The reality of the Cloud Shared Responsibility Model
Cloud service providers (AWS, Azure, GCP) guarantee the security of the cloud—physical data centers, hypervisors, and core networking. However, security in the cloud—identity and access management (IAM), storage bucket access policies, VPC segmentation, encryption keys, and logging—remains entirely your responsibility.
Over 80% of cloud security incidents stem from customer misconfigurations: an overly permissive IAM policy, a publicly readable S3 bucket containing customer backups, or unauthenticated database snapshots left exposed to the internet.
Six inspection pillars of our cloud review
-
Identity and Access Management (IAM)
Auditing root account usage, MFA enforcement, dormant credentials, service account privileges, and cross-account trust relationships.
-
Storage & Database Exposure
Inspecting S3 buckets, Azure Blob storage, RDS databases, and Redis caches to ensure public access blocks are enforced and encryption at rest is activated with customer-managed keys.
-
Network Security & Perimeter Defense
Evaluating VPC routing, public subnet exposure, Security Group rules (e.g. open SSH/RDP ports 22 and 3389), and WAF configurations.
-
Logging, Monitoring & Incident Readiness
Verifying multi-region CloudTrail, VPC Flow Logs, GuardDuty, and Azure Monitor enablement with multi-region log file validation and CERT-In aligned 180-day retention.