Cloud Security: AWS, Azure, and GCP Best Practices
Cloud adoption continues to accelerate, with 94% of enterprises using cloud services according to Gartner’s 2025 Infrastructure Report. Yet misconfigured cloud resources remain the leading cause of data breaches, with the IBM Cost of a Data Breach 2025 report estimating average breach costs at $4.88 million. Understanding cloud security — from the shared responsibility model to CSPM tooling — is essential for any organization operating in AWS, Azure, or GCP.
The Shared Responsibility Model
Every cloud provider operates under a shared responsibility model, but the specific boundaries differ by service type. The provider secures the cloud (physical infrastructure, hypervisors, network). The customer secures what is in the cloud — data, configurations, access policies, and application code.
IaaS vs PaaS vs SaaS Responsibility
In IaaS (EC2, Compute Engine), customers are responsible for OS patching, firewall rules, and application security. In PaaS (RDS, Cloud SQL), the provider handles OS and runtime, but customers must still configure access controls, encryption, and audit logging. SaaS (Office 365, Google Workspace) shifts most responsibility to the provider, but customers retain accountability for user access, data classification, and compliance. Misunderstanding these boundaries is the root cause of most cloud breaches. The 2024 S3 Bucket Leak of over 50 million customer records at a major financial firm occurred because the bucket’s block-public-access setting was disabled — entirely the customer’s responsibility under AWS’s model.
Provider-Specific Model Differences
AWS’s model emphasizes “security of the cloud vs. security in the cloud.” Azure adds “customer data ownership” explicitly, while GCP frames shared responsibility through “security of the infrastructure” and “security of the content.” These semantic differences matter in compliance audits: SOC 2 reports may reference the provider’s controls differently depending on which model elements the auditor maps.
Identity and Access Management Hardening
IAM is the single most critical control in any cloud environment. The 2023 Capital One breach (affecting 106 million customers) originated from a misconfigured IAM role that allowed a SSRF attack to assume a privileged role.
Least Privilege Implementation
AWS IAM policies, Azure RBAC roles, and GCP IAM bindings all enforce access decisions, but least privilege is notoriously difficult to implement correctly. The AWS IAM Access Analyzer generates policies based on actual usage, helping teams refine overly permissive roles. Azure Privileged Identity Management (PIM) provides just-in-time (JIT) access elevation with approval workflows. GCP’s IAM Recommender analyzes usage patterns and suggests tighter bindings. A 2024 study by Palo Alto Networks found that the average AWS account has 42% unused permissions across IAM roles — a massive and unnecessary attack surface.
Multi-Factor Authentication
MFA reduces account compromise risk by 99.9% according to Microsoft. Cloud provider root accounts must have hardware MFA (YubiKey, Titan) enabled. AWS Organizations, Azure Management Groups, and GCP Organization Policies allow enforcement of MFA across all member accounts. FIDO2/WebAuthn passwordless authentication is increasingly supported by all three providers.
Service Account and Secret Management
Service accounts (IAM Roles for EC2, Managed Identities in Azure, Service Accounts in GCP) should have short-lived credentials via STS. AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager rotate secrets automatically. Never embed credentials in code — use provider-native secret stores or HashiCorp Vault for multi-cloud environments.
Infrastructure Security and Network Controls
Cloud network security differs fundamentally from on-premises: the perimeter is logical, not physical.
Virtual Network Segmentation
AWS VPCs, Azure VNets, and GCP VPCs provide network isolation. Security groups (stateful firewalls) and network ACLs (stateless) control traffic at the instance and subnet levels. The principle of least connectivity means: no 0.0.0.0/0 ingress except through load balancers or CloudFront; egress filtering to known endpoints; and VPC Flow Logs, NSG Flow Logs, or VPC Flow Logs (GCP) enabled for traffic analysis. Microsegmentation tools like AWS Network Firewall, Azure Firewall, and GCP Cloud Next-Gen Firewall enforce application-layer rules.
Data Encryption
All three providers offer encryption at rest (AES-256) via KMS. Customer-managed keys (CMK) provide additional control over key rotation and access auditing. Encryption in transit should enforce TLS 1.3 minimum. S3 default encryption, Azure Storage Service Encryption, and GCP default encryption at rest are transparent but should be verified in compliance audits.
Cloud Security Posture Management
CSPM tools continuously assess cloud configurations against compliance frameworks (CIS Benchmarks, NIST 800-53, SOC 2). AWS Security Hub, Azure Security Center, and GCP Security Command Center aggregate findings from native services: GuardDuty (threat detection), Config (compliance evaluation), and Inspector (vulnerability scanning).
Automated Remediation
Detection without remediation generates alert fatigue. Event-driven remediation using CloudWatch Events + Lambda, Azure Policy + Automation Runbooks, or GCP Cloud Functions + Security Command Center automatically corrects common misconfigurations: opening S3 bucket ACLs, disabling logging, or creating overly permissive security groups. Infrastructure as Code (Terraform, Pulumi, CDK) with policy-as-code tools (Checkov, Sentinel, cfn-guard, tfsec) prevents misconfigurations at deployment time. Continuous compliance monitoring replaces point-in-time audit evidence. AWS Config Rules, Azure Policy, and GCP Organization Policies enforce guardrails: requiring encryption, blocking public access, enforcing resource tagging.
Compliance Automation
Continuous compliance monitoring replaces point-in-time audit evidence. AWS Config Rules, Azure Policy, and GCP Organization Policies enforce guardrails: requiring encryption, blocking public access, enforcing resource tagging. Automated evidence collection feeds SOC 2 and ISO 27001 audit processes. Infrastructure-as-code scanning tools also verify that deployed resources match approved configurations, preventing configuration drift that creates security gaps.
