Cloud Application Architecture

What it is

Cloud applications are protected by more than their own code. Supplemental security components sit in front of or beside them, cryptography protects their data and traffic, sandboxing contains untrusted code, and virtualization and orchestration platforms such as containers and Kubernetes decide how they run.

The CCSP expects you to know what each component does and when to use it.

How it works

Supplemental security components

DAM is valuable because it records activity separately from the database, so a privileged insider cannot quietly change the record. It can be agent based on the database host or network based.

Cryptography in cloud applications

• In transit: TLS between users and the application and between internal services; mutual TLS between microservices.
• At rest: storage and database encryption with keys from a KMS; field level encryption for the most sensitive values.
• Keys and secrets: fetched at run time from a secrets manager or KMS, never embedded in code or images.
• Where TLS terminates: if a load balancer decrypts traffic for inspection, traffic onward to the application should be re-encrypted.

Sandboxing

A sandbox runs code in a restricted environment where it cannot harm the host or other workloads. Uses include:

• Running untrusted or customer supplied code, as serverless platforms and browsers do.
• Detonating suspicious files to observe behaviour.
• Testing new versions safely before release.

Sandboxes limit file system, network and system call access. Their strength depends on the isolation technology, from language level sandboxes up to dedicated lightweight virtual machines.

Application virtualization and orchestration

Key Kubernetes concepts:

• Pods are the smallest deployable unit, holding one or more containers.
• Namespaces separate workloads logically; they are not a strong security boundary by themselves.
• RBAC controls who can do what through the Kubernetes API.
• Network policies restrict which pods can talk to each other; by default pods can usually reach each other.
• Secrets hold sensitive values; they are only base64 encoded by default, so enable encryption at rest and restrict access.

Container hardening example:

securityContext:
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false

Application virtualization

Application virtualization runs an application in an isolated layer separated from the underlying OS, so it can be delivered without installation and kept from changing the host. It helps with legacy applications and with contained testing.

A worked example

A retailer moves its monolithic shop to microservices on Kubernetes. A penetration test shows that a compromised product image service can reach the payment service directly and that container images run as root.

The architect adds network policies so only the checkout service can reach payment, requires mutual TLS between services, rebuilds images from minimal bases running as non-root, and puts an API gateway and WAF in front of public endpoints. DAM is deployed on the order database to watch for unusual bulk reads.

How the exam asks about this

• "Which component BEST detects a database administrator copying large volumes of customer records?" Database activity monitoring.
• "A known vulnerability cannot be patched in code for two weeks. What provides interim protection?" A WAF rule acting as a virtual patch.
• "By default, what protection do Kubernetes secrets have?" Only base64 encoding, so encryption at rest must be enabled.