# What Is Cloud Security? Securing AWS, Azure and Google Cloud

**URL:** https://securesys.com.tr/en/learning/system-cloud-security/what-is-cloud-security-aws-azure-google-cloud

![What Is Cloud Security? Securing AWS, Azure and Google Cloud](/images/bilgi-merkezi/covers/cover-sistembulut-05.webp)

Cloud infrastructures give organisations speed, scalability and operational flexibility.

A new server can be created within minutes.

A new database can be brought into service with a few clicks.

A new application can be deployed to different regions of the world in a short time.

But this convenience also leads to a new security problem:

**Cloud environments grow very fast and can be misconfigured just as fast.**

A Security Group can be opened wrongly.

A storage bucket can be left open to the internet.

An IAM role can receive more privilege than it needs.

An API key can be forgotten inside a repository.

A test server can stay open on the internet after production work has ended.

An admin account can be given permanently high privilege.

**Cloud Security** aims at managing exactly these risks.

Cloud Security is the holistic security approach for protecting the identities, data, networks, workloads, applications and management planes on platforms such as AWS, Microsoft Azure and Google Cloud against cyber threats.

But cloud security is not merely a firewall or antivirus matter.

The modern cloud security approach handles the layers of;

**IAM + Network Security + Data Protection + Workload Protection + Logging + CSPM + Vulnerability Management + DevSecOps + Incident Response**

together.

The basic principle is this:

**The cloud provider may be secure; yet your cloud configuration can still be insecure.**

#### What Is Cloud Security?

**Cloud Security** is the whole set of technical and operational controls for protecting the confidentiality, integrity and availability of the resources and data running in cloud environments.

Within that scope, areas such as;

- AWS Security,
- Microsoft Azure Security,
- Google Cloud Security,
- Cloud IAM,
- Cloud Network Security,
- Cloud Storage Security,
- Cloud Workload Protection,
- Cloud Logging,
- Cloud Security Posture Management

are assessed.

Cloud security is not just “protecting the cloud from outside”.

It must at the same time be able to answer, within the cloud;

who can reach which resource,

which service is open to the internet,

which role was given which permission,

which data is encrypted,

which changes are being logged.

These questions must be answerable.

### What Is the Shared Responsibility Model?

One of the most fundamental concepts of cloud security is the **Shared Responsibility Model**.

This model states that security responsibility is shared between the cloud provider and the customer.

Broadly:

#### Cloud Provider

The physical data centre,

hardware,

core network,

hypervisor,

infrastructure security

can be the provider's responsibility.

#### Customer

Identity,

access,

configuration,

data,

application,

workload,

network policy

carry customer responsibility.

This boundary changes with the service model used.

Customer responsibility differs between IaaS, PaaS and SaaS.

### How Is IaaS Security Achieved?

In the **Infrastructure as a Service (IaaS)** model, basic resources such as virtual machines, network and storage are provided.

In services such as AWS EC2 or Azure Virtual Machine, for instance, the organisation is generally responsible for;

the operating system,

patching,

EDR,

the local firewall,

user accounts,

the application,

network rules.

Classic server security principles therefore continue in an IaaS environment.

Working in the cloud does not remove the need for Windows or Linux hardening.

### How Is PaaS Security Different?

In the **Platform as a Service (PaaS)** model the operating system and some infrastructure layers are managed by the provider.

But the organisation can still be responsible for;

IAM,

application security,

data access,

network exposure,

logging,

encryption.

When a managed database is used, for example, operating system patching can be done by the provider.

But that database being open to the internet can be the customer's misconfiguration.

### Is SaaS Security Part of Cloud Security?

Yes.

On SaaS platforms such as Microsoft 365 or Salesforce the user does not manage the physical infrastructure.

But matters such as;

MFA,

access control,

data sharing,

OAuth,

user lifecycle

remain the customer's responsibility.

Cloud Security therefore covers not only IaaS systems but SaaS ecosystems too.

### What Is AWS Security?

**AWS Security** is the secure management of the identity, network, compute, storage and application resources in an Amazon Web Services environment.

