Cloud Arena
All Cheat Sheets

IAM & Security Cheat Sheet

Multi-cloud reference for AWS, Azure, and Google Cloud IAM & Security services

AWS IAM

AWS
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
aws iam create-role --role-name LambdaProcessorRole --assume-role-policy-document file://trust-policy.jsonCreate IAM Role with trust policy
aws iam attach-role-policy --role-name LambdaProcessorRole --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRoleAttach managed execution policy
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/DeployRole --role-session-name GithubCIObtain temporary STS session credentials
aws iam generate-service-last-accessed-details --arn arn:aws:iam::123:role/AppRoleAudit unused permissions via Access Advisor

Architectural Key Facts

  • •Global identity and access governance system providing authentication and authorization for AWS resources.
  • •Policy evaluation logic: Explicit Deny always takes absolute precedence over any Allow; implicit deny by default.
  • •IAM Roles issue temporary credentials (`ASIA...`) via AWS Security Token Service (STS), eliminating hardcoded secrets.
  • •Permission Boundaries set the maximum permissible permissions an identity can have; vital for safe delegated role creation.
  • •Service Control Policies (SCPs) in AWS Organizations enforce guardrails across multi-account organization units.

Production Limits & Quotas

Item / DimensionLimit / Quota
Roles per account5,000 roles (soft limit)
Managed policies attached to a role10 managed policies (expandable to 20)
STS assumed role session duration15 minutes to 12 hours

AWS KMS

AWS
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
aws kms create-key --description 'Production Database CMK' --key-usage ENCRYPT_DECRYPT --origin AWS_KMSProvision Customer Managed Key (CMK)
aws kms generate-data-key --key-id alias/prod-db --key-spec AES_256Envelope encryption: Generate 256-bit plaintext & ciphertext DEK
aws kms encrypt --key-id alias/prod-db --plaintext fileb://secret.txt --output text --query CiphertextBlobDirect KMS encrypt (for small payloads <4KB)
aws kms enable-key-rotation --key-id KEY_IDEnable automatic annual cryptographic key rotation

Architectural Key Facts

  • •Hardware-backed encryption service using FIPS 140-2 Level 3 cryptographic modules (HSMs).
  • •Implements Envelope Encryption: KMS protects Data Encryption Keys (DEKs); clients encrypt data locally with DEKs.
  • •Key Policies are the primary access control mechanism; without explicit delegation in the Key Policy, IAM policies cannot grant access.
  • •Multi-Region Keys share the same key ID and key material across regions to decrypt data globally without cross-region network calls.
  • •Every cryptographic API call is recorded immutably in AWS CloudTrail for compliance audits.

Production Limits & Quotas

Item / DimensionLimit / Quota
Direct encrypt payload limit4,096 bytes (4 KB; use envelope encryption for larger)
Cryptographic requests per second5,500 to 50,000 req/s depending on region (auto-scaling)
Key policy size limit32 KB

AWS Secrets Manager

AWS
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
aws secretsmanager create-secret --name prod/db/credentials --secret-string '{"username":"admin","password":"ComplexP@ss1"}'Store encrypted credentials
aws secretsmanager get-secret-value --secret-id prod/db/credentials --query SecretString --output textRetrieve plaintext secret string
aws secretsmanager rotate-secret --secret-id prod/db/credentials --rotation-lambda-arn ARN --rotation-rules AutomaticallyAfterDays=30Configure automated 30-day rotation

Architectural Key Facts

  • •Dedicated secrets lifecycle management service designed to store database passwords, API tokens, and private keys.
  • •Built-in automated rotation for Amazon RDS, Aurora, DocumentDB, and Redshift using predefined AWS Lambda functions.
  • •4-step zero-downtime rotation lifecycle: `createSecret`, `setSecret`, `testSecret`, and `finishSecret` with version staging labels.
  • •Client-side caching libraries (Python, Java, Go) store secrets in memory to prevent API throttling and reduce costs.
  • •Multi-Region Secret replication synchronizes credentials across disaster recovery regions automatically.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max secret value size65,536 bytes (64 KB)
GetSecretValue API rate limit10,000 requests/sec (use client caching)
Resource policy size limit20,480 bytes (20 KB)

