Sure! How? Some considerations:
https://www.theregister.co.uk/2017/11/01/how_to_secure_a_softwaredriven_technology_stack_in_a_cloud_of_moving_parts/
Quoting:
"That makes securing the APIs important. Start by authenticating the client, and then enforce SSL encryption to ensure that the client is talking to an authenticated server.
Commercial identity and access management (IAM) tools can handle authentication, meaning that you don’t have to code it directly into the API. This has two advantages. The first is that you don’t have to maintain authentication code that has been implemented in duplicate across a range of applications and interfaces. The second is that you can fold the client/server authentication process into a broader user identification system.
Finally, on the API security side proper vulnerability management and patching of the infrastructure hosting the API is a crucial part of the security process. While APIs may be the major touchpoints for developers and operations staff in a cloud environment, it’s still important to understand and secure each of the layers on which they rely."
(...)
Hardening components at each layer of the technology stack is important. Virtual machines should be security hardened, as should containers.
Other aspects of the cloud stack that should be hardened include your servers, applications and underlying databases. Automate compliance by codifying the rules for hardening your system as configuration parameters into your software. This will be more efficient than imposing security rules as written policies that business departments can ignore.
The hardened configuration can be audited at set intervals to ensure that the system is taking the security measures it is supposed to. If there are any problems, you can use configuration management tools to correct things and ensure that your cloud-based infrastructure is compliant with the necessary rules. This automation concept underpins the DevOps discipline, and it is a crucial part of a cloud deployment.
(...)
"There are broad guidelines you can subscribe to and follow to help secure a cloud-based stack of moving parts. These include the CSA’s Security Guidance for Critical Areas of Focus in Cloud Computing v4.0 that was released in July (...) for OpenStack, Microsoft’s Azure, and Amazon’s AWS.
A mixture of general best practice and platform-specific implementation will help you avoid becoming the next headline."
