Cloud Security Interview Questions

import boto3
def check_public_s3_buckets():
    s3 = boto3.client('s3')
    public_buckets = []
    
    buckets = s3.list_buckets()['Buckets']
    
    for bucket in buckets:
        bucket_name = bucket['Name']
        try:
            acl = s3.get_bucket_acl(Bucket=bucket_name)
            for grant in acl['Grants']:
                grantee = grant.get('Grantee', {})
                if grantee.get('URI') == 'http://acs.amazonaws.com/groups/global/AllUsers':
                    public_buckets.append(bucket_name)
                    break
        except Exception as e:
            print(f"Error checking {bucket_name}: {e}")
    
    return public_buckets
public_buckets = check_public_s3_buckets()
print(f"Public buckets found: {public_buckets}")

resource "aws_vpc" "secure_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "secure-vpc"
    Environment = "production"
  }
}
resource "aws_subnet" "private_subnet" {
  vpc_id            = aws_vpc.secure_vpc.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-west-2a"
  
  tags = {
    Name = "private-subnet"
    Type = "Private"
  }
}
resource "aws_security_group" "web_sg" {
  name_prefix = "web-sg"
  vpc_id      = aws_vpc.secure_vpc.id
  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["10.0.0.0/16"]
  }
}

import boto3
import json
from datetime import datetime, timedelta
def monitor_iam_activities()

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted-psp
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'downwardAPI'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  egress:
  - to: []
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53

import boto3
import json
def check_security_group_compliance():
    ec2 = boto3.client('ec2')
    violations = []
    
    security_groups = ec2.describe_security_groups()['SecurityGroups']
    
    for sg in security_groups:
        for rule in sg.get('IpPermissions', []):
            # Check for overly permissive rules
            for ip_range in rule.get('IpRanges', []):
                if ip_range.get('CidrIp') == '0.0.0.0/0':
                    if rule.get('FromPort') != 443 and rule.get('FromPort') != 80:
                        violations.append({
                            'SecurityGroupId': sg['GroupId'],
                            'Rule': rule,
                            'Issue': 'Unrestricted access on non-standard port'
                        })
    
    return violations
def remediate_violations(violations):
    ec2 = boto3.client('ec2')
    
    for violation in violations:
        sg_id = violation['SecurityGroupId']
        rule = violation['Rule']
        
        # Remove the problematic rule
        try:
            ec2.revoke_security_group_ingress(
                GroupId=sg_id,
                IpPermissions=[rule]
            )
            print(f"Removed violation from {sg_id}")
        except Exception as e:
            print(f"Failed to remediate {sg_id}: {e}")
violations = check_security_group_compliance()
if violations:
    print(f"Found {len(violations)} violations")
    # remediate_violations(violations)  # Uncomment for auto-remediation