Critical security areas on the AWS side include services and concepts such as;

IAM,

EC2,

S3,

VPC,

Security Groups,

CloudTrail,

KMS,

GuardDuty,

AWS Config.

But secure AWS use is not merely switching those services on.

What matters is the correct architecture and a minimum privilege model.

### What Is Azure Security?

**Microsoft Azure Security** covers the protection of resources running on Azure such as;

Virtual Machines,

Storage Accounts,

VNets,

Azure SQL,

Key Vault,

Entra ID,

AKS,

Application Gateway.

In Azure security, the combination of resource privileges with Entra ID in particular makes identity security critical.

A faulty role assignment can grant broad access to many resources.

### What Is Google Cloud Security?

**Google Cloud Security (GCP Security)** covers the security of compute, storage, IAM, network and managed services on Google Cloud.

For example;

Compute Engine,

Cloud Storage,

VPC,

IAM,

Cloud Logging,

Cloud KMS,

GKE

can be included in the security assessment.

Although the service names differ from AWS and Azure, the core security principles are the same:

**Minimum privilege, minimum exposure and maximum visibility.**

### What Is Multi-Cloud Security?

An organisation can use AWS, Azure and Google Cloud at the same time.

That structure is called **multi-cloud**.

Multi-cloud provides flexibility.

But from a security perspective;

different IAM models,

different log formats,

different network rules,

different security tooling

create operational complexity.

Multi-cloud security therefore requires central visibility.

### Why Is Cloud IAM One of the Most Critical Subjects?

In cloud environments many management operations are carried out through APIs.

If an identity holds the right permission it can change hundreds of resources.

**Identity and Access Management (IAM)** therefore sits at the centre of cloud security.

A faulty IAM permission can create serious impacts such as;

data access,

resource deletion,

network change,

new credential creation.

### How Is Least Privilege Applied in the Cloud?

A user or role must be given only the permission they need.

If a developer only needs read access to a particular storage bucket, for instance, being an administrator across the whole account is unnecessary.

But the number of permissions in cloud IAM systems can be very high.

Privilege creep can therefore form over time.

Periodic access review must be carried out.

### What Is Overprivileged IAM?

**Overprivileged IAM** is a user or service identity holding far broader privileges than the business need.

For example:

*:*

and similar excessively broad permission structures can be a serious risk.

In the same way, an application service that only needs to reach a particular database can be owner across the whole subscription or project.

Privileges this broad amplify attack impact.

### What Is a Cloud Role?

Rather than giving permission to a user directly, cloud providers allow roles to be used.

A role;

provides a permission set for particular tasks.

For example;

read-only,

database operator,

network administrator

and similar.

But if role design is wrong, privilege escalation routes can still form.

### What Is Cloud Privilege Escalation?

A user may not be an admin directly.

But thanks to the permissions they hold they can;

create a new role,

grant themselves permission,

create service account credentials,

change policy.

They can thereby reach higher privilege.

A cloud security assessment must therefore look not only at existing roles but at **permission chaining** risks.

### What Is a Cloud Attack Path?

A **cloud attack path** is the attack route running from a low-privilege identity to a critical cloud resource or high privilege.

For example:

Developer User

↓

Application Owner

↓

Secret Access

↓

Service Account

↓

Subscription Admin

can form such a chain.

Attack path analysis is therefore becoming steadily more important in modern cloud security products.

### Why Does Service Account Security Matter?

In cloud environments applications generally use a service identity.

A role on the AWS side,

a managed identity on the Azure side,

a service account on the GCP side

and similar models can be found.

The credentials of these identities can be highly valuable to an attacker.

The use of long-lived static keys in particular is risky.

### Why Is a Long-Lived Access Key Risky?

If an access key is used for years without changing it can leak through;

a repository,

a developer laptop,

a log,

a config file.

Temporary credentials or workload identity must therefore be used as far as possible.

If a static key is required, rotation and monitoring must be carried out.

### What Is Cloud Secret Management?

Applications may need sensitive data such as;

a password,

an API key,

a token,

a certificate.

That information must not be kept inside the code.

The secret manager or key vault services of cloud providers can be used.

