The vast majority of cloud incidents don't start with a sophisticated zero-day. They start with a misconfiguration: an over-permissive role, a public storage bucket, or logging that was never turned on. The good news is that the same list that attackers exploit is a list you can work through and close. Here's the one we start with.
1. Lock down IAM (least privilege)
Identity is the new perimeter. Review who — and what — can do what:
- Remove unused users, roles and access keys.
- Replace broad
*permissions with least-privilege policies scoped to real needs. - Prefer short-lived roles over long-lived access keys.
2. Enforce MFA everywhere
Require multi-factor authentication on the root account and every human user, and avoid using the root account for daily work. Stolen credentials are behind a large share of cloud intrusions; MFA blunts most of them.
3. Close public exposure (S3 and beyond)
Enable S3 Block Public Access at the account level and audit any bucket policy that overrides it. Do the same review for databases, snapshots and load balancers that may be reachable from the internet without needing to be.
4. Turn on logging and keep it
Enable CloudTrail across all regions, plus GuardDuty and Config where possible. If an incident happens, logs are the difference between "we know exactly what occurred" and "we're guessing." Store them somewhere tamper-resistant.
5. Encrypt data at rest and in transit
Use KMS-backed encryption for storage and databases, enforce TLS for data in transit, and manage keys deliberately. Encryption won't stop every attack, but it dramatically limits the blast radius of one.
6. Segment your network
Use VPCs, security groups and network ACLs to limit what can talk to what. A flat network lets one compromised instance reach everything; segmentation contains it.
7. Map it to a framework
Tie your configuration to a recognized baseline — CIS Benchmarks, NIST 800-53, and requirements from GDPR, HIPAA or PCI DSS as they apply. This turns ad-hoc hardening into evidence you can show auditors and customers.
Most cloud breaches are preventable with configuration you already have access to. The hard part is doing it consistently — and keeping it that way.
From checklist to continuous posture
Running this once is a great start; keeping it healthy as you ship is the real goal. That's where an audit-and-fix engagement plus ongoing monitoring pays off. Explore our AWS Security Consulting service, add 24/7 monitoring, or book a free consultation for a review of your account.