Niagaros Cloud Security Academy

See Niagaros in Action
Discover how Niagaros automates compliance and turns high-risk attack paths into remediations.

New to Cloud Security?

Cloud security is one of the fastest-growing skills in tech. Whether your goal is to earn advanced certifications (for multi-cloud golden jackets) or become a cloud security engineer, focusing on identity, isolation, visibility, and automation is key.

This guide breaks down 14-day fast-track paths for AWS, Azure, GCP, EU Cloud and Oracle Cloud Infrastructure (OCI). Each roadmap is designed to give real-world skills and certification readiness.

Why 14 Days?
Each cloud has core security pillars that overlap: IAM/Identity, Network Isolation, Logging & Detection, and Automation.
Hands-on labs and scenario-based practice are more effective than reading theory.

This 14-day schedule is intense but realistic, giving you mastery in a focused period.

Niagaros Platform & Fundamentals

Niagaros company, platform, objectives, target users, market size, job roles, glossary, compliance frameworks and unified cloud security categories.

Cloud Security Academy

1. AWS Security – Advanced

Amazon Web Services (AWS) is the most widely adopted cloud platform globally, which also makes it the most frequently targeted. AWS security expertise—especially around IAM, multi-account governance, detection, and automation—is one of the most valuable cloud security skill sets today.

This guide provides a 14-day roadmap to reach AWS Security Advanced level and prepare for the AWS Certified Security – Specialty exam. It focuses on real-world security engineering, not memorization.

Study Commitment and Goal

• Time per day: 3–4 focused hours
• Audience: Cloud engineers, security engineers, DevOps, platform teams

Primary goals:

• AWS Security Advanced proficiency
• AWS Security Specialty exam readiness
• Practical detection, investigation, and automation skills

Core Mental Model for AWS Security

All AWS security decisions map back to four non-negotiable pillars.

Identity (IAM First, Always)

IAM is the AWS control plane and the most common root cause of security failures.

Key components:

• IAM users, roles, and groups
• Permission policies and trust policies
• Explicit denies and policy conditions
• IAM Identity Center (SSO)

If identity is compromised, every AWS service is compromised.

Isolation

Isolation limits blast radius and prevents small mistakes from becoming major incidents.

Key mechanisms:

• AWS Organizations and multi-account strategy
• Service Control Policies (SCPs)
• Permission boundaries
• Network isolation using VPCs and endpoints

Visibility

You cannot secure what you cannot see.

Visibility relies on:

• CloudTrail
• GuardDuty
• Security Hub
• Amazon Detective

Logs and detections are the foundation of investigation and compliance.

Automation

Security must scale faster than attackers.

Automation includes:

• EventBridge
• Lambda-based remediation
• Policy-as-code
• CI/CD security enforcement

The goal is always prevent, then detect, then respond.

Day 1: IAM Core

Day one focuses on mastering AWS IAM fundamentals.

You will learn:

• Differences between IAM users, roles, and groups
• IAM policy evaluation logic
• How explicit denies override allows
• How conditions affect access decisions

Hands-on work:

• Write a least-privilege IAM policy manually
• Test policies using the IAM Policy Simulator
• Validate access decisions without guessing

Outcome: You can predict IAM behavior confidently.

Day 2: Organization-Level Control

Day two introduces enterprise-scale AWS governance.

Key topics:

• AWS Organizations structure
• SCPs versus IAM policies
• Permission boundaries and their use cases

Hands-on work:

• Create an SCP blocking public S3 access
• Create an SCP blocking root account usage
• Validate SCP enforcement across accounts

Outcome: You can prevent catastrophic mistakes globally.

Day 3: Advanced IAM and Federation

Day three focuses on advanced access patterns.

Key topics:

• Cross-account IAM roles
• External ID in trust policies
• Attribute-Based Access Control (ABAC) using tags
• IAM Identity Center (SSO) integration

Hands-on work:

• Build and test cross-account access
• Diagram a secure IAM architecture

Outcome: You can design secure access for complex organizations.

