Security › Module 5 › Lesson 3
Cloud Patterns
Cloud reference patterns literacy names shared responsibility, landing zones, identity federation, network hubs, and managed service boundaries — map cloud row on YOUR $ARCH_LAB before patterns lab.
Visual · t41_cloud_reference_patterns
Cloud reference patterns literacy. $ARCH_LAB only. Original Cyberlium.
Opening
Cloud shifts some controls to provider — literacy teaches shared responsibility and landing zone vocabulary so fictional org cloud designs on $ARCH_LAB stay defensible.
Cloud reference architectures document shared responsibility — provider secures infrastructure, customer secures data, identity, and configuration — plus landing zone patterns: org hierarchy, network hub-spoke, centralized logging, IAM guardrails. On Cyberlium you sketch fictional LAB-ARCH-001 cloud slices under $ARCH_LAB using placeholder account labels — never paste employer live cloud tenant IDs or production ARNs. Cyberlium writes cloud pattern row on YOUR $ARCH_LAB — pattern name, customer vs provider responsibility split, one guardrail for fictional LAB-ARCH-001 landing zone. Next: Patterns Lab.
1. Cloud reference patterns (named)
Shared responsibility: provider physical and hypervisor; customer IAM, encryption keys, network ACLs on YOUR fictional org. Landing zone: org unit structure, baseline guardrails, audit logging for LAB-ARCH-001. Hub-spoke: centralized ingress/egress inspection. Managed services: boundary between PaaS provider ops and customer config.
On $ARCH_LAB, write cloud row — pattern, responsibility split, one guardrail example.
Command guide
Try these commands — Cloud reference patterns (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: C4 model (https://c4model.com/); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/); NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why reference patterns accelerate secure design
Reinventing cloud architecture per project repeats IAM and logging mistakes. Reference patterns give reviewers common vocabulary for guardrail checks. Lab patterns stay fictional — production landing zones follow cloud architect and security sign-off.
Students draft lab cloud notes — production patterns follow enterprise cloud governance.
3. Lab boundary
Forbidden: importing employer live cloud account exports or real ARNs into lab. Allowed: cloud reference card — pattern with $ARCH_LAB placeholder account labels.
Ship: cloud pattern row for YOUR lab landing zone. Next: Patterns Lab.
4. What you ship: cloud reference pattern row for $ARCH_LAB
Pattern, responsibility split, guardrail. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Cloud pattern row. $ARCH_LAB named. File t41-m05-l03-cloud-reference-patterns.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Assume provider secures everything so skip IAM guardrails. Paste employer cloud export into lab.
Right
Write cloud reference pattern row for YOUR $ARCH_LAB fictional landing zone. Next: Patterns Lab.
Mission: draft cloud pattern on YOUR lab org
1) Name one reference pattern. 2) Split customer vs provider responsibilities. 3) Document one guardrail for LAB-ARCH-001. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Shared responsibility means customer still owns identity and data — not 'cloud is secure by default.'
Knowledge Check
APPLY: Shared responsibility on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Landing zones define baseline guardrails for cloud org structure.
True or False
Knowledge Check
APPLY: Cloud reference literacy on Cyberlium uses:
Multiple choice