But the access given to the secret vault itself must also be kept to a minimum.

### Why Is a Public IP Critical in the Cloud?

Assigning a public IP to a cloud workload can place it directly on the internet attack surface.

For example;

SSH,

RDP,

a database,

a management interface

can become reachable through the public IP.

In a cloud environment, therefore:

**“Does this resource genuinely have to be public?”**

must always be asked.

### What Is a Security Group?

A Security Group is the control mechanism determining which network traffic can reach cloud workloads.

A faulty security group can open critical ports such as;

22,

3389,

3306,

5432,

1433

to the internet.

Security Group review is therefore one of the core parts of a cloud security assessment.

### Is 0.0.0.0/0 Always a Vulnerability?

No.

It is normal for a public web server's port 443 to be reachable from the whole internet, for instance.

But an SSH or database port being open to the whole internet can be a serious risk in most scenarios.

Broad access must therefore be assessed in the context of:

**port + resource + business purpose**

### The Difference Between a Network ACL and a Security Group

Although the details change by cloud provider, in general;

a Security Group can provide access control at workload level,

a Network ACL at subnet or network level.

The two mechanisms can be used to build layered network security.

But unnecessary complexity can also raise the risk of operational error.

### VPC and VNet Security

Structures such as the **VPC** in AWS and the **VNet** in Azure are used for cloud network isolation.

A secure cloud architecture can use separations such as;

a public subnet,

a private subnet,

a management subnet,

a database subnet.

But creating a subnet is not segmentation on its own.

Network rules must also be limited correctly.

### What Is a Private Endpoint?

It is one of the mechanisms making it possible to reach managed cloud services over a private network connection rather than the public internet.

A database or storage service can be reachable through a private endpoint, for instance.

Public exposure can thereby be reduced.

But DNS and routing must be configured correctly.

### Why Is a Cloud Firewall Used?

A Security Group provides basic access control in most cases.

But when central policy, advanced inspection or outbound filtering is needed, a cloud firewall can be used.

A cloud firewall can provide features such as;

L3/L4 filtering,

application control,

threat prevention.

### Why Does Egress Filtering Matter in the Cloud?

In cloud network security, outbound traffic matters as much as inbound.

A compromised workload can use the internet egress for;

a C2 connection,

malware download,

data exfiltration.

Allowing every workload to connect anywhere on the internet can therefore create unnecessary risk.

### Is a NAT Gateway a Security Control?

While a NAT Gateway lets resources in a private subnet reach the internet, it can reduce direct inbound access.

But it is not a security product on its own.

Outbound traffic must still be controlled.

NAT must also be monitored for cost and capacity.

### What Is Public Storage?

Cloud storage resources becoming reachable from the internet because of faulty permissions is assessed as **public storage exposure**.

For example;

backups,

customer data,

reports,

source code,

logs

can be public.

This is one of the most commonly known misconfiguration examples in cloud security.

### How Is AWS S3 Bucket Security Achieved?

On S3 buckets;

public access,

bucket policy,

IAM permission,

encryption,

logging,

versioning

can be assessed.

A bucket being public is not always wrong.

It can be legitimate for a bucket publishing public web assets.

But it creates serious risk for sensitive data.

### How Is Azure Storage Security Achieved?

On Azure Storage accounts;

public access,

SAS tokens,

network restriction,

private endpoint,

encryption,

access keys

can be assessed.

Long-lived SAS tokens in particular can create risk for sensitive data access.

### Google Cloud Storage Security

On GCP Cloud Storage, areas such as;

IAM,

public access,

service accounts,

signed URLs,

encryption

must be checked.

The basic principle is the same again:

**Only the identity that needs the data must reach it.**

### How Is Encryption at Rest Achieved in the Cloud?

Cloud providers can supply default encryption on many services.

But the organisation can decide between options such as;

a provider-managed key,

a customer-managed key,

an HSM-backed key.

What matters here is not merely that encryption exists but the key management process.

### What Is a Customer-Managed Key?

A **customer-managed key (CMK)** is the model in which the lifecycle of the encryption key sits more under customer control.