Day 4: Encryption and Secrets Management

Day four is dedicated to data protection.

Key topics:

• AWS KMS and customer-managed keys
• Key policies versus IAM policies
• Envelope encryption

Hands-on work:

• Encrypt S3 buckets using KMS
• Encrypt EBS volumes
• Encrypt RDS databases
• Compare Secrets Manager and SSM Parameter Store

Outcome: You can protect data at rest and manage secrets securely.

Day 5: Network Isolation

Networking is a common attack path.

Key topics:

• Security Groups versus Network ACLs
• Designing private-only subnet architectures
• Eliminating public IPs

Hands-on work:

• Create VPC endpoints for S3 and STS
• Validate no public access paths exist

Outcome: You can design zero-trust network architectures.

Day 6: Logging and Auditability

Security without logs is blind.

Key topics:

• Organization-wide CloudTrail
• Management events and data events
• Centralized logging accounts

Hands-on work:

• Enable CloudTrail across all accounts
• Centralize logs securely
• Protect log buckets with least-privilege policies

Outcome: You have tamper-resistant audit trails.

Day 7: Threat Detection

Day seven introduces AWS’s detection stack.

Key topics:

• GuardDuty organization-wide enablement
• GuardDuty finding categories
• Security Hub and CIS benchmarks

Hands-on work:

• Review sample GuardDuty findings
• Analyze Security Hub alerts

Outcome: You can detect suspicious activity early.

Day 8: Investigation

Detection only matters if you can investigate.

Key topics:

• Amazon Detective
• CloudTrail event analysis

Hands-on work:

• Investigate an IAM credential compromise
• Investigate an EC2 crypto-mining scenario
• Document investigation steps

Outcome: You can perform structured security investigations.

Day 9: Incident Response

Day nine focuses on structured incident response.

Key topics:

• AWS incident response lifecycle
• Containment and recovery strategies

Hands-on work:

• Create incident response playbooks
• Simulate IAM credential compromise
• Contain compromised identities

Outcome: You can respond to real AWS security incidents.

Day 10: Automated Remediation

Automation is how AWS security scales.

Key topics:

• EventBridge-driven workflows
• Lambda remediation patterns

Hands-on work:

• Disable compromised IAM keys automatically
• Isolate EC2 instances
• Lock down S3 buckets
• Test end-to-end remediation

Outcome: You can respond in seconds, not hours.

Day 11: Infrastructure as Code Security

Modern AWS environments are built with code.

Key topics:

• Terraform and AWS CDK security patterns
• Avoiding wildcard IAM permissions

Hands-on work:

• Secure Terraform state with S3 and DynamoDB
• Enforce IAM changes via code review
• Run IaC security scans

Outcome: Security is enforced before deployment.

Day 12: CI/CD Security

Day twelve secures the delivery pipeline.

Key topics:

• GitHub Actions with AWS OIDC
• Eliminating long-lived credentials

Hands-on work:

• Integrate tfsec or Checkov
• Enable secrets scanning
• Enforce pipeline failures on misconfigurations

Outcome: CI/CD pipelines do not become an attack vector.

Day 13: Exam Lock-In

This day consolidates knowledge.

Hands-on work:

• Take a full practice exam
• Review incorrect answers
• Map mistakes to exam domains
• Rebuild weak areas hands-on

Outcome: Exam readiness with confidence.

Day 14: Final Review and Validation

The final day confirms readiness.

You should be able to:

• Whiteboard a secure multi-account AWS architecture
• Walk through a complete incident response scenario
• Clearly explain IAM, KMS, GuardDuty, CloudTrail, and Security Hub

What This Guide Intentionally Skips

To stay focused and efficient, this guide skips:

• Non-security AWS services
• Excessive theory
• Low-ROI or niche features

Outcome Validation

By the end of 14 days, you should be able to:

• Design secure multi-account AWS architectures
• Explain IAM decisions clearly and defensibly
• Detect, investigate, and respond to AWS security incidents
• Automate preventative and corrective controls
• Perform at AWS Security Specialty or senior cloud security engineer level

2. Azure Security – Advanced

Microsoft Azure is deeply integrated with enterprise identity, productivity, and hybrid infrastructure. Because of this, Azure security expertise—especially around Entra ID, RBAC, policy enforcement, and threat detection—is critical for securing modern organizations.

