☁️ Cloud Security Checklist
AWS / Azure / GCP Security Checklist
Practical hardening checklist for all three major clouds. CIS benchmark mapped, domain-grouped, with persistent progress tracking.
Loading...
0%
Identity & Access Management
Avoid use of root account for daily operations
Use IAM users or roles. Root access keys should not exist.
Enable MFA on root account
Hardware MFA strongly preferred for root.
Enforce MFA for all IAM users with console access
Apply via IAM policy: deny all actions without MFA present.
No IAM users with AdministratorAccess or *.* wildcard
Apply least privilege. Use IAM Access Analyser to validate.
Rotate access keys every 90 days
Deactivate and delete keys older than 90 days.
Remove unused IAM credentials (>45 days inactive)
IAM Credential Report shows last used date.
Enable IAM Access Analyser in all regions
Detects externally accessible resources.
Do not use access keys for EC2 instances — use IAM roles
Attach instance profiles, never hardcode keys.
Logging & Monitoring
Enable CloudTrail in all regions with log file validation
Multi-region trail, management events, S3 object events.
Ensure CloudTrail logs are stored in a dedicated S3 bucket with MFA Delete
Prevent log tampering. Enable S3 Object Lock.
Enable AWS Config in all regions
Records configuration changes to all supported resources.
Enable GuardDuty in all regions
Threat detection for accounts, workloads, and data.
Enable Security Hub in all regions
Aggregates findings from GuardDuty, Macie, Inspector.
Set up CloudWatch alarms for root account usage
Alert on any root account API call.
Set up alarm for IAM policy changes
Alert on CreatePolicy, PutGroupPolicy, PutRolePolicy.
Set up alarm for CloudTrail configuration changes
Alert on StopLogging, DeleteTrail, UpdateTrail.
Set up alarm for console login without MFA
Filter CloudTrail for ConsoleLogin where MfaUsed=false.
Storage
Enable S3 Block Public Access at account level
Prevents any bucket from being made public.
Enable S3 server-side encryption by default
Use SSE-S3 or SSE-KMS on all buckets.
Enable S3 versioning on critical buckets
Protects against ransomware and accidental deletion.
Enable S3 access logging on buckets containing sensitive data
Log all read/write access.
Enforce HTTPS on all S3 buckets via bucket policy
Deny HTTP (aws:SecureTransport=false).
Compute & Network
No security groups with 0.0.0.0/0 on port 22 or 3389
Use Bastion Host, SSM Session Manager, or VPN.
No security groups with unrestricted inbound on all protocols
0.0.0.0/0 on -1 (all traffic) is a critical finding.
Enforce IMDSv2 on all EC2 instances
Prevents SSRF-based credential theft via IMDS.
Enable VPC Flow Logs in all VPCs
Critical for network forensics and anomaly detection.
Ensure no EC2 instances have public IPs unless required
Use private subnets with NAT gateway.
Enable EBS encryption by default
All new volumes encrypted with AWS-managed or CMK.
Use dedicated instances or hosts for sensitive workloads
Prevent hardware sharing with other AWS customers.
Database & Secrets
Ensure RDS instances are not publicly accessible
PubliclyAccessible must be false.
Enable RDS encryption at rest
Must be set at creation time — requires snapshot+restore otherwise.
Enable automated backups for RDS
Minimum 7-day retention.
Use AWS Secrets Manager for credentials, not hardcoded in code or environment variables
Rotate secrets automatically.
Enable KMS key rotation
Annual automatic rotation for all CMKs.
Loading...
0%
Identity & Access
Enable Azure AD Security Defaults or Conditional Access
Enforces MFA for all users, blocks legacy auth.
Require MFA for all Global Administrators
Use Conditional Access or PIM with MFA activation.
Block legacy authentication protocols
Legacy auth bypasses MFA. Block via Conditional Access.
Enable Privileged Identity Management (PIM)
Just-in-time role activation for all privileged roles.
No permanent Global Administrator assignments
All admin role assignments should be eligible (PIM), not permanent.
Enable Azure AD Identity Protection
Risk-based policies for sign-in and user risk.
Ensure guest users have limited directory access
Restrict guest users from reading full directory.
Security Centre & Monitoring
Enable Microsoft Defender for Cloud on all subscriptions
Formerly Azure Security Centre — required for threat detection.
Enable all Defender for Cloud plans (Servers, Databases, Storage, etc.)
Each workload type requires separate enablement.
Enable diagnostic settings on all key resources
Key Vault, NSGs, Storage, Azure AD → Log Analytics.
Enable Azure Activity Log retention for 1 year minimum
Configure in Diagnostic Settings.