The organisation can manage;

key rotation,

access,

disabling,

audit

operations.

This can matter particularly in regulated and highly sensitive systems.

### What Is KMS?

**Key Management Service (KMS)** is the cloud service category providing central management of encryption keys.

In KMS security;

key permission,

rotation,

logging,

separation of duties

matter.

IAM permissions granting access to an encryption key must also be regarded as critical.

### Why Is Cloud Logging Critical?

Many management operations in cloud environments take the form of API calls.

Logs are therefore extremely valuable for attack analysis.

Operations such as;

a new user,

a new key,

a security group change,

a storage policy change,

a role assignment,

resource deletion

can be seen in audit logs.

### What Is AWS CloudTrail?

**AWS CloudTrail** provides a record of many API activities within an AWS account.

Who carried out which operation?

From which IP?

On which resource?

Information of this kind is valuable for incident response.

Configuring CloudTrail with the correct scope and retention matters.

### What Is the Azure Activity Log?

The Azure Activity Log helps monitor many management operations carried out at subscription level.

Operations such as;

resource creation,

role change,

network change

can be seen.

Transferring these records to a SIEM increases SOC visibility.

### What Are Google Cloud Audit Logs?

GCP Audit Logs help monitor management and access activity on cloud resources.

Privileged and administrative activity in particular is valuable for incident response.

### Can Cloud Logs Be Altered?

If an attacker obtains high privilege they can try to switch logging settings off or delete logs.

Protecting logs through architectures such as;

a separate security account,

a central logging project,

immutable storage

can therefore be assessed.

### What Is Centralized Cloud Logging?

It is the transfer of logs from different cloud accounts and subscriptions to a central security account or SIEM.

This structure can help preserve past telemetry should an attacker manipulate local log sources.

### What Is CSPM?

**Cloud Security Posture Management (CSPM)** is the technology and process category continuously analysing security configurations in cloud environments.

CSPM can detect risks such as;

public storage,

an open network port,

missing MFA,

logging being switched off,

missing encryption,

an overprivileged identity.

The constant change of cloud environments makes CSPM particularly valuable.

### Why Is CSPM More Effective Than Manual Checking?

A cloud environment can hold hundreds or thousands of resources.

New resources can be created every day.

A manual security review loses currency in a short time.

CSPM, by scanning continuously, can detect configuration drift.

But findings must always be prioritised on a risk basis.

### What Is Cloud Misconfiguration?

**Cloud misconfiguration** is a cloud resource being configured insecurely.

For example;

a public database,

open SSH,

public storage,

an admin IAM role,

audit logging disabled,

encryption disabled

and similar.

A significant proportion of cloud security incidents relates to configuration errors.

### How Does Configuration Drift Form in the Cloud?

A resource may have been created securely with Terraform.

But an administrator opens a temporary rule through the portal.

That change does not appear in the Infrastructure as Code.

Months later it is forgotten.

This is an example of **cloud configuration drift**.

Continuous comparison must therefore be made between IaC and runtime configuration.

### What Is Infrastructure as Code Security?

Cloud resources can be created through code with tools such as Terraform, CloudFormation or Bicep.

This model provides a great advantage for security.

Because the configuration can be analysed before production.

A CI/CD pipeline can warn, for instance:

“This Security Group opens SSH to the internet.”

This approach is called **IaC security scanning**.

### What Is Policy as Code?

**Policy as Code** is the definition of security and compliance rules as code.

For example:

Public databases forbidden.

Encryption mandatory.

Admin ports cannot be opened to the internet.

These rules can be checked automatically during the deployment process.

Security is thereby not left dependent on human checking alone.

### What Is Shift Left Cloud Security?

It is moving the security check from after production to before development and deployment.

For example;

a Terraform scan,

a container image scan,

a secret scan,

a dependency scan

can be run within the CI/CD pipeline.

This approach aims to fix the error before it reaches production.

### What Is Cloud Workload Protection?

A cloud workload can be;

a virtual machine,

a container,

a Kubernetes node,

serverless.

The runtime security of those workloads is assessed within **Cloud Workload Protection (CWP/CWPP)**.

