Cloud security baseline: identity, logging and encryption first

Cloud providers secure the underlying infrastructure, but under the shared responsibility model you are responsible for how you configure identities, networks, data and logging. Many serious cloud incidents trace back to a small number of basics: weak identity controls, missing logs, and data left exposed. Getting those right first gives you a strong foundation for everything else.

1. Identity is the new perimeter

• Lock down the root or global administrator account: strong MFA, no access keys, and use only for break-glass tasks.
• Use single sign-on through your identity provider rather than local cloud users.
• Enforce MFA for every human user, with phishing-resistant methods for administrators where possible.
• Grant least privilege through roles and groups; avoid broad administrator policies for daily work.
• Replace long-lived access keys with short-lived credentials, such as workload identity or OIDC federation for CI/CD.
• Review privileged access regularly and remove unused accounts and roles.

2. Separate environments

Put production, staging and development in separate accounts, subscriptions or projects. This limits the blast radius of a mistake or compromise, and lets you apply stricter controls to production. Use organisation-level guardrails, such as service control policies or Azure Policy, to block risky actions everywhere.

3. Logging you can rely on

• Enable control-plane audit logging in every account and region: AWS CloudTrail, Azure Activity Log, or Google Cloud Audit Logs.
• Send logs to a central, separate logging account with restricted access and retention controls.
• Protect logs from deletion or tampering, for example with object lock or immutable storage.
• Enable your provider's threat detection service and route alerts to a monitored channel.
• Decide retention periods based on your obligations and investigation needs.

4. Encryption and data exposure

• Enable encryption at rest by default for storage, databases and backups.
• Use provider-managed keys or customer-managed keys depending on your requirements, and restrict who can administer keys.
• Enforce TLS for data in transit.
• Block public access to storage at the account or organisation level, and grant exceptions explicitly.
• Keep secrets in a managed secrets service, never in code or environment files committed to repositories.

5. Network basics

Avoid exposing management ports such as SSH and RDP to the internet; use a bastion, session manager or zero-trust access instead. Keep databases in private subnets. Review security groups and firewall rules for 0.0.0.0/0 entries.

6. Backups and recovery

Back up critical data to a separate account or vault with restricted deletion rights. Test restores regularly and record how long they take. Ransomware and malicious insiders often target backups first.

Measure against a benchmark

Once the basics are in place, compare your environment against the CIS Benchmark for your provider, or your provider's own security best-practice standard. Automate these checks so drift is caught early, and treat new findings like any other engineering work with owners and due dates.