A Cloud Security Assessment Checklist for Azure, AWS and GCP

Most cloud security incidents trace back to a small, recurring set of configuration mistakes, not novel exploits. This checklist covers the areas that produce the most real-world findings across Azure, AWS and GCP.

Identity and access

• Are IAM roles and policies scoped to least privilege, or do broad "admin" roles get assigned by default for convenience?
• Are service accounts and workload identities inventoried, with credentials rotated or eliminated in favour of federated identity?
• Is MFA enforced for console/portal access, especially for privileged accounts?

Storage and data exposure

• Are storage buckets/containers (S3, Blob Storage, Cloud Storage) explicitly reviewed for public access, rather than assumed private by default?
• Is encryption at rest enabled, and is key management separated from broad administrative access?

Network configuration

• Are security groups/NSGs reviewed for overly permissive rules (0.0.0.0/0 on sensitive ports)?
• Is there network segmentation between production and non-production environments?

Logging and monitoring

• Is CloudTrail / Activity Log / Cloud Audit Logs enabled and retained, not just available?
• Is there alerting on high-risk actions: IAM policy changes, security group modifications, new root/owner-level access?

Workload and container security

• Are container images scanned for known vulnerabilities before deployment?
• Is Kubernetes RBAC configured, or does everything run with cluster-admin by default?

A note on multi-cloud

If you run more than one cloud platform, the individual checklist items matter less than the consistency of how they're applied. A strong Azure configuration and a neglected AWS account owned by a different team is a common, avoidable gap.