1 min lesson
Network segmentation and service-to-service auth
Walk through each part of "Network segmentation and service-to-service auth", then explain what each one does.
Step 1 of 2
Network segmentation and service-to-service authshrink what's reachable, kill the long-lived key
Two systemic moves shrink the threat surface more than any single fix. First, minimize internet exposure: private subnets by default, public ingress only through a load balancer or gateway and explicit egress controls so a compromised box can't freely phone home. Second, stop authenticating services with secrets they have to carry.
- Anti-pattern
- A static access key in an env var, shared across deploys, rotated never.
- Better
- The workload assumes a role and gets short-lived credentials from the platform - no secret to leak.
- Mechanism
- Cloud workload identity (instance/pod role, OIDCOpenID Connect. The modern single sign-on standard, built as an identity layer on top of OAuth 2.0. Where SAML is XML and enterprise-legacy, OIDC is JSON and what newer tools implement first. Press Enter for the full definition. federation, mTLS-based service identity in a mesh).
- Payoff
- Credentials expire on their own; identity is verifiable; there's no long-lived key for an attacker to find.
"Cursor's public posture is least-privilege plus MFA plus monitoring, SOC 2 certification and vetted subprocessors published in the Trust Center. I'd map an IAM review onto that: kill wildcard roles and static keys, enforce IMDSv2 so an app SSRF can't become a credential, default storage to private and move service identity to short-lived workload credentials so there's no standing key to steal."