This guide provides a 14-day  roadmap to reach Azure Security Advanced level and prepare for senior cloud security roles and certifications such as AZ-500. It focuses on real-world security engineering and operational readiness.

Study Commitment and Goal

• Time per day: 3–4 focused hours
• Audience: Cloud engineers, security engineers, DevOps, platform teams

Primary goals:

• Azure Security Advanced proficiency
• Enterprise-grade identity and governance design
• Practical detection, investigation, and automation skills

Core Mental Model for Azure Security

All Azure security decisions align to four foundational pillars.

Identity (Entra ID Is the Control Plane)

Identity is the primary security boundary in Azure.

Key components:

• Microsoft Entra ID users, groups, and service principals
• Role-Based Access Control (RBAC)
• Conditional Access policies
• Privileged Identity Management (PIM)

If identity is compromised, subscriptions, resources, and data are exposed.

Isolation

Isolation reduces blast radius across environments.

Key mechanisms:

• Management groups and subscriptions
• Azure Policy and policy initiatives
• Resource locks
• Network isolation using VNets and private endpoints

Visibility

Security requires centralized visibility and correlation.

Visibility relies on:

• Azure Activity Logs
• Azure Monitor and Log Analytics
• Microsoft Defender for Cloud
• Microsoft Sentinel

Automation

Azure security must be enforced continuously.

Automation includes:

• Azure Policy remediation
• Logic Apps and Functions
• Security-as-code
• CI/CD enforcement

The goal is prevent, then detect, then respond.

Day 1: Identity and RBAC Fundamentals

Day one focuses on Entra ID and RBAC fundamentals.

You will learn:

• Entra ID users, groups, and service principals
• Azure RBAC role definitions and scopes
• Role assignment inheritance
• Built-in roles versus custom roles

Hands-on work:

• Assign least-privilege roles at resource group scope
• Test effective permissions
• Review sign-in and audit logs

Outcome: You can predict access behavior confidently.

Day 2: Tenant and Subscription Governance

Day two introduces enterprise governance patterns.

Key topics:

• Management groups hierarchy
• Subscription isolation strategies
• Azure Policy versus RBAC
• Policy initiatives and assignments

Hands-on work:

• Create policies blocking public IPs
• Enforce allowed locations
• Prevent deletion of critical resources

Outcome: You can enforce guardrails at scale.

Day 3: Advanced Identity and Privileged Access

Day three covers advanced identity security.

Key topics:

• Conditional Access policies
• Privileged Identity Management (PIM)
• Identity Protection risk signals
• Managed identities

Hands-on work:

• Enforce MFA for privileged roles
• Configure just-in-time access
• Secure service-to-service authentication

Outcome: You can secure both human and workload identities.

Day 4: Data Protection and Secrets

Day four focuses on data security.

Key topics:

• Azure Key Vault
• Managed HSM
• Encryption at rest and in transit

Hands-on work:

• Store secrets and certificates in Key Vault
• Enable customer-managed keys for storage accounts
• Encrypt Azure SQL and managed disks

Outcome: You can protect sensitive data and secrets.

Day 5: Network Security and Isolation

Networking is a major attack surface.

Key topics:

• Network Security Groups (NSGs)
• Azure Firewall
• Application Gateway and WAF
• Private endpoints

Hands-on work:

• Remove public endpoints
• Enforce private-only access to PaaS services
• Validate traffic flow restrictions

Outcome: You can design private, zero-trust network architectures.

Day 6: Logging and Monitoring

Without logs, investigations fail.

