Cloud Concepts, Containers and Serverless

What it is

Cloud computing delivers computing resources over a network on demand, so customers rent capacity instead of owning hardware. The NIST definition (SP 800-145) lists five essential characteristics, three service models and four deployment models.

Containers package an application with its dependencies so it runs the same everywhere. Serverless computing runs small functions without the customer managing servers. The exam asks you to name models, place responsibilities and spot security issues in containers and functions.

How it works

Cloud concepts

Five NIST characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.

Shared responsibility model: the provider secures the cloud itself (facilities, hardware, base services), and the customer secures what they put in the cloud (data, identities, configuration). The more managed the service, the more the provider handles, but the customer always owns their data and access control.

Other terms: multi-tenancy means several customers share the same hardware, and a hypervisor is the software that creates and runs virtual machines.

Container technology

A container is a lightweight, isolated process that bundles an application and its libraries. Unlike a virtual machine it shares the host's operating system kernel, so it starts fast but isolates less.

Kubernetes components: the API server (the control point), etcd (the key value store holding cluster state and secrets), the scheduler, the controller manager, and on each node the kubelet and kube-proxy. Workloads run in pods.

Container security issues:

• Images with known vulnerabilities or hidden malware, often from untrusted registries.
• Secrets baked into images.
• Containers run as root or in privileged mode, which makes escape to the host easier.
• An exposed Docker daemon API (unencrypted API port 2375) or an open Kubernetes API or kubelet.
• Weak role based access control (RBAC) and no network policies between pods.
• Container escape through a kernel or runtime flaw, which gives access to the host.

Countermeasures include scanning images (tools such as Trivy, Clair and Anchore), using trusted and signed images, running as a non-root user, dropping capabilities, restricting the API with authentication and TLS, enabling RBAC and network policies, and auditing with benchmarks (Docker Bench for Security, kube-bench). The tool kube-hunter looks for weaknesses in a cluster.

Serverless computing

In serverless computing, also called function as a service (FaaS), the customer uploads code that runs in response to events, and the provider handles servers, scaling and patching. Examples include AWS Lambda, Azure Functions and Google Cloud Functions. Billing is by execution.

Serverless security issues:

• Event data injection: input from triggers (storage events, messages, HTTP requests) is trusted and not validated.
• Over privileged function roles: a function that can do more than it needs lets an attacker move further.
• Vulnerable dependencies in packaged libraries.
• Secrets stored in code or environment variables in clear text.
• Denial of service and "denial of wallet": floods of invocations raise cost or exhaust limits.
• Limited visibility: short lived functions leave few traces unless logging is enabled.

Countermeasures: validate every event input, give each function the least privilege role, scan dependencies, keep secrets in a managed secrets store, set concurrency and budget limits, and log invocations.

A worked example

A team runs a web app in containers on Kubernetes. A scan shows the kubelet API is reachable from the internet without authentication, and several pods run in privileged mode.

An attacker could run commands in containers and escape to the node. The fix is to restrict API access, require authentication, remove privileged mode, and apply network policies. Image scanning in the build pipeline would catch vulnerable components earlier.

How the exam asks about this

• "In which service model does the customer manage the operating system?" → IaaS.
• "Which Kubernetes component stores cluster state and secrets?" → etcd.
• "What is another name for serverless computing?" → Function as a service.