucket policies.
Security
Trivy
Trivy is an open source security scanner that finds vulnerabilities, misconfigurations and secrets in container images, code and infrastructure files.
Security
cert-manager
cert-manager is a Kubernetes add-on that issues and renews TLS certificates automatically, for example from Let's Encrypt.
Security
GnuPG
GnuPG (GPG) is the free implementation of OpenPGP used to sign and encrypt files, emails and software packages with key pairs.
- Terraform & OpenTofu Tutorials
Terraform Secrets Management: Keep Passwords Out of Code and State
How to handle secrets in Terraform and OpenTofu: sensitive variables, AWS Secrets Manager, SSM, generated passwords, ephemeral values and state encryption.
- Kubernetes Tutorials
Kubernetes Namespaces and RBAC: Roles, ServiceAccounts, Quotas and kubectl auth can-i
Split a cluster with namespaces and control access with RBAC: Roles, ClusterRoles, bindings, ServiceAccounts, quotas, limit ranges and how to fix Forbidden errors.
- Terraform & OpenTofu Tutorials
Terraform Security Scanning with tflint, Checkov and Trivy
Find misconfigurations in Terraform and OpenTofu code before deploying: tflint for errors, Checkov and Trivy for AWS security issues, with CI examples.
- Terraform & OpenTofu Tutorials
AWS Organizations and Multi-Account Setup with Terraform
Design and create a multi-account AWS landing zone with Terraform or OpenTofu: AWS Organizations, OUs, accounts, service control policies and cross-account roles.
- Terraform & OpenTofu Tutorials
AWS KMS and Secrets Manager with Terraform: Encrypt and Store Secrets
Create KMS keys with rotation and policies, and store and read secrets in AWS Secrets Manager and SSM Parameter Store with Terraform or OpenTofu, safely.
- Terraform & OpenTofu Tutorials
AWS Security Monitoring with Terraform: CloudTrail, GuardDuty, Config and Security Hub
Enable AWS security services with Terraform or OpenTofu: an organization CloudTrail, GuardDuty, AWS Config and Security Hub, with encrypted log storage.
AWS Management and Governance
AWS Config
AWS Config records the configuration of AWS resources over time and evaluates them against rules for compliance and auditing.
AWS Security, Identity and Compliance
AWS Security Hub
AWS Security Hub aggregates security findings from AWS services and partners and checks accounts against standards such as CIS and AWS Foundational Best Practices.
- Terraform & OpenTofu Tutorials
AWS Systems Manager Session Manager with Terraform: SSH Without Open Ports
Connect to EC2 instances without SSH keys, bastion hosts or open port 22 using AWS Systems Manager Session Manager, configured with Terraform or OpenTofu.
AWS Security, Identity and Compliance
AWS Cognito
Amazon Cognito provides user sign-up, sign-in and access control for web and mobile apps, with user pools and identity pools.
AWS Security, Identity and Compliance
AWS GuardDuty
Amazon GuardDuty is a managed threat detection service that analyzes CloudTrail, VPC flow and DNS logs to find compromised resources and attacks.
AWS Management and Governance
AWS Control Tower
AWS Control Tower sets up and governs a secure multi-account AWS environment (landing zone) with guardrails, account factory and centralized logging.
AWS Security, Identity and Compliance
AWS IAM Identity Center
AWS IAM Identity Center (formerly AWS SSO) gives people single sign-on access to multiple AWS accounts and applications with permission sets.
- AWS Best Practices
AWS Security Groups’ Best Practices
Best practices for AWS security groups, the virtual firewalls of EC2, RDS and other resources: naming, groups as sources, least privilege and rule descriptions.