Cloud Incident Response
Cloud incidents require different response procedures than on-premises. The NIST SP 800-61 revision 3 acknowledges cloud-specific challenges: lack of physical access to machines, shared forensic boundaries, and provider-specific data preservation mechanics.
Detection and Analysis
Cloud-native detection leverages provider services: GuardDuty (AWS), Microsoft Defender for Cloud (Azure), and Event Threat Detection (GCP). Centralized logging across accounts requires a SIEM aggregation strategy — using S3 + Athena, Azure Sentinel, or GCP Chronicle. Detection rules should trigger on: IAM privilege escalation, unusual API volume, data exfiltration patterns (large S3 GET requests), and crypto mining compute spikes.
Containment and Forensics
Cloud containment involves revoking IAM credentials, isolating instances (security group modification), and preserving snapshots for forensic analysis. Provider support for forensic acquisition varies: AWS allows EBS snapshot sharing; Azure supports disk export with customer-managed keys; GCP enables persistent disk cloning. Chain of custody documentation must account for the provider’s involvement in evidence preservation.
Container and Serverless Security
Containers and serverless functions introduce unique security challenges beyond traditional IaaS.
Container Security Stack
Container security must cover the full lifecycle. At build time, scan base images for known vulnerabilities using Trivy or Docker Scout, pin base image digests rather than tags, and use minimal base images (distroless, Alpine, scratch). At deployment time, enforce Kubernetes Pod Security Standards (Baseline or Restricted), use OPA/Gatekeeper admission controllers, and limit container capabilities with seccomp, AppArmor, and read-only root filesystems. At runtime, monitor for anomalous process execution, unexpected network connections, and container escape attempts using Falco or Aqua Security.
Serverless security shifts responsibility - the provider manages the runtime, but customers must secure function code, dependencies, and permissions. Never include secrets in function environment variables - use AWS Lambda’s integration with Secrets Manager, Azure Functions Managed Identity, or GCP Cloud Functions Secret Manager. Apply the least privilege IAM role per function, not a shared role. Enable VPC access for Lambda functions interacting with private resources.
Cloud-Native Security Operations
Cloud Security Operations Centers (Cloud SOCs) extend traditional SOC capabilities to cloud environments. Cloud Detection and Response (CDR) tools - SentinelOne Cloud, Palo Alto Cortex XDR, and CrowdStrike Falcon Cloud Security - monitor cloud API events, workload behavior, and network traffic. Detection rules cover: cloud credential abuse (AssumeRole from unusual principals), infrastructure drift (Security Group rule changes), data exfiltration patterns (S3 MultiPart upload to unfamiliar buckets), and crypto mining compute spikes. The 2025 Cloud Security Alliance report found that organizations with dedicated Cloud SOCs detected incidents 57% faster than those relying on traditional SOC teams.
Building a Security Program
A mature security program requires more than individual tools — it requires processes, training, and culture. Start with a risk assessment: identify your most valuable assets, threat actors, and vulnerabilities. Develop security policies covering acceptable use, data classification, incident response, and vendor risk management. Implement security controls based on a recognized framework: NIST Cybersecurity Framework provides a comprehensive approach organized around Identify, Protect, Detect, Respond, and Recover functions. ISO 27001 offers a certifiable standard for information security management. CIS Controls provide prioritized actions for common threats. Train all employees on security basics: phishing awareness, password hygiene, data handling, and incident reporting. Regular security testing — vulnerability scanning, penetration testing, and red team exercises — validates that controls work. Measure program effectiveness through metrics: mean time to detect, mean time to respond, vulnerability remediation time, and phishing click rates.
Cloud Security Architecture
Cloud security follows the shared responsibility model. The cloud provider secures the infrastructure (physical security, network, hypervisor). The customer secures everything they put in the cloud: data, configurations, identities, and applications. Key cloud security practices: enable encryption at rest and in transit, implement least-privilege IAM policies, use network segmentation (VPCs, security groups), enable logging and monitoring (CloudTrail, CloudWatch), and automate compliance checks (AWS Config, Azure Policy). The Cloud Security Alliance’s Cloud Controls Matrix provides a framework for assessing cloud provider security.
FAQ
Who is responsible for patching the OS in EC2? The customer. AWS patches the hypervisor; customers manage OS and application patches. Use Systems Manager Patch Manager for automation.
What is a CSPM tool? Cloud Security Posture Management — a tool that continuously monitors cloud configurations against security benchmarks (CIS, NIST) and alerts on misconfigurations. Examples include Wiz, Prisma Cloud, and AWS Security Hub.
How do I detect a compromised IAM credential? Enable CloudTrail (AWS), Azure Monitor, or GCP Cloud Audit Logs. Look for API calls from unusual geographies, new user creation, or changes to trust policies.
What encryption should be used for data at rest in S3? Server-Side Encryption with S3-Managed Keys (SSE-S3) for default, SSE-KMS for customer-managed key control over rotation and auditing, or SSE-C for customer-provided keys.
Can I use the same security group across multiple AWS accounts? Security groups are account-scoped. Use AWS RAM (Resource Access Manager) to share security groups or implement a centralized firewall architecture with AWS Network Firewall.
See our Security Guide for foundational concepts. For CI/CD security integration, read DevSecOps Guide. Learn about Zero Trust Architecture for cloud-native networks.