VECTOR 02 // INFRASTRUCTURE & NETWORKING

Cloud Architecture & Zero Trust Hardening

Multi-cloud architecture reviews and runtime isolation across AWS, GCP, and Azure. We eliminate public internet ingress, enforce IMDSv2, and deploy turnkey Terraform runbooks.

EXECUTION FRAMEWORK

4-Phase Cloud Hardening Process

PHASE 01

Topology Audit

Mapping VPC peering, transit gateways, route tables, IAM role trust policies, and ingress exposure.

PHASE 02

Privilege Pruning

Auditing wildcard IAM policies (*:*), enforcing least-privilege scoping, and deploying ephemeral session tokens.

PHASE 03

Dark-Routing Setup

Eliminating public NAT/IGW paths by transitioning services to VPC PrivateLink and private service connects.

PHASE 04

IaC Verification

Delivering verified Terraform / OpenTofu configurations and validating runtime enforcement via CI/CD gates.

Covered Cloud Subsystems

AWS: Control Tower, IAM Identity Center, VPC PrivateLink, KMS Key Policies, EKS IRSA.
Google Cloud: Organization Policies, Workload Identity Federation, VPC Service Controls.
Microsoft Azure: Entra ID Conditional Access, Private Endpoints, Azure Key Vault RBAC.
Kubernetes: Cilium eBPF network policies, pod security standards, and secret management.

Delivered Blueprints

Turnkey Terraform Runbooks: Production-tested modules ready for git push.
Zero Ingress Verification: Cryptographic proof of no public attack surface.
IMDSv2 Enforcement Matrix: Complete elimination of cloud SSRF token theft.
Executive Cloud Risk Scorecard: CISO-level architectural maturity rating.

TECHNICAL ARTIFACT SPECIFICATION

Terraform Hardening Blueprint (AWS IMDSv2 & PrivateLink)

CONFIG: ENFORCE IMDSV2 & DISABLE PUBLIC INGRESS TERRAFORM READY

- public_network_access_enabled = true - http_tokens = "optional" # Vulnerable to SSRF token exfiltration

# BhishmaSec Hardened Fix: Mandatory IMDSv2 Hop-Limit & PrivateLink Enclave

+ public_network_access_enabled = false + http_tokens = "required" # IMDSv2 Session Token Enforced + http_put_response_hop_limit = 1