Cloud Threat Model

Sun, 22 Feb 2026 00:00:00 +0000

Cloud Threat Model

I attended a cybersecurity event 👉container security village. I learn this topic Threat Modelling in Cloud so i want to apply this theory. Some memories :)

My experiment a static website in an AWS S3 bucket, served via a Content Delivery Network (CDN), with an AWS Lambda backend API. I want to apply threat modeling: shifting security left by finding flaws in the design phase rather than in production.

Diagram showing Components (Data Flows) ✴️

Where does secure private data start?

Browser / app.py
   AWS WAF 
      │
      ▼
┌─────────────────┐        ┌──────────────────┐
│  API Gateway    │──────▶ │  Lambda (Python) │
│  (HTTP API)     │        │  handler.py      │
└─────────────────┘        └────────┬─────────┘
                                    │ s3:ListBucket
                                    ▼
                           ┌──────────────────┐
                           │    S3 Bucket     │  (private)
                           │  gallery images  │
                           └──────────────────┘
                                    ▲
                           OAC (sigv4)
                                    │
Browser ──────────────────▶ CloudFront CDN
                            (image delivery)

Phase 2: Identify Threats (Using STRIDE) 🧐

Component	STRIDE Category	Threat Description
S3 Bucket	Information Disclosure	Misconfigured permissions allow unauthorized public read access.
CDN (CloudFront)	Spoofing / Tampering	Attackers bypass the CDN to target the S3 origin directly.
API Gateway / Lambda	Elevation of Privilege	Lack of authentication allows unauthorized code execution.

STRIDE methodology (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to identify threats at each component.

Mitigation Plan: Cloud configuration fixes.

S3: Block direct public access and apply CloudFront restriction.
Lambda: Use IAM roles for S3 and Cloudfront access.
API Gateway: Enable a firewall to block IPs that exceed request limits.
CloudFront: Apply Amazon CloudFront Origin Access Control (OAC).

👉My code:🔗 Results

Recommended Tools

OWASP Threat Dragon (Free, open-source tool)

Offtopic

Love your dogs by giving them a quality life. Don’t forget to neuter!

STRIDE on Break Lib Site

Cloud Threat Model

Cloud Threat Model

Diagram showing Components (Data Flows) ✴️

Phase 2: Identify Threats (Using STRIDE) 🧐

Mitigation Plan: Cloud configuration fixes.

Recommended Tools

Offtopic