Sécurité du cloud : Azure, AWS et Google Cloud

Ce que vous saurez faire

1. Sécuriser AWS/Azure/GCP avec IAM minimal
2. KMS pour chiffrement
3. VPC et network policies
4. Monitoring CloudTrail

Étape 1 — Responsabilité partagée

Provider:  physique, hyperviseur, network core
Client:    OS, apps, data, IAM, network virtuel

Mauvaise config IAM = JAMAIS la faute du fournisseur.

Étape 2 — IAM avec MFA obligatoire

aws iam create-user --user-name aminata
aws iam create-access-key --user-name aminata

# Policy least-privilege
aws iam put-user-policy --user-name aminata \
  --policy-name ReadOnlyS3 \
  --policy-document file://policy.json

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject","s3:ListBucket"],
    "Resource": ["arn:aws:s3:::itsc-docs","arn:aws:s3:::itsc-docs/*"],
    "Condition": {
      "Bool": { "aws:MultiFactorAuthPresent": "true" }
    }
  }]
}

Étape 3 — Rotation clés automatique

#!/usr/bin/env bash
# Tous les 90j
USER=aminata
NEW=$(aws iam create-access-key --user-name $USER --query 'AccessKey.AccessKeyId' --output text)
# Update app avec $NEW
# Puis:
aws iam update-access-key --user-name $USER --access-key-id ANCIEN --status Inactive

Étape 4 — KMS chiffrement

aws kms create-key --description "itsc-app-key"

aws s3api put-bucket-encryption --bucket itsc-docs \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "arn:aws:kms:us-east-1:123:key/abc"
      },
      "BucketKeyEnabled": true
    }]
  }'

Étape 5 — Azure KeyVault

az keyvault key create --vault-name itsc-kv --name app-key --kty RSA --size 4096

az storage account update --name itscstorage \
  --encryption-key-vault $VAULT_URI \
  --encryption-key-name app-key \
  --encryption-key-source Microsoft.Keyvault

Étape 6 — VPC avec subnets privés

aws ec2 create-vpc --cidr-block 10.0.0.0/16
aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.0.1.0/24 --availability-zone us-east-1a  # public
aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.0.10.0/24 --availability-zone us-east-1a # privé

aws ec2 create-security-group --group-name itsc-api-sg --vpc-id vpc-xxx
aws ec2 authorize-security-group-ingress --group-id sg-xxx \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

Étape 7 — CloudTrail

aws cloudtrail create-trail --name itsc-audit \
  --s3-bucket-name itsc-audit-logs \
  --is-multi-region-trail \
  --include-global-service-events \
  --kms-key-id arn:aws:kms:us-east-1:123:key/abc

aws cloudtrail start-logging --name itsc-audit

Étape 8 — Azure Activity Log

az monitor diagnostic-settings create \
  --name itsc-audit-diag \
  --resource /subscriptions/$SUB/resourceGroups/rg-itsc \
  --logs '[{"category":"Administrative","enabled":true}]' \
  --workspace /subscriptions/$SUB/resourceGroups/rg-audit/providers/Microsoft.OperationalInsights/workspaces/itsc-logs

Étape 9 — Config Rules (guardrails)

Resources:
  Rule1:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Source: { Owner: AWS, SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED }
  Rule2:
    Properties:
      ConfigRuleName: encrypted-volumes
      Source: { Owner: AWS, SourceIdentifier: ENCRYPTED_VOLUMES }
  Rule3:
    Properties:
      ConfigRuleName: root-account-mfa-enabled
      Source: { Owner: AWS, SourceIdentifier: ROOT_ACCOUNT_MFA_ENABLED }

Étape 10 — Secrets Manager

aws secretsmanager create-secret --name prod/db/creds \
  --secret-string '{"username":"app","password":"'$(openssl rand -base64 32)'"}'

# Rotation auto
aws secretsmanager rotate-secret --secret-id prod/db/creds \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123:function:rotate-db \
  --rotation-rules AutomaticallyAfterDays=30

# Usage app
DB_SECRET=$(aws secretsmanager get-secret-value --secret-id prod/db/creds --query SecretString --output text)

Étape 11 — Zero Trust (Private Endpoints)

# VPC Endpoint S3 = pas d'Internet
aws ec2 create-vpc-endpoint --vpc-id vpc-xxx \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-xxx \
  --vpc-endpoint-type Gateway

# Azure: Private Endpoint
# GCP: Private Service Connect

Étape 12 — WAF managé

aws wafv2 create-web-acl --name itsc-waf --scope CLOUDFRONT \
  --region us-east-1 \
  --default-action Allow={} \
  --rules '[{
    "Name": "AWS-AWSManagedRulesCommonRuleSet",
    "Priority": 1,
    "OverrideAction": { "None": {} },
    "Statement": {
      "ManagedRuleGroupStatement": {
        "VendorName": "AWS",
        "Name": "AWSManagedRulesCommonRuleSet"
      }
    },
    "VisibilityConfig": {
      "SampledRequestsEnabled": true,
      "CloudWatchMetricsEnabled": true,
      "MetricName": "CommonRuleSet"
    }
  }]'

Checklist hebdo

✓ Aucun IAM sans MFA
✓ Aucune clé d'accès > 90 jours
✓ Tous buckets chiffrés, non publics
✓ CloudTrail/Activity Log actif global
✓ Aucun SG avec 0.0.0.0/0 sur 22/3389
✓ Alertes cost overrun configurées
✓ Secrets dans vault, jamais en IaC clair