Common cloud misconfigurations

Why misconfigurations dominate

Cloud makes it easy to create things in seconds, often by people who are not security experts. One wrong click can make data public to the world. Attackers run automated scans of the whole internet that find open storage and open ports within hours.

The usual suspects

Public buckets in detail

Object storage (AWS S3 buckets, Azure Blob containers, Google Cloud Storage buckets) holds files. It can be made public through access settings or policies. Since April 2023, AWS turns on S3 Block Public Access and disables ACLs by default for new buckets, which helps, but older buckets and deliberate changes still cause leaks.

$ aws s3api get-public-access-block --bucket invoices-bucket
{
    "PublicAccessBlockConfiguration": {
        "BlockPublicAcls": true,
        "IgnorePublicAcls": true,
        "BlockPublicPolicy": true,
        "RestrictPublicBuckets": true
    }
}

Infrastructure as code and scanning

Many teams define cloud resources in code (Terraform, CloudFormation, Bicep). That lets security checks run before anything is created. CSPM (cloud security posture management) tools, built into providers (like AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center) or from vendors, scan live accounts and list misconfigurations against benchmarks such as the CIS Benchmarks.

buckets = [
    {"name": "invoices", "public": False, "encrypted": True},
    {"name": "test-upload", "public": True, "encrypted": False},
]
for b in buckets:
    problems = []
    if b["public"]:
        problems.append("PUBLIC")
    if not b["encrypted"]:
        problems.append("NOT ENCRYPTED")
    print(b["name"], problems or "ok")

Detection

• Alert when a bucket policy or ACL changes to public.
• Alert when a network rule opens a sensitive port to 0.0.0.0/0.
• Alert when logging is stopped or deleted.
• Watch for large downloads from storage by unusual identities or IPs.

Common mistakes

• "Temporary" public access for testing that is never removed.
• Fixing a finding by hand but not in the infrastructure code, so the next deployment brings it back.
• Scanning only the main region; attackers use the regions nobody watches.