How Do You Secure Your AWS, Azure or GCP Cloud Account?
Key takeaways
- Cloud shared responsibility means the provider secures the infrastructure while you secure everything you deploy on it, and the configuration errors in that second half cause most cloud breaches.
- Enforce MFA on every human identity and delete unused access keys, because a single leaked key is a faster route in than any exploit.
- Replace long-lived access keys with short-lived roles or instance profiles, so a stolen credential expires within an hour instead of staying valid.
- Keep storage buckets, blob containers and databases private by default, and audit that no object is publicly readable without a deliberate, logged exception.
- Enable audit logging and log export to a separate account, because an attacker who compromises the main account will otherwise delete their own trail.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Which identity controls matter most on AWS, Azure and GCP?
Identity and access management decides how much damage any single mistake causes. Start with MFA for every human identity, then remove the standing access keys for the root, owner and subscription administrator accounts, because those credentials are permanent by design and are often left in a shared password manager or a CI config. Give every engineer a named identity with just-in-time or group-based roles, and every workload its own service identity rather than a borrowed person's. Review role assignments quarterly and delete anything unused for 60 days. On Azure, check the role assignments in Entra ID; on GCP, check the service account key list, because old keys stay valid until deleted.
How do I check my cloud setup against a known baseline?
Use the CIS benchmark for your provider, because it gives a concrete, versioned checklist rather than general advice. For AWS that is the CIS AWS Foundations Benchmark, for Azure the CIS Microsoft Azure Foundations Benchmark, and for GCP the CIS Google Cloud Platform Foundation Benchmark. A cloud security assessment of a small or mid-sized Indian deployment typically runs in the low hundreds of thousands of rupees and produces a prioritised list of deviations, each with the exact control reference and the console or API call that fixes it. Score the deviations rather than counting them: a public bucket holding customer data outranks fifty untagged resources.
What should be logged, and where should the logs go?
Log the control-plane events an attacker would need: changes to identity and access policy, creation of new credentials, changes to network rules, changes to storage permissions, and the enabling or disabling of logging itself. Keep those logs in a separate account or a dedicated log-analytics workspace that the workload administrators cannot delete, and set an organisation-level retention policy so the 180-day log retention requirement under the CERT-In directions is met without relying on anyone remembering. Enable the provider's own data access audit logs, because they capture reads of sensitive objects that control-plane logs never show.
| Control | What it stops | How to verify it |
|---|---|---|
| MFA on every human identity | Credential theft and account takeover | Export the identity list and check the MFA column |
| No standing root or owner keys | Long-lived credential abuse | List the access keys and delete unused ones |
| Per-workload roles, no shared logins | Privilege escalation through a shared account | Map each role to a named service or person |
| Private storage by default | Public exposure of buckets and blobs | Run an open-permission scan across all regions |
| Private subnets and restricted ingress | Direct internet exposure of workloads | Review the firewall and security group rules |
| Audit logging in a separate account | Anti-forensic deletion of the trail | Try deleting a log group from the admin account |
| Log export and 180-day retention | Missing incident evidence | Check the retention setting, not just the default |
What are the frequently asked questions?
Get a straight answer on this
Send us your provider list and a redacted IAM export, and we will return a prioritised CIS-gap list with fixed-price remediation steps.
Send us the details See pricing