The cloud misconfigurations we find in nine of every ten assessments

Cloud environments fail in remarkably consistent ways. The specific service names differ between providers; the underlying mistakes do not.

1. Roles that can grant themselves more

Permissions to modify IAM policy are effectively administrator permissions. We find them attached to build agents, lambda execution roles and — memorably — a monitoring integration that only needed read access to a metrics endpoint.

2. Trust policies with no conditions

A role trusting an external identity provider without conditions on audience or subject can often be assumed from outside your organisation entirely. This is a two-line fix that almost nobody applies at creation time.

3. The metadata service reachable from user input

Server-side request forgery in a web application becomes credential theft when the workload can query the instance metadata endpoint. Enforcing session-oriented metadata access removes an entire class of escalation.

4. Storage that is private but not really

Bucket-level access blocks are widely applied now. Pre-signed URL generation endpoints without authorisation checks are not — and they hand out access one object at a time.

5. Logging that stops at the account boundary

Control plane logs written into the same account an attacker compromised are evidence they can delete. Centralised, append-only log storage in a separate account is the single change that most improves post-incident investigation.

None of these require sophisticated tooling to find. They require someone whose job is to look, on a schedule, with authority to fix what they find.