The aim is to monitor behaviour such as;

malware,

vulnerabilities,

runtime attacks,

unexpected processes.

### What Is CWPP?

A **Cloud Workload Protection Platform (CWPP)** is the platform category focusing on the runtime security of cloud workloads.

VMs,

containers,

Kubernetes,

serverless

and other workload types can be covered.

While CSPM looks at configuration, CWPP focuses more on runtime behaviour.

### What Is CNAPP?

A **Cloud-Native Application Protection Platform (CNAPP)** aims to unite the different areas of cloud security under a single platform.

For example, features such as;

CSPM,

CWPP,

CIEM,

container security,

IaC security,

vulnerability management

can be offered together.

But buying a CNAPP does not create a secure cloud architecture on its own.

Process and responsibilities are still required.

### What Is CIEM?

**Cloud Infrastructure Entitlement Management (CIEM)** focuses on analysing cloud IAM permissions and excessive privilege.

A user may hold 500 permissions, for instance, yet have used only 10 of them in the last 90 days.

That analysis can be valuable for privilege reduction.

### How Is Cloud Vulnerability Management Carried Out?

Cloud workloads carry CVE and patch risks too.

VMs,

container images,

Kubernetes nodes

can be scanned.

But cloud vulnerability management must not look at the CVSS score alone.

For example:

Critical CVE

Publicly exposed VM

Known exploit

can be very high priority.

That approach is **risk-based vulnerability management**.

### Why Does Exposure Context Matter?

The same vulnerability can exist on two different servers.

The first server is in a private subnet.

The second server is open to the internet.

The risk is not the same.

In cloud security, therefore, vulnerability + exposure + privilege must be assessed together.

### What Is a Toxic Combination?

Cloud findings that look low or medium risk individually can together create serious risk.

For example:

A public VM

A critical vulnerability

A high-privilege service account

Sensitive storage access

can together form a critical attack path.

Combinations of this kind can be assessed as a **toxic combination** in modern CNAPP platforms.

### How Is Attack Path Analysis Changing Cloud Security?

Cloud security reports used to show thousands of separate findings.

The modern approach asks instead:

**“Which of them together genuinely allow a critical asset to be reached?”**

The security team can thereby close the most critical attack paths first.

That is a more meaningful security approach than an alert count.

### Why Is Cloud Asset Inventory Difficult?

Cloud resources can be created and deleted very fast.

A developer can create a VM today and delete it tomorrow.

A serverless function or container can appear within minutes.

A traditional CMDB may therefore not be enough on its own.

Cloud API-based asset discovery is required.

### What Is Shadow Cloud?

Teams can use a separate cloud account, project or subscription without central IT's knowledge.

This is **shadow cloud** risk.

If the security team does not know about that account;

logging,

MFA,

CSPM,

budget,

security policy

may not be applied.

The cloud organisation structure must therefore be managed centrally.

### Why Do AWS Organizations Matter?

In AWS, multiple accounts can be managed under a central organisation.

Thereby;

policy,

billing,

security,

logging

can be made more central.

In the same way, Azure management group/subscription and GCP organization/project structures matter for governance.

### What Is a Landing Zone?

A **cloud landing zone** is the starting architecture ensuring new cloud accounts or subscriptions are created with standard security and network rules.

When a new account is opened, for instance;

central logging,

security monitoring,

a network baseline,

IAM policy

can be applied automatically.

This approach is the foundation of cloud governance.

### What Is Cloud Governance?

Cloud governance defines;

who can create resources,

which regions can be used,

which security baseline will be applied,

which tags are mandatory,

how costs will be managed.

These must be set out.

Cloud Security is not only technical protection but a governance matter.

### Why Does Tagging Matter for Security?

Cloud resources can be marked with tags such as;

owner,

environment,

criticality,

data classification.

When a public IP is found, for instance, it becomes possible to understand whether it belongs to the production payment system or a test server.

That makes risk prioritisation easier.

### Why Must the Cloud Asset Owner Be Known?

When a security finding is detected:

**“Whose resource is this?”**

If the answer to that question is unknown, remediation is delayed.

