Designing Secure APIs in the Cloud
summary
Cloud APIs use three concrete patterns: gatekeeper validates and sanitizes requests so only vetted traffic reaches internal services; valet key issues a SAS token that expires after 10 minutes for Azure Storage uploads; and federated identity delegates auth to an IdP/STS with claims-based access. The checklist includes MFA, JIT elevation for production, secrets in a manager not in code, encrypt-in-transit and at-rest, removing unused VMs to shrink attack surface, and threat modeling to map authentication, integrity, confidentiality, availability, and authorization risks.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:21Story Time
- 2:28Human Errors
- 4:34About Adora
- 5:33Security Checklist
- 7:47Gatekeeper
- 10:01Valet Key
- 12:30Federated Identity
- 14:10Enforce Security
- 16:35Reduce Attack Surface
- 18:21Consider Threat Modeling
related talks
27mDesigning Secure Applications in the Cloud
34mDesigning Secure Applications in the Cloud
18mAPI Security Simplified: A 5-Pillar Approach
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
24mAPI Security in DevSecOps: Built-In, Not Bolted On
17mAPI Security Simplified: Practical Tips & Tools
50mSecuring .NET Apps and Microservices in Azure
29mDefence in depth