Securing Apps in the Open-By-Default Cloud
summary
Describes an automated system that enforces authentication and authorization from project creation through production, built to work across AWS and GCP and to stop App Engine services being internet-open by default. Components include a firewall manager that reverts unsafe VPC rules, a stateless OAuth proxy (Java on Kubernetes) with a jump‑point to block an OAuth replay race, and an Envoy-based Envoy sidecars service mesh + API gateway. Development spans ~3 years, firewall manager built by two engineers, introspection tooling by 3–4, and it materially reduces manual reviews and unsafe exposures across hundreds of projects.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 8:00Unmanaged Services
- 13:20Proxying
- 17:13App Engine Proxy
- 17:44Leaf Proxy
- 18:10Managed Services
- 24:40Solution
- 34:02QA
- 36:58Enumeration
related talks
49mProtecting API workloads OWASP Top 10
54mProtecting API Workloads Against OWASP and Programming Language CVE's
41mPanel: Securing Cloud Native Applications
56mThe Future of AppSec is Cloud-Native
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
24mStandard Classification: Application Gateway: What is it and how can you ...
31mEffective building blocks for securing...
01h 01mSimplifying Cloud Network and Security for Developers