Key topics:

• Azure Activity Logs
• Resource diagnostic settings
• Log Analytics workspaces

Hands-on work:

• Centralize logs across subscriptions
• Enable diagnostics for critical services
• Protect log data retention and access

Outcome: You have reliable audit and telemetry data.

Day 7: Threat Detection

Day seven introduces Azure’s native detection capabilities.

Key topics:

• Microsoft Defender for Cloud
• Secure Score
• Regulatory compliance standards

Hands-on work:

• Enable Defender plans
• Review security recommendations
• Analyze sample alerts

Outcome: You can detect misconfigurations and threats.

Day 8: Security Investigation

Detection must lead to investigation.

Key topics:

• Microsoft Sentinel analytics
• KQL fundamentals

Hands-on work:

• Investigate suspicious sign-in activity
• Trace resource modifications
• Correlate identity and network events

Outcome: You can perform cloud-scale investigations.

Day 9: Incident Response

Day nine focuses on structured response.

Key topics:

• Azure incident response lifecycle
• Containment strategies for identity and compute

Hands-on work:

• Build incident response playbooks
• Disable compromised accounts
• Isolate virtual machines

Outcome: You can contain and recover from incidents.

Day 10: Automated Remediation

Automation reduces response time.

Key topics:

• Azure Policy remediation tasks
• Logic Apps and Azure Functions

Hands-on work:

• Auto-remediate non-compliant resources
• Trigger workflows from security alerts
• Validate remediation effectiveness

Outcome: Security actions execute automatically.

Day 11: Infrastructure as Code Security

Infrastructure must be secured before deployment.

Key topics:

• ARM, Bicep, and Terraform security patterns
• Parameterization and secrets handling

Hands-on work:

• Enforce policy compliance in IaC
• Secure state and pipelines
• Review role assignments as code

Outcome: Security is embedded in deployment workflows.

Day 12: CI/CD and Supply Chain Security

Pipelines are high-value targets.

Key topics:

• Azure DevOps and GitHub Actions security
• Workload identity federation

Hands-on work:

• Remove stored secrets from pipelines
• Integrate IaC security scanning
• Enforce pipeline security gates

Outcome: Delivery pipelines are hardened.

Day 13: Knowledge Lock-In

Day thirteen consolidates understanding.

Hands-on work:

• Take a practice exam
• Review weak domains
• Rebuild scenarios hands-on

Outcome: Confidence in real-world and exam scenarios.

Day 14: Final Review and Validation

The final day confirms readiness.

You should be able to:

• Design secure Azure tenant and subscription architectures
• Explain RBAC, Policy, and Entra ID decisions clearly
• Detect, investigate, and respond to Azure security incidents

What This Guide Intentionally Skips

To maintain focus, this guide skips:

• Non-security Azure services
• Excessive theory
• Low-impact features

Outcome Validation

By the end of 14 days, you should be able to:

• Secure enterprise-scale Azure environments
• Implement least-privilege identity and governance
• Detect and respond to Azure security threats
• Automate preventative and corrective controls
• Operate at senior Azure security engineer level

3. GCP Security – Advanced

Google Cloud Platform security is built around strong identity, strict project isolation, and service-level perimeters. Mastery of GCP security requires deep understanding of IAM, organization policies, VPC design, logging, and Security Command Center.

This 14-day ultra-compressed guide is designed to elevate you to GCP Security Advanced level and prepare you for senior cloud security roles and the Professional Cloud Security Engineer certification.

Study Commitment and Goal

• Time per day: 3–4 focused hours
• Audience: Cloud security engineers, platform engineers, DevSecOps teams

Primary goals:

• GCP Security Advanced proficiency
• Enterprise-grade identity and perimeter design
• Practical detection, investigation, and automation skills

Core Mental Model for GCP Security

GCP security decisions align to four foundational pillars.

Identity

IAM is the primary control plane in GCP.

Key components:

• IAM users, groups, and service accounts
• Primitive, predefined, and custom roles
• IAM Conditions
• Workload Identity Federation

If IAM is overly permissive, all resources are exposed.