Enable Key Vault logging
All key/secret operations logged to Log Analytics.
Set up Defender for Cloud alerts email notifications
Admin email on High severity alerts.
Storage & Data
Disable public blob access at storage account level
allowBlobPublicAccess=false on all accounts.
Enable Soft Delete for blobs and containers
Protects against accidental/malicious deletion.
Enable storage account encryption with customer-managed keys
CMK in Azure Key Vault for sensitive data.
Enforce HTTPS-only traffic on storage accounts
Deny HTTP access (supportsHttpsTrafficOnly=true).
Enable Azure Defender for Storage
Detects unusual access patterns, malware uploads.
Network
Ensure no NSG allows inbound 0.0.0.0/0 on port 22 or 3389
Use Azure Bastion instead of direct RDP/SSH.
Enable Network Watcher in all regions
Required for network diagnostics and flow logs.
Enable NSG Flow Logs in all NSGs
Sent to Log Analytics for traffic analysis.
Enable Azure DDoS Protection Standard on critical VNets
Basic is insufficient for production workloads.
Use Private Endpoints for PaaS services
Key Vault, Storage, SQL via private link — no public endpoints.
Database & Key Vault
Enable Azure AD authentication for Azure SQL
Disable SQL authentication where possible.
Enable Azure SQL Auditing to Log Analytics
All database events logged for 90 days minimum.
Enable Advanced Threat Protection on Azure SQL
Detects SQL injection, anomalous access patterns.
Ensure Key Vault key expiry date is set
Keys should expire; enforce rotation.
Ensure Key Vault secret expiry date is set
Secrets with no expiry are a long-term risk.
Enable soft delete and purge protection on Key Vaults
Prevents accidental or malicious permanent deletion.
Loading...
0%
Identity & IAM
Avoid use of basic roles (Owner, Editor, Viewer) in production
Use predefined or custom roles with least privilege.
Do not assign service accounts the Editor or Owner role
Create custom roles with only required permissions.
Disable service account key creation via org policy
Use Workload Identity Federation instead of keys.
Enable 2-step verification for all users, especially admins
Enforce via Google Workspace admin.
Do not use default compute service account for workloads
Create dedicated SAs with minimal IAM roles.
Rotate service account keys every 90 days if keys required
Set org policy, audit key age regularly.
Remove service accounts not used for 90 days
Audit via IAM recommender.
Logging & Monitoring
Enable Cloud Audit Logs for Admin Activity, Data Access, and System Events
Data Access logs are off by default.
Export audit logs to Cloud Storage with 1-year retention
Bucket lock enabled.
Enable log sinks to a dedicated security project
Separate log project with restricted access.
Enable alerting for project ownership changes
assignIAMPolicy, setIAMPolicy on projects.
Enable alerting for custom role changes
CreateRole, UpdateRole, DeleteRole log entries.
Enable alerting for VPC firewall rule changes
Insert/Update/Delete on compute.firewalls.
Enable Security Command Centre (Standard or Premium)
Threat detection, vulnerability findings, compliance.
Storage
Prevent public access to GCS buckets via org policy
constraints/storage.publicAccessPrevention = enforced.
Enable uniform bucket-level access on all buckets
Disables legacy per-object ACLs.
Enable GCS bucket versioning for critical data
Protects against deletion and ransomware.
Enable Cloud KMS encryption for sensitive GCS buckets
CMEK on bucket creation.
Ensure retention policies on GCS log buckets
Lock prevents deletion during retention period.
Compute & Network
Ensure no firewall rules allow ingress from 0.0.0.0/0 on port 22 or 3389
Use IAP (Identity-Aware Proxy) for SSH/RDP.
Enable VPC Flow Logs on all subnets
Required for network forensics.
Use Private Google Access for instances without public IPs
Allows API access without internet exposure.
Restrict default network firewall rules
The "default" network allows internal traffic on all ports — restrict it.
Do not use default VPC network for production resources
Create custom VPCs with appropriate segmentation.
Enable OS Login on Compute instances
Manages SSH access via Google identity instead of keys.
Block project-wide SSH keys
Per-instance keys only, not project-level.
Database & Secrets
Ensure Cloud SQL instances are not publicly accessible
Set authorized networks to private IPs or Cloud SQL Proxy only.
Enable automated backups for all Cloud SQL instances
Minimum 7-day retention.
Enable Cloud SQL SSL/TLS for all connections
Require SSL connections, reject non-SSL.
Use Secret Manager for all credentials
Not environment variables or Compute instance metadata.
Rotate secrets in Secret Manager automatically
Set up rotation schedules via Cloud Scheduler.