SEC549: Enterprise Cloud Security Architecture

  • In Person (5 days)
  • Online
30 CPEs

The age of cloud computing has arrived as organizations have seen the advantages of migrating their applications from traditional on-premises networks. However, the rapid adoption of cloud has left the cloud security architect scrambling to design on this new medium. A shift to the cloud requires cybersecurity professionals to reorient their security goals around a new threat model to enable business requirements while improving their organization's security posture. This enterprise cloud security architecture training course will teach students to create secure identity and network patterns in the cloud in order to support business at any stage of the cloud journey, whether planning for first workloads, managing complex legacy environments, or operating in an advanced cloud-native ecosystem. 20 Hands-On Labs

What You Will Learn

Design it right from the start.

SEC549 takes an architectural lens to enterprise-scale, cloud infrastructure challenges. It addresses the security considerations architects need to tackle when tasked with business expansion into the cloud in order to both maximize the speed of cloud adoption and modernization of the organization. From the centralization of workforce identity and network security controls, to the secure usage of shared cloud-hosted data, and the design of effective logging strategies, students take away from this course a clear mental model of the cloud and the controls available to them. This allows students to shift their threat models to this new, vastly different world with distributed perimeters and unfamiliar trust boundaries.

It's inevitable that even the most mature organizations will have their security posture challenged, therefore in this course we dive deep into architectures which enable Security Operation Centers to monitor, detect, respond and recover from incidents in the cloud. In this enterprise cloud security architecture course, students learn how to effectively support business goals with robust logging of cloud telemetry and centralization of events and insights gathered at the edge. This course empowers the Architect to ensure adequate logging is configured in cloud environments and develop recovery strategies emphasizing the need to design for availability.

The SEC549 is constructed around the cloud migration journey of a fictional company and the challenges they encounter along the way. Aspiring cloud security architect students are tasked with phasing in a centralized identity plan, and designing secure patterns for enabling cloud-hosted applications. Both network-layer and identity-layer controls are covered in-depth as complementary mechanisms for securing access to distributed resources.

"I would recommend this course. It hits many core aspects of secure design. Additionally, lack of Cloud Security Architecture and Strategy, and Insecure Design have been highlighted as a top risk by organizations like Cloud Security Alliance and OWASP. Cloud security architecture topics need to have more attention and focus in general." - Greg Lewis, SAP

What is Enterprise Cloud Security Architecture?

The practice of Enterprise Security Architecture is the consumption of requirements in order to design access control patterns, network controls or secure processes in support of a business outcome.  Enterprise Cloud Security Architecture is this business-centric practice but operating in the Cloud. A Cloud Security Architect designs secure patterns for workloads deployed on Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service service models as well as hybrid architecture patterns which may tightly integrate to on-premises systems. The cloud security architect's goal is to tease out security flaws when information systems interconnect, and complexity naturally forms.  The development of secure architecture patterns gives us the ability to preemptively manage complexity, ideally before a system is put into use. Mitigating design flaws in the early stages of development with proactive Cloud Security Architecture saves time and is crucial considering the high cost associated with fixing flaws after deployment.


  • Mitigate the risk posed by nascent cloud technologies and their rapid adoption
  • Decrease the risk of cloud migrations by planning a phased approach
  • Help your organization prevent identity sprawl and tech debt through centralization
  • Enable business growth by creating high-level guardrails
  • Prevent costly anti-patterns from becoming entrenched
  • Move your organization towards a Zero-Trust posture through the uplifting of existing access patterns
  • Design effective Conditional Access Policies and learn how to place guardrails around business-driven policy exceptions

"The problems we talk about are some that I face in my job every day or know I will face shortly. Getting definitive answers for many of these issues is very helpful for me. Getting years of experience from the instructors and what they have worked on is invaluable." - Patrick Haughney, Paylocity


  • Enable business through secure enterprise cloud security architectural patterns
  • Connect the dots between architectural patterns and real-life infrastructure
  • Build a secure, scalable identity foundation in the cloud
  • Centralize your organization's workforce identity to prevent sprawl
  • Build micro-segmented networks using hub and spoke patterns
  • Configure centralized network firewalls for inspecting north-south and east-west traffic
  • Learn how to incorporate both network-based and identity-based controls
  • Ability to create data perimeters for cloud-hosted data repositories
  • Centralize and share Key Management Service (KMS) resources across an organization
  • Enable Security Operations to respond in the Cloud
  • Understand the telemetry and logging available across service models (IaaS, PaaS and SaaS)
  • Design recovery processes leveraging break-glass accounts
  • Strategically approach a phased cloud migration
  • Implement Conditional Access Policies in order to guardrail resource access and strength your identity boundary


The hands-on portion of SEC549 is unique and especially suited to the student who wants to architect for the cloud. Each lab is performed by observing and correcting an anti-pattern presented as an architectural diagram. The 'correct' version of each diagram is implemented as live infrastructure in AWS and made available to the student to explore the configurations. In this course, the students have access to an enterprise-scale AWS Organization and can observe all details discussed in the labs and throughout the course.

