Cloud console

Works like the AWS, Azure or Google Cloud consoles. Close a security audit's findings in a cloud account: a public bucket, SSH open to the internet, a departed engineer's key and an intern with too much access, without breaking the app.

The lakeshore-prod account at Lakeshore Family Health. Last week's security audit left four findings open against it. (A made-up company and account. Start with the brief.)

QuickCruit Cloud Console

Global

Storage buckets

4 buckets in lakeshore-prod. Files live in buckets; each bucket sets who can read them.

Access	What it holds	Created
Private	Files people upload in the app	2024-03-11
Public	Images and styles for the public website	2023-11-02
Public	Monthly patient exports for the finance team	2025-06-19
Private	Weekly operations reports	2024-08-30

Practice account. Nothing here is real.

lakeshore-prod

Audit findings: lakeshore-prodRina Ferraro, Platform lead

Last week's audit closed with four findings on this account. All four are assigned to you; close each one in the console.

The exports bucket. A bucket of patient exports can be read by anyone on the internet. Make it private, and keep the files: compliance needs the export for the audit.
SSH from the internet. SSH on port 22 is open to the whole internet on one security group. Limit it to the office network, 192.0.2.128/25.
The departed engineer's access. Someone who left is still using an access key. Turn the key off and take them out of admins. Left recently: Caleb Nakamura (2026-08-21), Leila Mercer (2026-10-05).
The intern role's policy. Ticket IT-2490: intern-analytics can do anything in the account. The intern only needs to list the files in lakeshore-reports and download them. Narrow its policy to those two actions, only from the office network.

The app, the website and deploys keep running while you work. If something already works, leave it be.

Lakeshore Family Health and everyone here are made up, and so is the account. A practice case, built for you.

Your list

The exports bucketTo do
SSH from the internetTo do
The departed engineer's accessTo do
The intern role's policyTo do
Nothing else brokeTo do

Fix what you can, then check. I read the account as it stands, not what you meant to do.