Cloud and subscribed services on a network diagram
Things that only exist because somebody else runs the platform underneath them.
12 objects in this group, each named in plain English with the technical terms kept as searchable aliases. 12 of them carry attack notes, and every one of those ships beside the defences that reduce it. Each has an entry of its own.
Cloud platform
AWS · Azure · GCP · Google Cloud · public cloud · hyperscaler · IaaS
A supplier's computing platform, rented by the hour, where a setting made on a website creates or removes a whole system.
AI model endpoint
LLM API · inference endpoint · model service · AI service
Where an application sends a question, along with documents, images or data, to an AI model and gets an answer back.
Cloud account
subscription · project · AWS account · Azure subscription · Google Cloud project · cloud environment
One named compartment of a cloud platform, with its own bill and its own list of who may change what.
Cloud account group
management group · AWS Organizations · GCP folder · landing zone · account structure
The parent that owns all of an organisation's cloud accounts and can set rules over every one of them.
Cloud control panel
control plane · management console · cloud portal · cloud API · management plane
The website and commands used to configure the cloud itself, as opposed to the systems running inside it.
Supplier-run application
SaaS · software as a service · cloud application · business application
An application a supplier runs entirely, which the organisation subscribes to and puts its data into.
Supplier-run application: what it is and how it is attacked →
Connected app
OAuth application · app registration · enterprise application · app consent · add-in
An outside program that somebody has allowed to reach company data on their behalf.
Managed database
RDS · Azure SQL · Cloud SQL · database as a service · DBaaS
A database the cloud provider runs, where the data and the settings are yours but the machine is never touched.
On-demand function
serverless · Lambda · Azure Functions · Cloud Run · FaaS
A small piece of code that runs only when something asks for it, with no server to look after.
Container platform
Kubernetes · K8s · cluster · EKS · AKS · GKE · OpenShift
The system that decides where each packaged application runs, and starts it again when it stops.
Container image store
container registry · image registry · ECR · ACR · artefact store
The library of packaged applications that machines fetch from whenever they start something.
Infrastructure blueprint
infrastructure as code · IaC · Terraform · state file · CloudFormation · Bicep
The written description of what the cloud should contain, together with the record of what was actually built.
Infrastructure blueprint: what it is and how it is attacked →
The other groups
- Network6The paths traffic travels along.
- Wireless and radio11The parts of the network that travel through the air, and how far they reach.
- Security and edge11The things that sit in front of something else and check what is trying to reach it.
- Servers13Machines that run something for other machines.
- Storage4Where data sits still.
- Endpoints and devices8The things people and processes touch directly.
- Identity6Who something claims to be, and what proves it.
- People and organisations4The humans and the entities they belong to.
- Places3Physical locations and regions.
- Process flow7Shapes for describing a procedure rather than a network.
- Threats15The adversary and the things they bring.
Draw it rather than read it
Every object above is in the editor. Press N, type a few letters of the plain name or the acronym, and it is placed and connected to whatever was selected. Nothing is uploaded, because the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram makerThe catalogue behind this page is published as open data under CC BY 4.0, last reviewed . Every attack note describes a mechanism and contains no procedure. Corrections are welcome.