Isolation

GCP relies on strong resource hierarchy and network perimeters.

Key mechanisms:

• Organization, folders, and projects
• Shared VPC and service projects
• VPC Service Controls
• Firewall rules and private access

Visibility

Visibility is centralized and audit-focused.

Visibility relies on:

• Cloud Audit Logs
• Cloud Logging and Monitoring
• Cloud Asset Inventory
• Security Command Center

Automation

Automation enforces consistency and reduces risk.

Automation includes:

• Organization Policies
• Event-driven remediation
• Infrastructure as code
• CI/CD enforcement

The goal is prevent, then detect, then respond.

Day 1: IAM Fundamentals

Day one establishes IAM mastery.

You will learn:

• GCP resource hierarchy
• Role types and inheritance
• Policy bindings and members

Hands-on work:

• Create least-privilege IAM policies
• Assign roles at project scope
• Validate permissions using gcloud

Outcome: You can reason about effective permissions confidently.

Day 2: Advanced IAM and Workload Identity

Day two focuses on non-human identity.

Key topics:

• Service account creation and usage
• Keyless authentication patterns
• Workload Identity Federation
• IAM Conditions

Hands-on work:

• Remove service account keys
• Enforce conditional access
• Audit IAM via Cloud Asset Inventory

Outcome: You can secure both human and workload identities.

Day 3: Organization and Project Governance

Day three covers enterprise guardrails.

Key topics:

• Folder and project hierarchy design
• Organization Policies
• Domain-restricted sharing

Hands-on work:

• Enforce no public IP policies
• Require encryption at rest
• Prevent resource creation outside approved regions

Outcome: You can enforce governance at scale.

Day 4: Network Security and Isolation

Networking defines attack paths.

Key topics:

• VPC firewall rules
• Private Google Access
• Cloud NAT
• VPC peering and restrictions

Hands-on work:

• Remove public IP exposure
• Enforce private service access
• Validate traffic restrictions

Outcome: You can design private-by-default networks.

Day 5: Data Protection and Secrets

Day five focuses on protecting sensitive data.

Key topics:

• Cloud KMS and key hierarchy
• Customer-managed encryption keys
• Secret Manager

Hands-on work:

• Encrypt storage and databases
• Apply IAM controls to keys
• Rotate secrets securely

Outcome: You can manage encryption and secrets effectively.

Day 6: Logging and Monitoring

Without audit logs, security is blind.

Key topics:

• Cloud Audit Logs types
• Logging sinks and destinations
• Cloud Monitoring alerts

Hands-on work:

• Centralize logs organization-wide
• Create security alerts
• Protect log integrity

Outcome: You have reliable telemetry for investigations.

Day 7: Threat Detection

Day seven introduces detection services.

Key topics:

• Security Command Center
• Event Threat Detection
• Vulnerability findings

Hands-on work:

• Review and triage findings
• Map findings to remediation actions
• Measure security posture

Outcome: You can identify misconfigurations and threats.

Day 8: Security Investigation

Detection must lead to investigation.

Key topics:

• Log-based investigations
• IAM activity analysis
• Network flow visibility

Hands-on work:

• Investigate compromised service account scenario
• Trace suspicious API usage
• Document investigation steps

Outcome: You can perform structured investigations.

Day 9: Incident Response

Day nine focuses on response workflows.

Key topics:

• GCP incident response lifecycle
• IAM containment strategies

Hands-on work:

• Disable compromised identities
• Rotate credentials
• Contain affected resources

Outcome: You can respond decisively to incidents.

Day 10: Automated Remediation

Automation reduces response time.

Key topics:

• Cloud Functions
• Pub/Sub event triggers

Hands-on work:

• Auto-remediate policy violations
• Respond automatically to findings
• Validate remediation

Outcome: Security actions execute without manual intervention.

Day 11: Infrastructure as Code Security

Security must exist before deployment.

Key topics:

• Terraform security patterns
• Policy enforcement in CI

Hands-on work:

• Scan IaC templates
• Prevent insecure deployments
• Secure state files

Outcome: Infrastructure is secure by default.

