Securing Cloud Workloads

What you will be able to do

• You will be able to design cloud network segmentation using VPCs and VNets, subnets, security groups, and NACLs to contain the blast radius of a compromise.
• You will be able to apply zero-trust segmentation, private connectivity, and egress controls to stop lateral movement and data exfiltration.
• You will be able to harden hosts and container images and secure the build-to-deploy supply chain with scanning, SBOMs, and signed, verified provenance.
• You will be able to secure Kubernetes and serverless workloads with RBAC, Pod Security Standards, network policies, and least-privilege execution roles.
• You will be able to eliminate long-lived credentials by using workload identity, secrets managers, and short-lived, automatically rotated secrets.
• You will be able to design a key hierarchy with a cloud KMS and HSMs, using envelope encryption, customer-managed keys, and enforced rotation and separation of duties.
• You will be able to enforce encryption in transit with TLS and mutual TLS, including certificate lifecycle and service-mesh patterns.
• You will be able to select and implement encryption-at-rest models (provider-managed, customer-managed, and client-side or BYOK) and assemble the layers into a defense-in-depth workload architecture.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   Network Security and Segmentation

   The cloud network is a workload's outermost control and its best tool for containing a breach. This module starts with the primitives you build with (VPCs and VNets, subnets, security groups, NACLs, and routing), then shows how to segment web, app, and data tiers so one compromised host cannot reach the whole environment. From there it advances to zero trust: micro-segmentation, private connectivity, and tight egress control that shut down lateral movement and data exfiltration.

   2 lessons · 5 quiz questions

2. 02

   Workload and Container Security

   Once the network contains a workload, the workload itself has to be hard to compromise. This module hardens the compute layer end to end: instance and image baselines, minimal container images, and a scanned, signed build-to-deploy supply chain, then secures how workloads run with Kubernetes RBAC, Pod Security Standards, network policies, serverless least privilege, and runtime threat detection.

   2 lessons · 5 quiz questions · assignment

3. 03

   Secrets and Key Management

   Workloads need credentials and cryptographic keys, yet a long-lived secret sitting in plaintext is the credential class attackers exploit most. This module retires static keys in favor of workload identity and short-lived, automatically rotated secrets drawn from a managed store, then builds the key layer beneath them: a KMS-backed hierarchy using envelope encryption, customer-managed keys, HSM protection, and enforced rotation with separation of duties. You will leave able to design a cloud key and secrets architecture that holds no standing secrets and keeps every key use auditable and controlled.

   2 lessons · 5 quiz questions

4. 04

   Encryption in Transit and at Rest

   With keys and access under control, the last mile is the data itself, moving on the wire and sitting on disk. This module implements encryption in transit with TLS 1.3 and mutual TLS, including the certificate lifecycle and the service-mesh patterns that make workload identity manageable at scale. It then works across the encryption-at-rest spectrum, from provider-managed keys to customer-managed, client-side, and bring-your-own-key models, so you can match key control to data sensitivity. You finish by layering network, workload, secrets, and cryptographic controls into a single threat-modeled workload you could defend in a design review.

   2 lessons · 5 quiz questions · assignment