SEC549: Cloud Security Architecture

  • In Person (5 days)
  • Online
30 CPEs

Organizations are migrating infrastructure and applications to the cloud at a rapid pace. As migrations take place, security architects are struggling to design hybrid and cloud-native solutions to meet their organization's security requirements. Shifting to the cloud requires a deep understanding of the threats introduced by a cloud migration, and how each provider mitigates those threats using their well-architected framework. SEC549 teaches security professionals how to design an enterprise-ready, scalable cloud organization. With nearly 20 hands-on labs, students will learn to design cloud solutions for their organization at any stage of the cloud journey, whether planning for the first workload, managing complex legacy environments, or operating in an advanced cloud-native ecosystem.

What You Will Learn

Design It Right From the Start.

SEC549 teaches students how to design enterprise-scale, cloud infrastructure solutions for their organization. By learning the cloud providers' well-architected frameworks, security architects can design centralized security controls for their cloud estate while maximizing the speed of cloud adoption for the organization. Students will learn how threat models change in the cloud with new, vastly distributed perimeters and unfamiliar trust boundaries. With those challenges in mind, our focus shifts to designing strategies for centralizing and reinforcing workforce identity, conditional access, policy guardrails, network security controls, data perimeters, and log streams.

SEC549 takes students through the cloud migration journey of a fictional company and the challenges they encounter along the way. As aspiring cloud security architects, students are tasked with phasing in a centralized identity plan for workforce cloud management and cloud-hosted application access along with supporting workload identity design principles for granting access to other cloud services. In addition, policy guardrails are put in place to create boundaries which help the organization maintain both security and compliance while providing flexibility for engineering teams. With identity and access management (IAM) in place, we start evaluating the pros and cons of various network and data lake designs to build a data perimeter for the organization. The final mission is monitoring network and data access by centralizing log data across the organization to secure access to critical resources.

"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - GREG LEWIS, SAP

What Is Cloud Security Architecture?

Cloud security architecture requires us to understand business requirements and existing cloud services and capabilities in order to design access control patterns, network controls, and secure processes to support a business outcome that can be implemented and maintained within required cloud operating environments. This requires architects to understand and design secure cloud solutions for workloads deployed on Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Software-as-a-Service (SaaS) service models. Understanding hybrid architecture patterns is also important as cloud workloads integrate with on-premises systems. The cloud security architect's goal is to identify security design flaws and inefficiencies when information systems interconnect and mitigate these flaws in the early stages of development using available cloud-capable security controls.

Business Takeaways

  • Mitigate the risks introduced by cloud technologies and their rapid adoption
  • Decrease the risk of cloud migrations by planning a phased approach
  • Prevent identity sprawl and technical debt through centralization
  • Enable business growth by creating high-level guardrails
  • Prevent costly anti-patterns from sprawling throughout a cloud organization
  • Apply learned access patterns to help move your organization towards zero-trust
  • Design effective conditional access policies and learn how to place guardrails around business-driven policy exceptions

"The problems we talk about are some that I face in my job every day or know I will face shortly. Getting definitive answers for many of these issues is very helpful for me. Getting years of experience from the instructors and what they have worked on is invaluable." - PATRICK HAUGHNEY, PAYLOCITY

Skills Learned

  • Enable business through secure enterprise cloud security architectural designs
  • Connect the dots between cloud architecture designs and real-life solutions
  • Build a secure, scalable identity foundation in the cloud
  • Centralize your organization's workforce identity to prevent sprawl
  • Build micro-segmented networks using hub and spoke patterns
  • Configure centralized network firewalls for inspecting north-south and east-west traffic
  • Learn how to incorporate both network-based and identity-based controls
  • Create data perimeters for cloud-hosted data repositories
  • Centralize and share Key Management Service (KMS) resources across an organization
  • Enable security operations and incident response in the cloud
  • Understand the telemetry and logging available across service models (IaaS, PaaS, and SaaS)
  • Design push and pull logging architectures for centralized log aggregation
  • Plan for cloud recovery processes using multiple tiers of break-glass accounts

Hands-On Cloud Security Architect Training

The hands-on portion of SEC549 is unique and especially suited to students who want to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The completed version of each diagram is implemented as live infrastructure in AWS, Azure, or Google (depending on the topic) and made available for students to explore. In this course, students have access to an enterprise-scale AWS, Azure, and Google Cloud organization and can observe all details discussed in the labs and throughout the course.