Day 12: CI/CD and Supply Chain Security

Pipelines are attack vectors.

Key topics:

• Cloud Build security
• Identity federation for CI/CD
• Secrets handling

Hands-on work:

• Remove static credentials
• Integrate security scanning
• Enforce pipeline controls

Outcome: Build systems are hardened.

Day 13: Knowledge Lock-In

Day thirteen consolidates skills.

Hands-on work:

• Practice PCSE exam scenarios
• Review weak domains
• Rebuild core labs

Outcome: Confidence across security domains.

Day 14: Final Review and Validation

The final day confirms readiness.

You should be able to:

• Design secure multi-project GCP architectures
• Explain IAM and perimeter decisions
• Detect and respond to GCP security incidents

What This Guide Intentionally Skips

To maintain focus, this guide skips:

• Non-security GCP services
• Excessive theory
• Low-impact features

Outcome Validation

By the end of 14 days, you should be able to:

• Secure enterprise-scale GCP environments
• Enforce least-privilege IAM and perimeters
• Detect and respond to cloud-native threats
• Automate preventative and corrective controls
• Operate at senior GCP security engineer level

4. OCI Security – Advanced

Oracle Cloud Infrastructure security is built around strong tenancy isolation, compartment-based access control, and policy-driven automation. OCI’s security model is explicit and deterministic, which makes it powerful but unforgiving if misunderstood.

This 14-day ultra-compressed guide is designed to take you to OCI Security Advanced level and prepare you for senior OCI security roles and the OCI Security Specialist certification.

Study Commitment and Goal

• Time per day: 3–4 focused hours
• Audience: Cloud security engineers, platform engineers, DevSecOps teams

Primary goals:

• OCI Security Advanced proficiency
• Enterprise-grade compartment and IAM design
• Practical detection, investigation, and automation skills

Core Mental Model for OCI Security

OCI security decisions align to four foundational pillars.

Identity

OCI IAM defines access using explicit policies.

Key components:

• Tenancy and compartments
• Users, groups, and dynamic groups
• IAM policies written in natural language
• Identity federation

If policies are overly broad, compartment isolation fails.

Isolation

Isolation is enforced primarily through compartments and networks.

Key mechanisms:

• Compartment hierarchy
• Virtual Cloud Networks (VCNs)
• Subnets and route tables
• Network Security Groups and Security Lists

Visibility

Visibility is centralized at the tenancy level.

Visibility relies on:

• OCI Audit
• Logging and Logging Analytics
• Events service
• Cloud Guard

Automation

Automation reduces manual intervention and enforces consistency.

Automation includes:

• Cloud Guard responders
• Event-driven remediation
• Infrastructure as code
• Policy-based controls

The objective is prevent first, detect second, respond automatically.

Day 1: Tenancy and IAM Fundamentals

Day one establishes the OCI security foundation.

You will learn:

• OCI tenancy structure
• Compartment hierarchy and inheritance
• IAM policy syntax and evaluation

Hands-on work:

• Create compartments
• Write least-privilege policies
• Test access using OCI CLI

Outcome: You can reason about access boundaries confidently.

Day 2: Advanced IAM and Federation

Day two focuses on advanced identity patterns.

Key topics:

• Dynamic groups for compute and services
• Federation with external identity providers
• Cross-tenancy access

Hands-on work:

• Assign dynamic group permissions
• Integrate federated identity
• Audit IAM activity using OCI Audit

Outcome: You can secure both human and workload identities.

Day 3: Compartment and Resource Governance

Day three focuses on isolation at scale.

Key topics:

• Compartment design patterns
• Tagging strategies for access control
• Policy inheritance and overrides

Hands-on work:

• Apply policies at compartment scope
• Enforce least privilege
• Validate isolation boundaries

Outcome: You can enforce governance across the tenancy.

Day 4: Network Security and Segmentation

Networking defines blast radius.