AWS WAF & Shield

AWS
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
aws wafv2 create-web-acl --name WebSecurityACL --scope REGIONAL --default-action Allow={} --rules file://waf-rules.json --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=WebACLCreate regional Web ACL for ALB/API Gateway
aws wafv2 associate-web-acl --web-acl-arn ACL_ARN --resource-arn ALB_ARNAttach Web ACL to Application Load Balancer
aws shield describe-protection --protection-id PROT_IDCheck AWS Shield Advanced protection status

Architectural Key Facts

  • •AWS WAF operates at Layer 7 (HTTP/HTTPS) inspecting traffic at CloudFront edge POPs, ALBs, and API Gateways.
  • •AWS Managed Rules (AMR) provide out-of-the-box protection against OWASP Top 10 vulnerabilities, botnets, and CVEs.
  • •Rate-based rules track client request frequencies in sliding windows (1m, 2m, 5m) to mitigate application-layer DDoS.
  • •Web ACL capacity is governed by Web ACL Capacity Units (WCUs); default budget is 1,500 WCUs per ACL.
  • •AWS Shield Standard provides automatic Layer 3/4 DDoS protection free; Shield Advanced adds 24/7 SRT and cost surge protection.

Production Limits & Quotas

Item / DimensionLimit / Quota
Default WCU capacity limit1,500 WCUs per Web ACL (expandable to 5,000)
Max request body inspectionUp to 64 KB for regional resources (ALB/API Gateway)
Rate-based rule minimum threshold10 requests per evaluation window

Microsoft Entra ID (Azure AD)

Azure

Key Commands & CLI Operations

CommandDescription
az ad user create --display-name 'Jane Doe' --user-principal-name jane@company.onmicrosoft.com --password 'InitialP@ss1'Provision new cloud directory user
az role assignment create --assignee jane@company.onmicrosoft.com --role 'Contributor' --scope /subscriptions/SUB_ID/resourceGroups/myrgAssign Azure RBAC role at Resource Group scope
az identity create -g myrg -n app-managed-idCreate User-Assigned Managed Identity for VM/Container
az ad app create --display-name 'Microservice-API'Register application with OAuth2/OIDC endpoint

Architectural Key Facts

  • •Cloud-based identity and access management service handling user authentication, single sign-on (SSO), and resource authorization.
  • •Azure Role-Based Access Control (RBAC) grants fine-grained permissions at Management Group, Subscription, Resource Group, or Resource scope.
  • •Managed Identities eliminate credentials in code; Azure automatically injects short-lived tokens into VMs, App Services, and Functions.
  • •Conditional Access policies enforce multi-factor authentication (MFA), compliant device checks, and risk-based blocking.
  • •Privileged Identity Management (PIM) provides just-in-time (JIT) access with mandatory approval workflows and audit trails.

Production Limits & Quotas

Item / DimensionLimit / Quota
Role assignments per subscription4,000 role assignments
Directory objects (Free tier)500,000 objects
Custom RBAC roles per directory5,000 custom roles

Azure Key Vault

Azure

Key Commands & CLI Operations

CommandDescription
az keyvault create -g myrg -n prod-vault-101 --location eastus --enable-purge-protection true --retention-days 90Provision Key Vault with purge protection
az keyvault secret set --vault-name prod-vault-101 -n DbPassword --value 'SecretDatabaseValue1!'Store secure secret string
az keyvault secret show --vault-name prod-vault-101 -n DbPassword --query value -o tsvRetrieve secret value programmatically
az keyvault key create --vault-name prod-vault-101 -n DiskEncryptionKey --kty RSA --size 4096Create 4096-bit RSA cryptographic key

Architectural Key Facts

  • •Centralized, secure cloud store for safeguarding application secrets, cryptographic encryption keys, and TLS/SSL certificates.
  • •Hardware Security Module (HSM) backing ensures FIPS 140-2 Level 2 (Standard) and Level 3 (Premium/Managed HSM) compliance.
  • •Soft Delete (retains deleted vaults/secrets for 7-90 days) and Purge Protection prevent accidental or malicious deletion.
  • •Azure RBAC for Key Vault allows granting fine-grained permissions (Key Vault Secrets User) using standard Azure IAM policies.
  • •Native integration with Azure App Service, Azure Functions, and AKS via CSI Secret Store Driver.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max secret value size25 KB per secret
API transaction rate limitUp to 25,000 transactions per 10 seconds per vault
Certificate auto-renewalSupported via integrated certificate authorities

