<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: designing-secure-cloud-architecture
description: >-
  Design secure cloud architectures across AWS, Azure, and GCP following Well-Architected
  Framework security pillars with landing zone patterns, guardrails, workload isolation,
  and cloud-native security controls.
domain: cybersecurity
subdomain: security-architecture
tags:
  - cloud-security
  - aws-well-architected
  - landing-zone
  - guardrails
  - cloud-native
  - workload-isolation
  - shared-responsibility
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004"]
---

# Designing Secure Cloud Architecture

## Overview

Secure cloud architecture requires understanding the shared responsibility model,
implementing landing zone patterns with guardrails, and applying cloud-native security
controls. This skill covers multi-account strategies, network architecture, workload
isolation, and security automation across major cloud providers.

Mode: `[MODE: ARCHITECT]` — Cloud security architecture design.

## Prerequisites

| Requirement | Details |
|---|---|
| Cloud provider account with organizational access | Required |
| AWS Organizations, Azure Management Groups, or GCP Organization | Required |
| Terraform or CloudFormation for IaC | Required |
| Python 3.10+ | Required |

## Key Concepts

### Secure Landing Zone Architecture

```
┌─────────────────────────────────────────────────┐
│              Organization Root                   │
├─────────────┬───────────────┬───────────────────┤
│  Security   │  Shared Svcs  │   Workloads       │
│  OU         │  OU           │   OU              │
├─────────────┼───────────────┼───────────────────┤
│ Log Archive │ Networking    │ Production OU     │
│ Security    │ Shared DNS    │  ├─ App A Account │
│ Tools       │ CI/CD         │  └─ App B Account │
│ Audit       │ Identity      │ Staging OU        │
│             │               │  ├─ App A Account │
│             │               │  └─ App B Account │
└─────────────┴───────────────┴───────────────────┘
```

### AWS Account Guardrails (SCPs)

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLeaveOrganization",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    },
    {
      "Sid": "DenyDisableCloudTrail",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyPublicS3",
      "Effect": "Deny",
      "Action": "s3:PutBucketPublicAccessBlock",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:publicAccessBlockConfiguration/BlockPublicAcls": "true"
        }
      }
    },
    {
      "Sid": "RequireIMDSv2",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringNotEquals": {
          "ec2:MetadataHttpTokens": "required"
        }
      }
    }
  ]
}
```

### VPC Security Architecture

```bash
# Create VPC with isolated subnets
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications \
  'ResourceType=vpc,Tags=[{Key=Name,Value=secure-vpc}]'

# Enable VPC Flow Logs
aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-123 \
  --traffic-type ALL --log-destination-type s3 \
  --log-destination arn:aws:s3:::flow-logs-bucket

# Create private subnet (no internet gateway)
aws ec2 create-subnet --vpc-id vpc-123 --cidr-block 10.0.1.0/24 \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-app}]'

# Create VPC endpoints for AWS services (no internet needed)
aws ec2 create-vpc-endpoint --vpc-id vpc-123 --service-name com.amazonaws.us-east-1.s3 \
  --vpc-endpoint-type Gateway --route-table-ids rtb-123
```

### Terraform Security Module

```hcl
# Secure baseline module
module "secure_baseline" {
  source = "./modules/security-baseline"

  enable_cloudtrail       = true
  enable_config           = true
  enable_guardduty        = true
  enable_security_hub     = true
  enable_access_analyzer  = true

  cloudtrail_s3_bucket    = module.log_archive.bucket_name
  config_s3_bucket        = module.log_archive.bucket_name

  # Encryption
  kms_key_deletion_window = 30
  enable_key_rotation     = true

  # Networking
  vpc_flow_logs_enabled   = true
  default_sg_restrict     = true

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}
```

## Workflow

### Step 1: Assess Current Cloud Posture

```bash
node scripts/agent.js --action assess --provider aws
```

### Step 2: Design Landing Zone

```bash
node scripts/agent.js --action design --provider aws --pattern multi-account
```

### Step 3: Generate Guardrails

```bash
node scripts/agent.js --action guardrails --provider aws --output scps.json
```

### Step 4: Validate Architecture

```bash
node scripts/agent.js --action validate --provider aws --config architecture.json
```

## Detection

```yaml
title: Designing Secure Cloud Architecture Detection
id: dab377e4-e49e-4390-97ec-3241562bde35
status: experimental
description: Detects suspicious activity related to designing secure cloud architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Designing Secure Cloud Architecture Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078.004 |

## Verification

- [ ] Multi-account strategy with OU hierarchy implemented
- [ ] SCPs prevent disabling security controls
- [ ] CloudTrail/audit logging enabled in all accounts
- [ ] VPC Flow Logs enabled for all VPCs
- [ ] Default security groups restrict all traffic
- [ ] Public access blocked for storage by default
- [ ] GuardDuty/Security Hub enabled organization-wide
- [ ] IMDSv2 enforced for all EC2 instances
- [ ] VPC endpoints used for AWS service access where possible

## References

- [AWS Well-Architected Security Pillar](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/)
- [Azure Landing Zones](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/)
- [GCP Security Foundations](https://cloud.google.com/architecture/security-foundations)
