Most cloud breaches aren't exotic exploits — they're misconfigurations: a public bucket, an over-permissive role, an exposed key. The cloud is secure; the settings usually aren't.
The usual suspects
| Misconfig | Impact |
|---|---|
| Public S3 / storage bucket | Mass data leak |
Over-broad IAM (*:*) |
One key = full account |
| Exposed metadata endpoint | SSRF → temp credentials |
Security group open to 0.0.0.0/0 |
Internet-facing admin ports |
| Long-lived access keys in code | Leaked via git (Secrets Management) |
Find them before attackers do
# multi-cloud misconfig & IAM auditing
prowler aws
scoutsuite aws
# find leaked keys in a repo
trufflehog filesystem ./repoPrinciples
- Least privilege IAM — grant the minimum, scope to resources, prefer short-lived roles over static keys.
- Default-deny networking — open only what's needed, to known sources.
- Block public access at the account level for storage.
Lock the metadata endpoint (
169.254.169.254) — SSRF into it is a classic cloud-credential theft.
Related: Secrets Management · XSS, SSRF and IDOR · Container and Docker Security