Each of the sections of the course discusses security design considerations for all three major clouds, however there is an emphasis on working with AWS and labs are structured around concepts in AWS.

Section 1:

  • Threat Modeling the Cloud
  • Centralizing User Account Provisioning
  • Structuring Accounts to Create Effective Hierarchies
  • Transitioning Access from IAM Users to Roles

Section 2:

  • Threat Modeling Zero-Trust Access
  • Integrating Modern Authentication into Legacy Applications
  • Scaling Cross-Cloud Authentication
  • Access Control for Shared Data Sets
  • Conditional Access Policy Design

Section 3:

  • Centralizing Network Security Controls
  • Building a Transit Gateway
  • Network Firewall Policies
  • VPC Private Network Access

Section 4:

  • Managing Access to Cloud-Native Storage
  • Data-Lake Access Controls and Governance
  • Architecting for Big Data Governance
  • Data Resiliency: Key Management and Backup Strategies

Section 5:

  • Centralizing Cloud-Native Events
  • Exporting Cloud Telemetry to an External SIEM
  • Architecting Network-layer Quarantine

"I've done a lot of labs over the years, These are likely one of the best ways to present them I've ever used." -Daniel Russell  BCBSLA

"The labs and exercises were excellent and provided additional supplementary, hands-on learning that helped solidify the course content." - Tyler Piller, British Columbia Lottery Corporation

"All three of today's labs were helpful in cementing the concepts. The "See It In Action" portions were particularly useful." - Oritse Uku

"I really liked that architecture diagrams were incorporated in each."- Greg Lewis, SAP


  • Section 1: A foundational section covering IAM in the cloud, the higher-level resource containers in each of the 3 major cloud providers, and how to use restrictive policy to enforce guardrails on an enterprise-scale cloud estate.
  • Section 2: A heavy emphasis on zero-trust and how to use cloud services to employ a ZT strategy to authorize access to cloud resources and build guardrails preventing unauthorized access.
  • Section 3: Managing cloud network resources at-scale requires an architect to understand cloud-native network controls. Learn how to centralize network configuration, enforce micro-segmentation, configure traffic inspection appliances, and share network services across accounts.
  • Section 4: Protecting data in the cloud requires security teams to examine cloud-native data protection capabilities. Learn how to protect and govern data stored in cloud-native storage and big data services.
  • Section 5: In this section we focus on how to uplift a SOCs capabilities, adapt traditional methodologies to cloud-hosted environments, ensuring robust detection and response continues as an organization shifts their workloads to the cloud.



  • Printed and electronic courseware
  • architectural diagrams representing secure patterns you can use as reference architecture
  • Access to the SEC549 Cloud lab environment


Depending on your current role or future plans, one of these courses is a great next step in your cloud security journey:

Syllabus (30 CPEs)

Download PDF
  • Overview

    SEC549 kicks off by defining concepts used throughout the course such as threat modeling the cloud, what makes a secure pattern and how our mental models need to adapt for the cloud.

    This section dedicates a portion of time to foundational concepts of identity in the cloud from users, groups, roles, and machine identities and how those concepts subtly differ across the 3 major cloud providers. Managing identity in the cloud is an overarching theme of this section. This course teaches students the core concepts of identity federation, single sign-on, and the protocols used in these technologies. Using AWS SSO as an example, students are taught how to enable identity federation in support of a centralized workforce identity, automatically provision users to the cloud and centrally maintain attributes governing access control.

    • Threat Modeling the Cloud
    • Centralizing User Account Provisioning
    • Structuring Accounts to Create Effective Hierarchies
    • Transitioning Access from IAM Users to Roles
    • Security Architecture in the cloud with an emphasis on threat modeling cloud-native services
    • Using the large-scale building blocks offered in three CSP to create effective hierarchical designs
    • Implementing an identity foundation - understanding how permissions are granted and patterns of IAM in the cloud
    • Federated access and single sign-on - managing users at scale with the federation of identity
  • Overview

    Identity and access control forms the basis of the concepts of this section. Section 2 starts with an in-depth look at the zero-trust movement, its history and how zero-trust in the cloud can be leveraged to uplift legacy access patterns. We not only discuss permission granting architectures but also how to build identity guardrails into your cloud estates, ensuring constraints are placed for security or compliance purposes. Students will learn how to authenticate end users and machine identities across multiple public cloud environments. The section wraps up by implementing policies that restrict access between an organization's resources and trusted third parties. A key take-away from this section is how to implement policies that restrict access between an organization's resources and trusted third parties.

    Wrapping up this section, students focus on Azure AD Conditional Access and how policies are crafted to define the guardrails for resource access. Taking a strong practical lens to Conditional Access, students will learn how to narrowly and safely carve out business-driven exceptions to multi-factor authentication (MFA) enforcement.