Each section discusses security design considerations for all three major clouds, however, there is a stronger emphasis on the AWS cloud. Each lab below indicates which cloud provider(s) is used to see the real-world implementation:

Section 1:

  • Threat Modeling the Cloud (cloud agnostic)
  • Centralizing User Account Provisioning (AWS / Azure)
  • Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
  • Designing an Identity Bastion Account (AWS / Google)

Section 2:

  • Threat Modeling Zero-Trust Access (cloud agnostic)
  • Integrating Modern Authentication into Legacy Applications (AWS)
  • Scaling Cross-Cloud Authentication (AWS)
  • Balancing Security and Usability with Conditional Access (Azure)

Section 3:

  • Centralizing Network Security Controls (AWS)
  • Building a Transit Gateway (AWS)
  • Network Firewall Policies (AWS)
  • VPC Private Network Access (AWS)

Section 4:

  • Data Discovery and Classification (Google)
  • Access Control for Shared Data Sets (AWS)
  • Access Control for BigQuery (Google)
  • Key Management Architecture (AWS / Google)

Section 5:

  • Centralizing Intra-cloud Log Events (AWS / Azure / Google)
  • Export Cloud Telemetry to a Centralized SIEM (AWS / Azure / Google)
  • Architecting Quarantine Patterns (AWS)

"I've done a lot of labs over the years. These are likely one of the best ways to present them I've ever used." - DANIEL RUSSELL, BCBSLA

"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - TYLER PILLER, BRITISH COLUMBIA LOTTERY CORPORATION

"All three of today's labs were helpful in cementing the concepts. The "See It in Action" portions were particularly useful." - ORITSE UKU

"I really liked that architecture diagrams were incorporated in each [lab]." - GREG LEWIS, SAP

Syllabus Summary

  • Section 1: A foundational section covering IAM in the cloud, the higher-level resource containers in each of the three major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
  • Section 2: A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
  • Section 3: Managing cloud network resources at-scale requires an architect to understand the cloud provider's network security capabilities. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
  • Section 4: Protecting data in the cloud requires security teams to examine cloud provider data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
  • Section 5: In this section we focus on how to uplift the capabilities of a Security Operations Center (SOC), adapt traditional methodologies to cloud-hosted environments, and ensure robust detection and response continues as their organization shifts workloads to the cloud.

Additional Free Resources

What You Will Receive

  • Printed and electronic courseware
  • architectural diagrams representing secure patterns you can use as reference architecture
  • Access to the SEC549 Cloud lab environment

What Comes Next

Syllabus (30 CPEs)

Download PDF
  • Overview

    Section 1 starts by defining concepts used throughout the course such as threat modeling the cloud, what makes a secure design, and how security changes in the cloud. Students then start designing cloud identity for the Delos organization by learning the foundational concepts of cloud identity: users, groups, roles, and machine identities. With those concepts in mind, we enable identity federation and provisioning from Microsoft Entra ID to both AWS and Google Cloud using Entra ID enterprise applications. With identity federation in place, students design a foundational cloud resource hierarchy for the organization to host resources with policy guardrails for organization units and accounts. The final module covers the cloud provider permission models and how to centralize legacy and external users and provide a single entry and management point for each cloud environment.

