AV-10 · Cloud misconfiguration and identity abuse

Cloud platforms offer speed and flexibility at the cost of configuration surface area. Access policies, IAM roles, storage permissions, networking rules, and managed service settings all change frequently — and any of them can become an attack path when defaults are too broad or changes aren't reviewed.

Cloud compromise often starts with identity abuse: a stolen access key, a leaked service account credential, an over-permissioned role attached to a public-facing compute instance. Once an attacker reaches the control plane, they may be able to enumerate resources, modify security controls, and create persistence — all through legitimate API calls.

Cloud governance is often split across teams, which means nobody has a complete picture. Security doesn't know what dev ops deployed. Platform doesn't know what the application team's CI/CD pipeline does. That fragmentation lets dangerous permissions accumulate until an attacker finds them.

Attackers with cloud control-plane access can enumerate buckets, read sensitive storage, create admin users or access keys, modify security groups to expose internal services, disable logging, snapshot and export data, or establish persistent IAM principals for re-entry. None of this requires endpoint compromise or custom malware.

Many cloud attacks blend into normal operations. An admin console login, an IAM policy update, a security group change — these happen legitimately every day. Detecting abuse means watching for the combination of who did it, from where, when, and whether it matches an approved change.

The most important evidence is in audit trails and identity logs, not endpoint telemetry. If you're not collecting cloud control-plane logs and retaining them long enough to investigate, you're effectively blind to this category of attack.

Apply least privilege to cloud roles and service accounts. Reduce standing admin access for humans — use just-in-time elevation where the platform supports it. Require strong MFA for console access. Separate deployment, operations, and security administration duties where practical.

Build baselines for normal admin workflows and alert on deviations. The most useful signals are: who normally makes changes versus who just made this change, what resources they normally touch, and what time of day these changes typically happen.

Cloud security is operational, not a one-time configuration task. Expose drift continuously. Check permissions, public exposure, and control-plane changes on a cadence that matches how fast your environment changes.