Key topics:

• VCN design
• Public vs private subnets
• Gateways (Internet, NAT, Service)
• Network Security Groups

Hands-on work:

• Remove public access paths
• Enforce private networking
• Validate traffic flows

Outcome: You can design private-by-default OCI networks.

Day 5: Data Protection and Key Management

Data protection is explicit in OCI.

Key topics:

• OCI Vault and Key Management
• Customer-managed vs Oracle-managed keys
• Secret storage and rotation

Hands-on work:

• Encrypt Object Storage and Block Volumes
• Manage key access policies
• Secure database encryption

Outcome: You can control encryption and secrets lifecycle.

Day 6: Logging and Monitoring

Without audit data, incidents cannot be investigated.

Key topics:

• OCI Audit service
• Service logs and custom logs
• Logging Analytics

Hands-on work:

• Enable tenancy-wide audit logging
• Centralize logs
• Configure alerts

Outcome: You have reliable visibility across the environment.

Day 7: Threat Detection with Cloud Guard

Day seven introduces threat detection.

Key topics:

• OCI Cloud Guard
• Detector and responder recipes
• Risk scoring

Hands-on work:

• Enable Cloud Guard
• Review findings
• Customize detector rules

Outcome: You can identify misconfigurations and threats.

Day 8: Investigation and Forensics

Detection must lead to investigation.

Key topics:

• Audit log analysis
• Cloud Guard incident review
• Resource activity tracing

Hands-on work:

• Investigate IAM violations
• Trace suspicious compute activity
• Document findings

Outcome: You can perform structured investigations.

Day 9: Incident Response

Day nine focuses on response workflows.

Key topics:

• OCI incident response lifecycle
• Identity containment strategies

Hands-on work:

• Disable compromised users
• Isolate compute instances
• Rotate credentials

Outcome: You can respond decisively to incidents.

Day 10: Automated Remediation

Automation reduces response time.

Key topics:

• Cloud Guard responders
• Events service
• Function-based remediation

Hands-on work:

• Auto-remediate policy violations
• Enforce security posture automatically
• Validate remediation workflows

Outcome: Security actions execute without manual intervention.

Day 11: Infrastructure as Code Security

Security must be built before deployment.

Key topics:

• Terraform for OCI
• Secure state storage
• IAM in code

Hands-on work:

• Scan Terraform templates
• Prevent overly permissive policies
• Enforce approvals

Outcome: Infrastructure is secure by default.

Day 12: CI/CD and Supply Chain Security

Pipelines require strict access control.

Key topics:

• OCI DevOps service
• Dynamic groups for pipelines
• Secret handling

Hands-on work:

• Remove static credentials
• Integrate Vault into pipelines
• Enforce pipeline controls

Outcome: CI/CD pipelines are hardened.

Day 13: Knowledge Lock-In

Day thirteen consolidates skills.

Hands-on work:

• Practice OCI Security Specialist scenarios
• Review weak domains
• Rebuild core labs

Outcome: Confidence across OCI security domains.

Day 14: Final Review and Validation

The final day confirms readiness.

You should be able to:

• Design secure multi-compartment OCI architectures
• Explain IAM, network, and encryption decisions
• Detect and respond to OCI security incidents

What This Guide Intentionally Skips

To maintain focus, this guide skips:

• Low-impact OCI services
• Excessive theory
• Non-security features

Outcome Validation

By the end of 14 days, you should be able to:

• Secure enterprise OCI environments
• Enforce least-privilege IAM and compartment isolation
• Detect and respond to OCI-native threats
• Automate preventative and corrective controls
• Operate at senior OCI security engineer level

Outcome: Secure compartment architecture, automated remediation, incident response mastery, OCI Security Specialist-ready.

5. European Cloud Security - Advanced

The same general track is applicable for European cloud providers like OVHcloud, StackIt, Cyso Cloud, Open Telekom Cloud, IONOS, Scaleway, Upcloud, Exoscale, Elastx, Atlas Cloud, Aruba Cloud.

Summary Table