The real graded Cloud Security tasks the portal assigns, grouped into three levels.
The portal assigns these Cloud Security tasks. Finish Level 1 before Level 2 and Level 2 before Level 3. Your mentor may mark some tasks as required for the certificate.
Level 1: Foundations (12 tasks)
Task
What to do
Shared responsibility
In a repo named cloud-security-internship, explain the shared responsibility model for IaaS, PaaS and SaaS with examples from AWS, Azure or GCP.
Secure the root account
On a free cloud account, turn on MFA for the root or owner account, create an admin user and set a billing alert. Screenshot each step (hide account IDs).
IAM least privilege
Create a user who can only read one storage bucket. Prove they cannot list other buckets or delete objects.
Read an IAM policy
Explain 3 IAM policies line by line (Effect, Action, Resource, Condition) and fix one that grants too much.
Storage security
Make a bucket private, block public access, turn on encryption and versioning, and show that a public link fails.
Network security basics
Create a VPC with public and private subnets. Put a VM in the private subnet and explain security groups versus network ACLs.
Encryption
Explain encryption at rest and in transit and key management (KMS). Encrypt a bucket or disk with a customer-managed key.
Secrets handling
Move a hard-coded API key from a sample app into Secrets Manager, Key Vault or Secret Manager and read it at runtime.
Audit logging
Turn on CloudTrail, the Azure Activity Log or Google Cloud audit logs, perform 5 actions and find each one in the logs.
Common misconfigurations
List the top 10 cloud misconfigurations (public buckets, open SSH, unused keys, no MFA and more) with a real breach example for each.
Scan for leaked secrets
Run gitleaks or trufflehog on a test repository containing a fake key and show it being found.
Security benchmark
Read the CIS Benchmark sections for one cloud provider and pick 10 controls to check in your account.
Level 2: Building real features (10 tasks)
Task
What to do
Posture scanning
Run Prowler (AWS/Azure/GCP) or ScoutSuite on your account and fix the 5 most serious findings. Show before and after.
IaC scanning
Write Terraform for a bucket and a VM with deliberate mistakes, find them with Checkov, tfsec or Trivy, and fix them.
Container image scanning
Scan a Docker image with Trivy, explain the critical CVEs, and rebuild it on a smaller base image to reduce them.
Detect risky changes
Create an alert that fires when someone makes a bucket public or adds an admin role, and test it.
Role assumption
Use roles with temporary credentials instead of long-lived access keys for an app or a CI pipeline, and explain why this is safer.
Secure CI/CD
Set up GitHub Actions to deploy with OIDC federation (no stored cloud keys) and least-privilege permissions.
Web application firewall
Put a WAF (AWS WAF, Azure Front Door or Cloud Armor) in front of a test app and block a simple SQL injection pattern.
Kubernetes security basics
In a local cluster, run a pod as non-root with a read-only filesystem and a network policy, and show a blocked connection.
Data protection
Find and classify sensitive data (phone numbers, Aadhaar-like numbers) in a sample bucket with a scanner script or a cloud DLP tool.
Backup and ransomware readiness
Turn on versioning or object lock for backups and show you can recover a file after it is deleted or overwritten.
Level 3: Professional work and capstone (8 tasks)
Task
What to do
Cloud attack simulation
Use a deliberately vulnerable lab (CloudGoat, flaws.cloud or a similar legal lab) and write how each weakness was found and how to fix it.
Incident response in the cloud
Write and test a playbook for a leaked access key: detect, disable, review logs, rotate and report.
Threat model
Make a STRIDE threat model of a 3-tier web app on the cloud and list a control for each threat.
Compliance mapping
Map your account's controls to ISO 27001 or SOC 2 areas and to India's DPDP Act duties, and list the gaps.
Multi-account guardrails
Design an account or project structure with organisation policies (for example, deny public buckets and allowed regions only) and explain it.
Security as code
Write automated checks in Python or with a policy tool (OPA or a cloud config rule) that fail when a resource breaks a rule.
Security report
Write a cloud security assessment report for your setup: findings by severity, evidence, fixes done and remaining risks.
Capstone: secure cloud app
Deploy a small app with least-privilege IAM, encrypted storage, secrets management, logging, alerts and scanning in CI. Submit the repo, the report and a 2-minute video.
Internship