Lesson 4 of 4 · ⭐ Gap priority

Production Security & Deployment Models

A customer requires an air-gapped install, or a security review flags a policy that's far too broad. Neither should be the first time you've thought about either.

Security domains in production

Three areas cover most of what shows up in a real review or incident.

Secrets management

API keys, DB credentials, and certs belong in a secrets manager (Vault, AWS Secrets Manager, Doppler) — never in source control or a plaintext env file.

Least-privilege IAM

A role should have exactly the permissions its job requires, no more. The most common production incident isn't a sophisticated exploit — it's an overly broad policy.

Network segmentation

Not every service needs to talk to every other service. VPCs, subnets, and security groups make "if this is compromised, what can it reach?" an answerable question.

Deployment models

The same application looks very different to operate depending on where it actually runs.

Cloud-hosted

Standard SaaS deployment — the provider's infra, your code, internet-reachable by default and gated behind auth.

On-prem

Runs inside the customer's own data center. You lose managed services (their DB, their load balancer) and gain their change-control process.

Air-gapped

No path to the public internet, ever. Every dependency — images, packages, even license checks — has to be mirrored in and updated by hand.

Exercises

Look at the sanitized IAM policy below, then work through both exercises.

// Flagged in a security review
{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

// What it should have been — this service only ever
// reads objects from one bucket
{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": "arn:aws:s3:::invoice-exports/*"
}

Concept check

Answer in your head first, then click a question to reveal the answer.

Scenario checklist

Work through the sample IAM policy and check each item off. Progress is saved in your browser.

Identify which permissions the flagged policy actually grantsIdentify what the service in question actually needs to doRewrite the policy to the minimum required action + resourceName what would have limited the blast radius if this had shippedDescribe how you would verify the scoped policy still works before rollout

Go deeper

These primers are a starting point. Read the primary sources to build real fluency.

AWS: IAM best practicesLeast privilege, straight from the source that defines the permission model HashiCorp: What is Vault?The problem a dedicated secrets manager solves, and why "just use env vars" stops scaling OWASP: Secrets Management Cheat SheetConcrete anti-patterns and what to do instead, vendor-neutral Kubernetes docs: Overview of Cloud Native SecurityHow segmentation and least privilege show up specifically in a cluster

Training Notes

What building this project taught me.

This is a flagged gap-priority module

This lesson covers two related gaps from the same job-hunting scan: security-domain production experience, and on-prem/air-gapped deployment. They're grouped here because most job descriptions raised them together, not separately.

Broad on purpose, not deep on any one model

Air-gapped installs alone could fill their own trail. The goal here is recognizing the vocabulary and trade-offs when a customer or job description raises them — not having shipped one yourself yet.