Cloud misconfigurations: 10 major AWS and Azure risks
Overly broad access permissions, publicly accessible storage and missing logs can leave cloud environments vulnerable. Security teams should regularly check these settings in AWS and Azure against actual requirements. The following list brings together ten common areas of risk and shows where to begin checking. Which gap takes priority depends on the data affected, its exposure and the safeguards in place.
Key takeaways
- Check identities first. Administrative accounts need strong authentication and permissions limited to their tasks.
- Limit public access where appropriate. Storage, databases and management interfaces should be accessible from the internet only when there is a justified need.
- Monitor changes continuously. Configuration checks and protected logs help identify deviations and investigate incidents.
Secure access and data
The order of the following points is not a universal ranking. It helps teams systematically review identities, data and accessible services.
- 1. Overly broad permissions. Check roles and accounts in AWS IAM and Azure against the permissions they actually need. Remove unused permissions and review privileged access regularly.
- 2. Missing multi-factor authentication. Enforce MFA for administrative and other relevant user accounts. Include root and emergency accounts in the review and monitor their use.
- 3. Public storage access. Check S3 bucket policies and Azure Storage access settings for unintended public access. In S3, Block Public Access helps limit public access. Exceptions need a documented purpose.
- 4. Publicly accessible databases. Inventory public endpoints and firewall rules. Restrict access to necessary sources and review access controls separately.
- 5. Inappropriate encryption and key management. For storage, databases and backups, check whether the encryption in use and access to keys meet protection requirements. Encryption does not replace access control.
Review networks and workloads
- 6. Overly permissive network rules. Check AWS Security Groups and Azure Network Security Groups for unnecessary inbound rules. In particular, restrict administrative access such as SSH and RDP to necessary sources.
- 7. Missing segmentation. Limit connections between applications, databases and management networks to necessary traffic. Regularly check the connections actually permitted against the architecture plan.
- 8. Vulnerable container images. Check base images and dependencies for known vulnerabilities. Deploy updated images and include the replacement of running containers in operational processes.
- 9. Credentials in code. Check repositories and build processes for keys, passwords and other secrets. Revoke or rotate any credentials found and replace them with suitable secrets management.
- 10. Incomplete logging. Record management activities and relevant data access where the respective service supports it. For CloudTrail, AWS recommends, among other things, a separate log archive and restricted access permissions. In Azure, the review should include activities, identities and relevant resource logs.
Embed checks in operations
An inventory starts with accounts, subscriptions and production resources. Teams can then assign responsibility and prioritise findings according to protection requirements, exposure and potential consequences.
CIS Benchmarks and the Microsoft Cloud Security Benchmark provide guidance for a security baseline. AWS Config and Azure Policy can automatically check selected rules. Those responsible need to assess the results, document exceptions and follow up on corrections.
Infrastructure as Code templates should be checked before deployment. The live environment also needs to be reviewed because settings can change during operation.
Frequently asked questions
Each question is closed. Tap to reveal the answer.
What is a cloud misconfiguration?
A setting that creates an unnecessary security risk for its intended use. Examples include unintended public storage access or unnecessary administrator permissions.
How can misconfigurations be found?
An inventory of cloud resources provides the foundation. Benchmarks, automated configuration checks and reviews of network rules and access permissions then help identify issues.
Are native cloud tools sufficient for the review?
They can automate part of the review. Whether they are sufficient depends on factors including the services used, the presence of multiple cloud environments and requirements for analysis and follow-up.
Editor’s Picks
Editor’s PickIdentity Security Gap: What Zero Trust Misses and How to Close ItEditor’s PickMFA-Bypass 2026: Why Your Second Factor No Longer Protects You
More from the MBF Media Network
Digital ChiefsCloud Repatriation 2026 Is a Statistical Illusion – Those Who Fall for It Miss the Real Architectural ShiftMyBusinessFutureCybersecurity Boom: NIS2 Drives Germany’s Security Growth
More from the MBF Media network
Image source: AI-generated (November 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
