Cloud Security Internship
Secure cloud accounts the way cloud security engineers do: IAM least privilege, storage and network security, encryption and secrets, audit logs, posture scanning, IaC and container scanning, and incident response.
What you'll work on
- Level 1: Foundations - Shared responsibility, Secure the root account, IAM least privilege and more
- Level 2: Building real features - Posture scanning, IaC scanning, Container image scanning and more
- Level 3: Professional work and capstone - Cloud attack simulation, Incident response in the cloud, Threat model and more
Full syllabus: all 30 graded tasks
These are the actual tasks the internship portal assigns for this domain. You submit each one with proof (a GitHub link or document) and a mentor reviews it.
Level 1: Foundations (12 tasks)
- Shared responsibility. In a repo named cloud-security-internship, explain the shared responsibility model for IaaS, PaaS and SaaS with examples from AWS, Azure or GCP.
- Secure the root account. On a free cloud account, turn on MFA for the root or owner account, create an admin user and set a billing alert. Screenshot each step (hide account IDs).
- IAM least privilege. Create a user who can only read one storage bucket. Prove they cannot list other buckets or delete objects.
- Read an IAM policy. Explain 3 IAM policies line by line (Effect, Action, Resource, Condition) and fix one that grants too much.
- Storage security. Make a bucket private, block public access, turn on encryption and versioning, and show that a public link fails.
- Network security basics. Create a VPC with public and private subnets. Put a VM in the private subnet and explain security groups versus network ACLs.
- Encryption. Explain encryption at rest and in transit and key management (KMS). Encrypt a bucket or disk with a customer-managed key.
- Secrets handling. Move a hard-coded API key from a sample app into Secrets Manager, Key Vault or Secret Manager and read it at runtime.
- Audit logging. Turn on CloudTrail, the Azure Activity Log or Google Cloud audit logs, perform 5 actions and find each one in the logs.
- Common misconfigurations. List the top 10 cloud misconfigurations (public buckets, open SSH, unused keys, no MFA and more) with a real breach example for each.
- Scan for leaked secrets. Run gitleaks or trufflehog on a test repository containing a fake key and show it being found.
- Security benchmark. Read the CIS Benchmark sections for one cloud provider and pick 10 controls to check in your account.
Level 2: Building real features (10 tasks)
- Posture scanning. Run Prowler (AWS/Azure/GCP) or ScoutSuite on your account and fix the 5 most serious findings. Show before and after.
- IaC scanning. Write Terraform for a bucket and a VM with deliberate mistakes, find them with Checkov, tfsec or Trivy, and fix them.
- Container image scanning. Scan a Docker image with Trivy, explain the critical CVEs, and rebuild it on a smaller base image to reduce them.
- Detect risky changes. Create an alert that fires when someone makes a bucket public or adds an admin role, and test it.
- Role assumption. Use roles with temporary credentials instead of long-lived access keys for an app or a CI pipeline, and explain why this is safer.
- Secure CI/CD. Set up GitHub Actions to deploy with OIDC federation (no stored cloud keys) and least-privilege permissions.
- Web application firewall. Put a WAF (AWS WAF, Azure Front Door or Cloud Armor) in front of a test app and block a simple SQL injection pattern.
- Kubernetes security basics. In a local cluster, run a pod as non-root with a read-only filesystem and a network policy, and show a blocked connection.
- Data protection. Find and classify sensitive data (phone numbers, Aadhaar-like numbers) in a sample bucket with a scanner script or a cloud DLP tool.
- Backup and ransomware readiness. Turn on versioning or object lock for backups and show you can recover a file after it is deleted or overwritten.
Level 3: Professional work and capstone (8 tasks)
- Cloud attack simulation. Use a deliberately vulnerable lab (CloudGoat, flaws.cloud or a similar legal lab) and write how each weakness was found and how to fix it.
- Incident response in the cloud. Write and test a playbook for a leaked access key: detect, disable, review logs, rotate and report.
- Threat model. Make a STRIDE threat model of a 3-tier web app on the cloud and list a control for each threat.
- Compliance mapping. Map your account's controls to ISO 27001 or SOC 2 areas and to India's DPDP Act duties, and list the gaps.
- Multi-account guardrails. Design an account or project structure with organisation policies (for example, deny public buckets and allowed regions only) and explain it.
- Security as code. Write automated checks in Python or with a policy tool (OPA or a cloud config rule) that fail when a resource breaks a rule.
- Security report. Write a cloud security assessment report for your setup: findings by severity, evidence, fixes done and remaining risks.
- Capstone: secure cloud app. Deploy a small app with least-privilege IAM, encrypted storage, secrets management, logging, alerts and scanning in CI. Submit the repo, the report and a 2-minute video.
Real software work, not just training
Every Cloud Security task is reviewed by our team and saved to your portfolio. Interns who pass the readiness check can take real work from Training Trains, W3AppDevelopers and DomainHostly projects on the Company Work board.
Frequently asked questions
Do I need experience to join the Cloud Security internship?+
Basic cloud and Linux knowledge helps. You need a free cloud account; MFA and a billing alert are set up in the first task.
What will I do in the Cloud Security internship?+
You complete 30 graded tasks in three levels: foundations, real features, and professional work. Each task is submitted with GitHub or document proof and reviewed. The final capstone is: Capstone: secure cloud app.
Do I get a certificate for the Cloud Security internship?+
Yes. After your required tasks are approved, your attendance is above 75% and you pass the proctored final exam, you get a graded completion certificate that anyone can verify at trainingtrains.com/verify.
Can I do the Cloud Security internship online?+
Yes. You can do it fully online from home, or offline at our Erode and Perundurai branches. Tasks, quizzes and mentor reviews are the same in both modes.
Available both online (work from home) and offline at our Erode and Perundurai branches - see the full internship program details for departments, duration, and the application process.