An owner must therefore be defined for every resource or application.

Cloud security is an organisational responsibility problem as much as a technical one.

### Is Kubernetes Part of Cloud Security?

Yes.

Managed Kubernetes services such as;

AWS EKS,

Azure AKS,

Google GKE

are used widely.

The cloud provider can manage some components of the control plane.

But the organisation's responsibility continues in areas such as;

RBAC,

workloads,

secrets,

container images,

network policy.

### Container Registry Security

Container images are stored in a registry.

In the registry, controls such as;

vulnerability scanning,

image signing,

access control,

immutable tags

can be applied.

If a vulnerable or altered image reaches production, the cloud workload can be at risk.

### What Is Serverless Security?

In serverless services, operating system management shifts to the provider.

But;

the function code,

IAM permission,

secrets,

event triggers,

dependencies

can be the customer's responsibility.

In serverless security an overprivileged function role in particular can create critical risk.

### How Is Cloud Database Security Achieved?

On managed databases;

public exposure,

authentication,

IAM integration,

encryption,

backup,

audit logging,

network access

must be assessed.

A database being managed does not automatically make the data inside it secure.

### Why Is a Public Database Critical?

A database port being reachable directly from the internet can raise the risk of;

brute force,

credential attacks,

vulnerability exploitation.

Access through the application subnet or a private endpoint must be preferred as far as possible.

### Cloud Backup Security

Cloud backups and snapshots also contain sensitive data.

With faulty IAM permissions an attacker can;

read,

delete,

copy

the backups.

Backup resources must therefore be protected as tightly as production.

### What Is a Snapshot Leak?

A VM or database snapshot can be shared with another account by mistake or made public.

A snapshot can contain;

a database,

credentials,

configuration,

sensitive data.

Snapshot sharing must therefore also be included in CSPM controls.

### What Is Immutable Cloud Backup?

Some cloud services can provide immutability features making it hard for a backup to be deleted or altered for a defined period.

This matters against ransomware and account compromise risks.

But protecting backup admin identities remains necessary.

### How Is Cloud Security Monitoring Carried Out?

Cloud monitoring must include different layers:

#### IAM Events

Role and permission changes.

#### Network Events

Security Group and firewall changes.

#### Storage Events

Public access changes.

#### Compute Events

New VM and workload creation.

#### Audit Logs

Administrative operations.

#### Threat Detection

Suspicious behaviour.

This telemetry must be transferred to the central SOC.

### Why Is a SIEM Necessary in Cloud Security?

AWS, Azure and GCP each have different log systems.

A SIEM can correlate those records in one place.

For example:

Git repository → secret leak

Cloud → new API login

IAM → role escalation

Storage → a large volume of downloads

can be parts of the same attack.

Cloud telemetry must therefore be analysed together with other security data.

### What Is Cloud-Native Threat Detection?

Cloud providers can offer native services detecting suspicious cloud behaviour.

These systems can detect behaviour such as;

unusual API activity,

a malicious IP,

crypto mining,

credential abuse.

But native detections must be integrated into SOC processes.

An alert sitting in the portal is not enough on its own.

### Why Is Crypto Mining Seen in Cloud Environments?

When an attacker obtains cloud credentials they can use the compute resources within the account for cryptocurrency mining.

This is both a security and a cost problem.

Sudden anomalies in;

GPU instances,

compute usage,

cost

must therefore also be followed from a security perspective.

### Can a Cloud Cost Anomaly Be a Security Signal?

Yes.

If an account normally spending 500 USD a day suddenly spends 8,000 USD it can be;

crypto mining,

abuse,

DDoS/EDoS,

a faulty deployment.

FinOps data can therefore add value to cloud security monitoring.

### Why Is Cloud Incident Response Different?

In a cloud environment the attacker does not have to reach a physical server.

With one API credential they can make hundreds of changes.

Incident response can therefore be carried out through;

audit logs,

IAM,

snapshots,

API activity,

resource history.

A forensic snapshot may also need taking before a compromised resource is deleted.

