← All articles

// cloud · guide

Cloud Misconfigurations: The Breaches Nobody Had to Cause

Cloud configuration mistakes can expose data or make another compromise more damaging. Review how identity, network access, storage policies and logging work together; an isolated setting does not establish an attack path.

Misconfiguration	Consequence
Public storage bucket	Customer data exposed to the internet
Over-broad IAM role	Potential privilege escalation, depending on the compromised identity
Exposed metadata endpoint	Potential credential exposure if metadata access and identity controls allow it
Open security group	Database reachable from anywhere
Disabled logging	Reduced visibility; other evidence sources may still exist

The usual suspects

• Public storage buckets — the classic. Customer data in object storage set to public "just to test something", never reverted.
• Over-broad IAM roles — a service given full admin because scoping permissions was fiddly. A compromise may then reach more resources than the workload needs.
• Exposed metadata endpoints — SSRF may reach metadata services when platform and workload protections allow it. Verify the request path, metadata protections and the permissions of any resulting credentials.
• Security groups open to the world — a database port on 0.0.0.0/0 because a developer needed access from home once.
• Disabled logging — missing sources or short retention can leave important gaps in an investigation.

Finding them before attackers do

A cloud security review checks identity and access policies, network exposure, storage permissions, logging coverage, and key management across your accounts — mapped to the CIS Benchmarks and provider best practice. Record the applicable platform baseline, evidence, affected resources and limitations. Remediation cost and business impact depend on the system and exposure; neither can be inferred from a generic checklist.