Cloud Security Intro: Serverless Specs

Build it securely from scratch

Cloud Security Intro (Chokmah LLC) teaches engineers to generate and validate a secure serverless task management API with Claude Code and AI-assisted workflows—not only to audit someone else’s stack.

Deliverables are designed as production-oriented artifacts (target band 300–400+ lines of course code, design claim), not throwaway demos.

Illustrative spec fragment (public sample)

Non-sensitive excerpt of the control-embedding pattern used in Module 1 labs. Full workshop materials are larger and engagement-specific.

# serverless-api-spec.yaml (illustrative fragment — not a complete course deliverable)
api:
  name: task-api
  runtime: python3.12
  auth: jwt
controls:
  - id: IAM-001
    type: least-privilege
    description: Function role scoped to task table read/write only
  - id: SEC-002
    type: secrets
    description: No secrets in env; load from managed secret store
  - id: LOG-003
    type: logging
    description: Structured request logs without PII in message body
  - id: ENC-004
    type: encryption
    description: Data at rest encrypted with platform KMS key
traceability:
  - threat: overprivileged_role
    control: IAM-001
    test: test_role_policy_least_privilege

Six labs mapped to modules

The course includes six hands-on labs—two per module—so the “6 labs” figure matches the three-module structure.

• Module 1 · Labs 1–2: Generate serverless-api-spec.yaml from natural language; embed IAM, secrets, logging, and encryption controls.
• Module 2 · Labs 3–4: Decompose OWASP Cloud-style threats into preventive controls; build a requirements → services → tests traceability matrix.
• Module 3 · Labs 5–6: Produce a STRIDE model for serverless paths; implement infrastructure security tests with boto3 or the Azure SDK.

Course Modules

Module 1: AI-Powered Specifications (70 min)

Transform vague requirements into precise, testable security specs. Use Claude Code to embed IAM, secrets, and encryption controls in the design phase. Labs 1–2.

• Generate serverless-api-spec.yaml from natural language
• Embed 12+ security controls (IAM, Secrets, Logging)
• Deliverable: Validated OpenAPI Specification

Module 2: Requirements Automation (70 min)

Decompose OWASP Cloud Top 10–class threats into actionable engineering tasks and prove coverage with a traceability matrix. Labs 3–4.

• Break down vulnerabilities into preventive controls
• Create traceability matrices (Reqs → Services → Tests)
• Deliverable: cloud-security-requirements.yaml

Module 3: Threat Modeling & Infra Testing (70 min)

Apply STRIDE to serverless infrastructure and write automated tests that check the controls you specified—so “secure” is demonstrated in CI, not only described in slides. Labs 5–6.

• Identify cloud-specific attack vectors (overprivileged roles, public buckets)
• Write infrastructure-as-code security tests using boto3 or Azure SDK
• Deliverable: test_cloud_security.py (10+ test cases)

Prerequisites

This is an intermediate-level engineering course. You should be comfortable with:

• Cloud Basics: Familiarity with AWS Lambda or Azure Functions
• Python 3.9+: Basic scripting and package management
• Terminal: Comfortable navigating CLI

Frequently asked questions

How long is Cloud Security Intro?

Three modules of about 70 minutes each (~3.5 hours instructional), with six hands-on labs (two per module).

How do the six labs map to modules?

Module 1: Labs 1–2 (spec + controls). Module 2: Labs 3–4 (requirements + traceability). Module 3: Labs 5–6 (STRIDE + infrastructure tests).

What will I build?

A secure serverless task API with YAML specs (12+ controls), traceability matrix, STRIDE model (9+ vectors), and pytest infrastructure tests (10+ cases in Module 3).

Who provides the course?

Chokmah LLC. Instructor: Dr. Daniyel Yaacov Bilar.

What does “14 automated validators” mean?

It is a product design claim for the lab harness count; the public page does not publish the full validator list (request syllabus for engagement details).