Azure DDoS Protection & WAF

Azure

Key Commands & CLI Operations

CommandDescription
az network ddos-protection create -g myrg -n ddos-plan --location eastusCreate Azure DDoS Network Protection plan
az network vnet update -g myrg -n prod-vnet --ddos-protection true --ddos-protection-plan ddos-planAssociate DDoS plan with Virtual Network

Architectural Key Facts

  • •Provides defense against large-scale distributed denial-of-service (DDoS) attacks at Layer 3, Layer 4, and Layer 7.
  • •DDoS Network Protection continuously profiles application traffic patterns and automatically applies mitigations during volumetric floods.
  • •DDoS Cost Protection provides SLA credits for scaling costs incurred by protected VMs during an active DDoS attack.
  • •Azure Web Application Firewall (WAF) inspects Layer 7 HTTP requests against OWASP core rule sets (CRS 3.2), bot managers, and custom rules.
  • •Deep integration with Azure Monitor delivers real-time attack telemetries, mitigation notifications, and forensic reporting.

Production Limits & Quotas

Item / DimensionLimit / Quota
Protected public IP addressesUp to 100 public IPs included per DDoS plan
WAF custom rules limitUp to 100 custom rules per WAF policy

IAM Basics

Google Cloud
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
gcloud projects add-iam-policy-binding PROJECT_ID --member=user:email@example.com --role=roles/viewerGrant role to user
gcloud projects get-iam-policy PROJECT_IDView project IAM policy
gcloud projects remove-iam-policy-binding PROJECT_ID --member=user:email@example.com --role=roles/viewerRevoke role

Architectural Key Facts

  • •IAM policies are attached to resources (Org, Folder, Project, Resource) and define 'Who has What access to Which resource'.
  • •Permissions are inherited downwards: Org -> Folder -> Project -> Resource.
  • •Primitive roles (Owner, Editor, Viewer) affect all resources in a project; avoid using them in production.
  • •Predefined roles provide granular access to specific services (e.g., roles/compute.instanceAdmin).
  • •Custom roles can be created for specific permission combinations if predefined roles don't fit.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max principals per policy binding1,500
Max custom roles per project300
Max conditional bindings per policy250

Roles

Google Cloud
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
gcloud iam roles describe roles/viewerView permissions in a role
gcloud iam roles create customRole --project=PROJECT_ID --title='Custom Role' --permissions=compute.instances.listCreate custom role
gcloud iam list-testable-permissions //cloudresourcemanager.googleapis.com/projects/PROJECT_IDList permissions available to test

Architectural Key Facts

  • •A Role is a collection of permissions; you cannot assign a permission directly to a user, only roles.
  • •Custom roles cannot be created at the Folder level (only Org or Project level).
  • •IAM Recommender suggests removing over-permissive roles based on actual usage over 90 days.
  • •Audit logs (Admin Activity) record whenever IAM policies are changed.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max permissions per custom role3,000
Role ID length64 characters

Service Accounts

Google Cloud
Explore Deep Dive Guide

Key Commands & CLI Operations

CommandDescription
gcloud iam service-accounts create my-sa --display-name='My Service Account'Create a Service Account
gcloud iam service-accounts keys create key.json --iam-account=my-sa@PROJECT.iam.gserviceaccount.comGenerate JSON key
gcloud iam service-accounts add-iam-policy-binding my-sa@PROJECT.iam.gserviceaccount.com --member='user:email@example.com' --role='roles/iam.serviceAccountUser'Allow user to impersonate SA

Architectural Key Facts

  • •A Service Account is an identity for applications/VMs, not humans.
  • •It acts as both an Identity (can be granted roles) and a Resource (users can be granted roles on the SA to use it).
  • •Best practice: Use Service Account Impersonation or Workload Identity Federation instead of downloading JSON keys.
  • •Default compute service account has the broad 'Editor' role; it's recommended to disable or restrict it.

Production Limits & Quotas

Item / DimensionLimit / Quota
Max service accounts per project100 (can request quota increase)
Max keys per service account10