    • Threat Modeling the Cloud (cloud agnostic)
    • Centralizing User Account Provisioning (AWS / Azure)
    • Structuring Accounts to Create Effective Hierarchies (AWS / Azure)
    • Designing an Identity Bastion Account (AWS / Google)
    • Security Architecture in the Cloud
      • Threat modeling the cloud
      • Cloud-native security models
    • Federated Access / Single Sign-On
      • Managing users at scale with Microsoft Entra ID, AWS Single Sign-On, and Google Cloud Identity
      • Provisioning users with the System for Cross-domain Identity Management (SCIM) specification
    • Creating Hierarchical Cloud Structures
      • Designing organizational hierarchy with AWS Organizations, Azure Management Groups, and Google Cloud
      • Creating policy guardrails in the hierarchy to help silo job roles and prevent IAM mistakes
    • Implementing an Identity Foundation
      • Understanding how permissions are granted and patterns of IAM in the cloud
      • Centralizing legacy users and machine identities into an identity bastion account
      • Granting secure external access to vendors and contractors
  • Overview

    Section 2 starts with an in-depth look at the zero-trust movement, its history, and how zero-trust in the cloud can be designed. Students see how zero-trust end user tokens can help create secure by default application architectures and learn how to authenticate end users and machine identities across multiple public cloud environments. Wrapping up this section, students focus on conditional access policies and designing guardrails for resource access.

    • Threat Modeling Zero-Trust Access (cloud agnostic)
    • Integrating Modern Authentication into Legacy Applications (AWS)
    • Scaling Cross-Cloud Authentication (AWS)
    • Balancing Security and Usability with Conditional Access (Azure)
    • Implementing Zero-Trust Architecture
      • History of Zero-Trust
      • Using cloud services to implement zero-trust architecture
    • Cloud Application Identity
      • Identity federation with AWS Cognito
      • Integrating modern authentication for legacy applications
    • Architecting Cross-Cloud Authentication
      • Killing long-lived credentials in AWS, Azure, and Google Cloud
      • Designing workload identity federation across cloud providers
      • Using certificates to authenticate on-premises workloads to cloud provider APIs
    • Conditional Access Policies
      • Designing effective Conditional Access policies
      • Workload identity federation across cloud providers
  • Overview

    With a solid identity foundation, students shift focus to cloud architecture patterns for their organization. Building an enterprise cloud network requires a fundamental understanding of how things change moving from an on-premises network. Section 3 starts with the key resources required to build public, private, and hybrid cloud networks. From there, students learn to centrally manage the configuration of these resources across their organization. Next, we explore cloud micro-segmentation, hub and spoke networks, and routing traffic between micro-networks. Our focus then shifts to centralizing traffic flow through ingress and egress networks, as well as inspecting east-west traffic with third-party security appliances. Finally, students learn how to share network services by adding additional spoke networks and sharing DNS configurations across the organization.

    • Centralizing Network Security Controls (AWS)
    • Building a Transit Gateway (AWS)
    • Network Firewall Policies (AWS)
    • VPC Private Network Access (AWS)
    • On-Premises Versus Cloud Networks
    • Managing Cloud-Hosted Networks at Scale
      • Sharing VPC networks across projects / accounts
      • Managing firewall rules using cloud managed firewall services
    • Cloud Network Micro-Segmentation
      • Connecting micro networks using VPC peering and hub and spoke services
      • Creating hybrid networks with site-to-site VPN tunnels and dedicated connections
    • Network Firewalls and Traffic Inspection
      • Centralizing ingress and egress traffic network controls
      • Inspecting east-west traffic with third-party security appliances
    • Centralized Shared Network Services
      • Hosting private link / private access services in a centralized spoke
      • Designing least privilege private link policies for data perimeters
      • Sharing private DNS hosted zones with spoke networks
  • Overview

    Section 4 focuses on cloud-native data protection patterns. Starting with common organization-wide storage service controls, students will establish foundational data perimeter policies. From there, we learn to segment data lake access through views and access points. Next, students explore how attribute-based access control, tagging, and data masking can enable cloud-native data loss prevention controls. Finally, the section wraps up with key management and backup architecture patterns.