    • Threat Modeling Zero-Trust Access
    • Integrating Modern Authentication into Legacy Applications
    • Scaling Cross-Cloud Authentication
    • Enforcing Cross-Cloud Identity Boundaries
    • Balancing Security and Usability with Conditional Access Policy
    • Cloud Migrations - considerations and business drivers
    • Zero-Trust Concepts - using cloud services to implement zero-trust patterns in a phased approach
    • Implementing the Identity Pillar into Cloud-hosted applications using AWS Cognito
    • Authenticating users and workloads across cloud providers (AWS, Azure, and Google Cloud) with workload identity federation
    • Enforcing identity boundaries with guardrails across clouds
    • Designing effective Conditional Access Policies
  • Overview

    With a solid identity foundation, students shift focus to cloud architecture patterns for their organization. Building an enterprise cloud network requires a fundamental understanding of how things change moving from an on-premise network. Section 3 starts with the key resources required to build public, private, and hybrid cloud networks. From there, students learn to centrally manage the configuration of these resources across their organization. Next, we explore cloud micro-segmentation, hub and spoke networks, and routing traffic between micro-networks. Our focus then shifts to centralizing traffic flow through ingress and egress networks, as well as inspecting east-west traffic with third-party security appliances. Finally, students learn how to share network services by adding additional spoke networks and sharing DNS configurations across the organization.

    • Centralizing Network Security Controls
    • Building a Transit Gateway
    • Network Firewall Policies
    • VPC Private Network Access
    • Comparing on-premise and cloud-hosted virtual networks
    • Managing cloud-hosted networks at scale with VPC sharing and the firewall manager
    • Building micro-segmentation and hybrid networks with hub and spoke architecture
    • Centralizing ingress and egress traffic network controls
    • Inspecting east-west traffic with third-party security appliances
    • Sharing network services and private DNS resources

  • Overview

    Section 4 focuses on cloud-native data protection patterns. Starting with common organization-wide storage service controls, students will establish foundational data perimeter policies. From there, we learn to segment data lake access through views and access points. Next, students explore how attribute-based access control, tagging, and data masking can enable cloud-native data loss prevention controls. Finally, the section wraps up with key management and backup architecture patterns.

    • Public Data Storage Organization Policies
    • Access Control for Shared Data Sets
    • Big Query Data Governance and Data Loss Prevention
    • Centralizing Key Management (KMS) Resources
    • Managing access to Cloud-Native Storage services
    • Establishing perimeters in the Cloud for application access
    • Data-Lake access control and governance with access points and views
    • Big Query (BQ) identity and data exfiltration controls
    • Data tagging for attribute-based access control, masking, and data loss prevention
    • Centralizing key management and data backup resources
  • Overview

    This section covers how to enable your SOC to operate (investigate incidents, log events, hunt for threats) in the new cloud-based world. Covered in this section is a deep dive on cloud data sources, aggregating logs and cloud-native events within the CSP while positioning them for export to the central SIEM. This section teaches students how to build effective architecture which empowers defenders to respond, contain and ultimately recover from cloud-based incidents.

    • Centralizing Cloud-Native Events
    • Exporting Cloud Telemetry to an External SIEM
    • Architecting Network-layer Quarantine
    • Security Operations in a Cloud-Centric World
    • In-depth look at data sources logging and aggregation to ensure sufficient logging coverage given various service models (IaaS, PaaS, SaaS)
    • Enabling response in the cloud with network-layer and identity-layer quarantine zones
    • Designing break-glass accounts for cloud account recovery with availability in mind


The following are courses or equivalent experiences that are prerequisites for SEC549:

Preparing for SEC549

Students taking SEC549 will have the opportunity to learn identity access management (IAM) patterns in the cloud. A basic familiarity with IAM concepts like role-based access control, attribute-based access control and permission management is helpful but not required.

Additionally, students will delve into cloud-native tools for securing deployments at the network layer. Having a basic understanding of network concepts such as firewalls, network access control lists and IP addressing is helpful but not mandatory.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.


  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.


  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact

Author Statement

"The cloud has turned our perimeter increasingly distributed and is often solely enforced with identity-based controls. In the cloud, safeguards have been lifted and the room for error is slim. Even with this grim reality, I am still optimistic. The migration to the cloud has enabled our most innovative technologies and presents an opportunity for the security sector to evolve and mature.

If armed with the correct foundational principles, we can as an industry build a more secure future, with greater availability and confidentiality than ever possible on-premises. If history has taught us anything, transitioning to the new cloud-native, zero-trust world will be bumpy but I am so pleased to help shepherd you along the journey."

- Kat Traxler & Eric Johnson

"Eric nailed it. Knowledgeable, experienced, and enthusiastic." - Daniel Russell, BCBSLA

"Throughout this course I was continually impressed with the quality of the content in this course. This is very challenging subject matter and Eric makes it relatable and provides a ton of real-world examples to help solidify the content." - Tyler Piller, British Columbia Lottery Corporation


Exercises provoke thought and instill good discussions.
Soe San Win
Robert Bosch, LLC
The content is excellent, provides a lens and framework to look at enterprise problems from an architectural lens and will provide actionable information that can be used Day 1 after this course.
Tyler Piller
British Columbia Lottery Corporation
Current information and lots of it.
Michael Martin
Banner Health

    Register for SEC549


    All pricing excludes applicable taxes