The shared responsibility reality

Cloud providers secure the underlying infrastructure. Everything you configure — identities, storage, networks, encryption and logging — remains your responsibility. That is where most incidents begin.

The usual suspects

1. Publicly accessible storage

Buckets, blobs and containers opened for a quick test and never closed.

Fix: enforce account- or organisation-level blocks on public access and alert on any policy that grants anonymous read.

2. Over-privileged identities

Wildcard permissions and long-lived access keys attached to users and workloads.

Fix: use roles and workload identities instead of static keys, apply least privilege, and review unused permissions regularly.

3. Management ports open to the internet

SSH, RDP and database ports reachable from anywhere.

Fix: remove direct exposure, use bastion or just-in-time access, and restrict security groups to known sources.

4. Logging switched off or incomplete

Without control-plane logs you cannot investigate.

Fix: enable audit logs organisation-wide, send them to a separate, locked-down account and retain them per policy — for India-regulated entities, align with the CERT-In 180-day requirement.

5. Unencrypted data and unmanaged keys

Fix: enforce encryption by default and manage keys centrally with rotation and access monitoring.

6. Drift from approved baselines

Resources created manually outside infrastructure-as-code.

Fix: define guardrails as policy, scan templates in the pipeline and alert on drift.

Guardrails beat audits

Point-in-time reviews find problems after they exist. Durable programmes combine:

  • Preventive guardrails — organisation policies, service control policies, Azure Policy
  • Detective controls — cloud security posture management (CSPM) with prioritised findings
  • Pipeline checks — scanning infrastructure-as-code before deployment

A 30-day quick-win plan

  1. Turn on organisation-wide audit logging
  2. Block public storage access by default
  3. Remove internet exposure of management ports
  4. Rotate or remove long-lived access keys
  5. Baseline posture with a CSPM tool and fix critical findings

Key takeaways

  • Under shared responsibility, configuration is always yours.
  • Public storage, over-privileged identities and missing logs cause most incidents.
  • Preventive guardrails and pipeline checks beat periodic audits.

Frequently asked questions

What is CSPM?

Cloud security posture management tools continuously check cloud configurations against best practice and compliance benchmarks and flag risky settings.

Should we use the same controls across AWS, Azure and GCP?

Use the same control objectives everywhere, implemented with each provider's native features, and report posture in one consolidated view.

How do we stop drift?

Deploy through infrastructure-as-code, restrict manual console changes for production and alert when deployed resources differ from approved templates.

In the cloud, every misconfiguration is one API call away from being internet-facing.

Explore our cloud security services for multi-cloud posture reviews and guardrail design.