    • Data Discovery and Classification (Google)
    • Access Control for Shared Data Sets (AWS)
    • Access Control for BigQuery (Google)
    • Key Management Architecture (AWS / Google)
    • Data Security & Privacy Playbook
      • Defining, dissecting, and defending data
      • Data classification patterns
      • Resource naming and tagging
      • Cloud data discovery and classification services
    • Cloud Storage Service Security
      • Managing access to cloud storage services
      • Establishing network perimeters in the cloud for data access
      • Designing data backup, replication, and business continuity plans in the cloud
    • Data Lake Security
      • Designing centralized data warehouses with data mart access points
      • Access control and governance with S3 access points
      • Access control and governance with BigQuery views, row-level, and column-level policies
      • Big Query identity and data exfiltration controls
      • Data pipelines for tagging for attribute-based access control, masking, and data loss prevention
    • Key Management Architecture
      • Creating centralized key management stores for the organization
      • Patterns for isolating key administrators from data being protected
      • Sharing keys across cloud accounts
      • Regulatory requirements that may require customer-managed or cloud hardware security module (HSM) managed keys
  • Overview

    Section 5 covers how to enable your SOC to operate (investigate incidents, log events, hunt for threats) in the new cloud-based world. Covered in this section is a deep dive on cloud data sources, aggregating logs, and cloud-native events within the cloud service provider (CSP) while positioning them for export to the central SIEM. This section teaches students how to build effective architecture which empowers defenders to respond, contain, and ultimately recover from cloud-based incidents.

    • Centralizing Intra-cloud Log Events (AWS / Azure / Google)
    • Export Cloud Telemetry to a Sentinel (AWS / Azure / Google)
    • Architecting Quarantine Patterns (AWS)
    • Security Operations in a Cloud-Centric World
      • On-premises versus cloud security operations
      • Cloud service provider incident coordination
    • Intra-cloud Logging and Aggregation
      • Understanding the logging journey for events in the cloud
      • Cloud event log types and data elements
      • Designing an intra-cloud security data lake for in-depth analysis
    • Centralized Log Export Patterns
      • Comparing SIEM solutions and platforms
      • Ingesting cloud events using push and pull architecture patterns
      • Exporting AWS log events using Kinesis, S3, and SQS
      • Exporting Azure log events using Event Hub
      • Exporting Google Cloud log events using Pub/Sub
      • Data processing and transformation using Cribl
      • Ingesting cross-cloud log event data using Microsoft Sentinel
    • Secure Incident Response Design
      • Managing read only access for incident responders
      • Enabling response in the cloud with network-layer and identity-layer quarantine zones
      • Designing break-glass accounts for cloud account recovery


The following experience is a prerequisite for SEC549:

  • Familiarity with AWS, Azure, and Google Management Consoles
Preparing For SEC549

Students taking SEC549 will have the opportunity to learn many different architecture patterns across the AWS, Azure, and Google clouds. Basic familiarity with cloud concepts like IAM, role-based access control, identity federation, VPC networks, and storage services management is helpful, but not required.

Additionally, students will delve into cloud-native tools for securing deployments at the network layer. Having a basic understanding of network concepts such as firewalls, network access control lists and IP addressing is helpful, but not mandatory.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.
  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses for delivering the lab documents and challenges. A second monitor and/or a tablet device can be useful for keeping the class materials visible while you are working on your labs.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"Distributing our workloads and data to the public cloud increases our perimeter, which is often protected only by identity-based security controls. With the network perimeter being lifted, the margin for error is slim. Even with this grim reality, we can still be optimistic. Migrating to the cloud enables our most innovative technologies and presents an opportunity for the security sector to evolve and mature.

If armed with the correct foundational design principles, we can build a more secure future, with greater availability and confidentiality than ever possible on-premises. Transitioning to the new cloud-native, zero-trust world may be bumpy, but we are here to help shepherd you along the journey."

- Kat Traxler, Eric Johnson, David Hazar

"Eric nailed it. Knowledgeable, experienced, and enthusiastic." - DANIEL RUSSELL, BCBSLA

"I am so impressed with David. He is a great teacher, very willing to take any questions." - Nicole McDowell, Cook County Health


Exercises provoke thought and instill good discussions.
Soe San Win
Robert Bosch, LLC
The content is excellent, provides a lens and framework to look at enterprise problems from an architectural lens and will provide actionable information that can be used Day 1 after this course.
Tyler Piller
British Columbia Lottery Corporation
Current information and lots of it.
Michael Martin
Banner Health

    Register for SEC549

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.