### What Is Cloud Forensics?

**Cloud forensics** is the forensic examination of security incidents in a cloud environment.

For example;

disk snapshots,

cloud audit logs,

network flow logs,

IAM activities,

object access logs

can be used.

Because data volatility can be high in a cloud environment, log retention must be planned in advance.

### How Is Cloud Isolation Carried Out?

When a compromised VM is detected, shutting the system down completely may not always be the first step.

Actions such as;

network isolation,

a security group change,

a snapshot,

credential revocation

can be assessed.

But the incident response procedure must be prepared in advance.

### Why Does Credential Rotation Matter in a Cloud Incident?

The attacker may have obtained an access key or secret.

Fixing the resource is not enough.

Compromised credentials must be rotated or revoked.

Whether the same secret is used elsewhere must also be investigated.

### How Must Root Account or Tenant Owner Accounts Be Protected?

The highest-privilege cloud accounts must not be used for daily operations.

Strong MFA,

minimum use,

alerting,

a break-glass procedure

must be applied.

The activity of these accounts must be extremely rare and visible.

### What Is a Cloud Security Assessment?

A **cloud security assessment** is the systematic evaluation of;

IAM,

network,

storage,

compute,

logging,

encryption,

backup,

workload,

governance

risks in a cloud environment.

This work is not merely a vulnerability scan.

The greatest risks in cloud security are generally configuration and identity based.

### How Is an AWS Security Assessment Carried Out?

In an AWS assessment, controls such as;

organization/account structure,

IAM,

CloudTrail,

S3,

EC2,

VPC,

Security Groups,

KMS,

GuardDuty,

backup

can be examined.

Attack path and privilege escalation risks must also be analysed.

### How Is an Azure Security Assessment Carried Out?

On the Azure side;

tenant/subscription structure,

Entra ID,

RBAC,

Storage,

VMs,

VNets,

NSGs,

Key Vault,

AKS,

logging

can be assessed.

Azure cloud security and Entra identity security must be handled together in particular.

### How Is a Google Cloud Security Assessment Carried Out?

On the GCP side;

organization/project,

IAM,

service accounts,

VPC,

Cloud Storage,

Compute Engine,

GKE,

KMS,

Audit Logs

can be analysed.

Here too the basic goal is not compliance alone but understanding the genuine attack paths.

### What Is a CIS Cloud Benchmark?

CIS publishes secure configuration recommendations for AWS, Azure and Google Cloud.

They can include controls such as;

MFA,

logging,

network,

IAM,

storage.

These benchmarks are valuable for a cloud security baseline.

But they must be tailored to each organisation's architecture.

### What Is a Cloud Security Baseline?

It is the set of security controls that must exist as a minimum across all of the organisation's cloud accounts.

For example:

Root/admin MFA mandatory.

Central logging active.

Public storage forbidden.

Security Group admin ports closed to the internet.

Encryption mandatory.

Cloud threat detection active.

This baseline can be enforced through automatic policy.

### Are Cloud Security Compliance and Cloud Security the Same Thing?

No.

A cloud environment can score highly on a compliance checklist.

But it can hold a genuine attack path.

All resources can be encrypted, for instance.

But the developer account can hold high privilege.

Compliance is therefore a part of security; not the whole of it.

### The Difference Between a Cloud Penetration Test and a Cloud Security Assessment

#### Cloud Security Assessment

Examines configuration, IAM, architecture and governance risks.

#### Cloud Penetration Test

Tests how exploitable those risks are through authorised attack techniques.

The two together provide a stronger cloud security picture.

### How Is Cloud Security Posture Measured?

Example KPIs;

#### Public Asset Count

#### Critical Misconfiguration Count

#### Overprivileged Identity Count

#### MFA Coverage

#### Logging Coverage

#### Encryption Coverage

#### Critical Vulnerability Exposure

#### Attack Path Count

#### Mean Time to Remediate

can be used.

But KPIs must not merely produce numbers; they must show genuine risk reduction.

### Why Does Mean Time to Remediate (MTTR) Matter?

Because a cloud environment changes very fast, the speed of fixing a finding matters as much as detecting it.

Public storage was detected, for instance.

But it stayed open for 45 days.

