Blog · 7 min read
The cloud misconfigurations we find in almost every assessment
Public buckets are the least of it. The identity and network-path findings that show up in nearly every first-time cloud review.
By One Circle Solutions · Published
Everyone checks for public storage buckets now. The findings that actually worry us in first-time cloud assessments are quieter — identity and network-path issues that turn one small compromise into full-environment access.
Identity findings (the ones that matter most)
- Long-lived access keys for human users, years old, often for people who left
- Service accounts and roles with wildcard permissions 'temporarily' granted during an incident or migration — never revoked
- No MFA on cloud console access outside the core engineering team
- Cross-account trust relationships nobody can explain, inherited from a contractor or acquisition
- CI/CD pipelines holding production-admin credentials that any developer commit can exercise
Network and exposure findings
- Security groups open to 0.0.0.0/0 on management ports — usually SSH or RDP 'just for troubleshooting'
- Databases and caches reachable from the whole VPC when one application needs them
- Forgotten dev/staging environments running production data with none of production's controls
- Snapshots and machine images shared more broadly than the resources they came from
Logging findings
- Control-plane audit logging (CloudTrail and equivalents) enabled in one region, silent in the rest
- Logs collected but nothing watching them — indistinguishable from no logs during an incident
- No alerting on the events that matter most: new admin principals, disabled logging, auth failures from new geographies
Why these persist
None of these misconfigurations breaks anything. The application runs fine with a wildcard role and an open security group — until credentials leak, and then the blast radius is everything that trust could reach. That's why point-in-time cleanups don't hold: the next migration recreates the same shortcuts. Continuous posture monitoring exists to catch the drift, not just the snapshot.