Cloud Security
In-depth guides and analysis on cloud security from the Safeguard engineering team.
239 articles
Azure DevOps Pipeline Security Hardening: A Practical Guide
How to lock down your Azure DevOps pipelines against supply chain attacks, credential leaks, and unauthorized deployments.
Using Azure AD Workload Identity Federation to remove sec...
How Azure Workload Identity Federation lets AKS and CI workloads swap Azure AD access tokens without ever storing a client secret—and how to migrate safely.
Designing least-privilege custom roles with Azure RBAC
A practical guide to designing least-privilege custom roles in Azure RBAC, covering over-permissioning pitfalls, scoping, and audit strategies.
GCP Artifact Registry Vulnerability Scanning: Integrating the Findings
Artifact Analysis on Artifact Registry produces a steady stream of findings. The discipline is in what you do with them. We map the workflows that actually reduce risk.
Choosing between Key Vault access policies and RBAC permi...
Access policies or RBAC? A concrete breakdown of Azure Key Vault's two permission models, when each still makes sense, and how to migrate safely.
Best practices for using Azure Managed Identity instead o...
A step-by-step guide to Azure Managed Identity best practices: system vs user assigned identities, least-privilege roles, and secretless authentication.
Configuring soft delete and purge protection for Azure Ke...
A step-by-step guide to enabling Key Vault soft delete and purge protection, recovering deleted secrets, and applying backup practices to prevent permanent data loss.
SSRF Exploitation in Cloud Environments
Server-Side Request Forgery is especially dangerous in cloud environments where metadata services expose credentials and configuration. This guide covers SSRF exploitation techniques and defenses specific to AWS, GCP, and Azure.
Using Privileged Identity Management for just-in-time Azu...
A practical guide to using Azure conditional access PIM for just-in-time role activation, reducing standing privileges and strengthening least-privilege access.
Preventing and detecting Azure service principal credenti...
How Azure service principal secrets leak through repos, pipelines, and IaC state files — and the detection, scoping, and rotation practices that stop a leak from becoming a breach.
Infrastructure as Code Security: Scanning Terraform, CloudFormation, and Kubernetes Manifests
IaC scanning catches misconfigurations before they reach production. This guide covers tools, techniques, and integration patterns for Terraform, CloudFormation, and Kubernetes.
AWS Inspector V2 Container Scanning: What Changed and Why It Matters
A deep look at Amazon Inspector v2 for container scanning, its improvements over v1, and how to get the most out of it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.