That period is the exposure window.

The remediation time of critical cloud misconfigurations must therefore be measured.

### Why Is Continuous Monitoring Essential in Cloud Security?

An environment that is secure today can change tomorrow.

A new developer arrives.

A new Security Group is opened.

New storage is created.

A new role is assigned.

An annual cloud security assessment is therefore not enough on its own.

Continuous posture monitoring is required.

### What Is Continuous Cloud Security Validation?

It is not merely monitoring cloud security controls but testing them regularly.

For example;

Does CSPM detect public exposure?

Does the SIEM produce a role escalation alert?

Does EDR see the workload attack?

Does backup restore work?

These controls must be verified periodically.

### What Should the Cloud Security Operating Model Be?

Cloud security is not the security team's job alone.

For example;

#### Platform Team

Manages the landing zone and cloud infrastructure.

#### DevOps

Manages deployment processes.

#### Security

Provides policy and monitoring.

#### SOC

Carries out threat detection.

#### Application Teams

Are responsible for their own workload security.

This division of duties must be clear.

### The Cloud Security Champion Model

In large development teams there can be a person competent in security within each team.

That person becomes the bridge between the central security team and development.

This approach can help security controls be applied earlier.

But ultimate risk ownership must be defined across the organisation.

### What Are the Biggest Mistakes in Cloud Security?

The most common examples include;

excessive IAM privilege,

public storage,

public management ports,

static credentials,

missing logging,

daily use of the root/admin account,

shadow cloud,

exposed secrets,

weak backup policies,

manual configuration drift.

Most of these errors arise not from a lack of high technology but from a governance and configuration problem.

### Core Controls for Corporate Cloud Security

A strong cloud security programme must generally contain these layers:

#### Cloud Governance

Account and subscription structure.

#### IAM Security

Least privilege and MFA.

#### Network Security

Segmentation and private access.

#### Data Security

Encryption and access control.

#### Workload Protection

VM, container and serverless security.

#### CSPM / CNAPP

Continuous posture visibility.

#### DevSecOps

IaC and pipeline security.

#### Logging & SOC

Central threat detection.

#### Backup & Recovery

Cyber resilience.

#### Security Validation

Periodic assessment and testing.

These layers must not be thought of independently of one another.

### What Should a Cloud Security Report Contain?

A professional report can include these areas:

#### Executive Cloud Risk Summary

The management summary.

#### Cloud Architecture

Account, subscription and project structure.

#### IAM Findings

Privilege risks.

#### Network Exposure

Public services and Security Groups.

#### Storage & Data Exposure

Sensitive data risks.

#### Logging & Detection

SOC visibility.

#### Workload Security

VM, container and serverless risks.

#### Attack Path Analysis

How the findings connect to one another.

#### Compliance Posture

CIS and the corporate baseline.

#### Remediation Roadmap

Prioritised actions.

The report thereby consists of more than hundreds of misconfiguration entries.

The genuine business and attack risk becomes visible.

### Conclusion: Cloud Security Is Not Something That Can Be Left to the Provider

AWS, Azure and Google Cloud offer some of the world's most advanced technology infrastructures.

But the provider being secure does not mean the customer's configuration is secure too.

An administrator can open a database to the internet by mistake.

A developer can put an API key into a repository.

An IAM role can receive more permission than it needs.

Storage can be public.

Audit logging can be switched off.

A backup can be deleted by the wrong account.

The basic question of cloud security is therefore not:

**“Is our cloud platform secure?”**

The better question must be:

**“Are we using the cloud platform securely?”**

Genuine cloud security is formed by applying the layers of;

**Shared Responsibility + IAM + Least Privilege + Network Segmentation + Data Protection + CSPM + Workload Protection + Logging + DevSecOps + Incident Response**

together.

And in modern cloud attacks one of the most critical components is often not the server itself.

**It is identity.**

Because when an attacker obtains a valid cloud identity they can create resources, read data or change security policies through the API without using any exploit.

We therefore move to the next critical question:

**Do the users, roles, service accounts and workload identities in your cloud environment genuinely hold minimum privilege?**