The cloud rarely fails because of exotic hacking. Far more often, the cause is a setting nobody noticed. Cloud platforms make it easy to move quickly, and that same speed makes it easy to leave a door open. These are the mistakes we see most often, and how to fix them.

Public storage

Buckets left open to the internet remain a leading cause of data exposure. They often begin as a temporary shortcut for sharing files, and then get forgotten.

Turn on account-wide public access blocks, serve public content through a controlled CDN and alert on any change to storage permissions. Review anything that is deliberately public at least once a quarter.

Over-permissioned identities

Roles with admin rights turn a small leak into a full compromise. Permissions tend to grow over time because adding access is easy and removing it feels risky.

• Replace wildcard permissions with narrowly scoped roles

• Use short-lived credentials rather than long-lived access keys

• Remove unused roles and keys on a regular schedule

• Require MFA and separate accounts for administrators

Open network rules

Management ports open to the whole internet are scanned constantly. Databases should never be publicly reachable, and administrators should connect through a controlled access service rather than directly.

Missing logs

If logging is off, you cannot investigate what you cannot see. Enable audit logs in every account and region, send them to a separate protected account, and keep them for long enough to investigate an attack that went unnoticed for months.

You cannot turn on logging retroactively. Enable it before the incident, not after.

Exposed secrets

Keys committed to code repositories or baked into container images are quickly found by automated scanners. Use a secrets manager, scan code before it is merged and rotate immediately if a key ever leaks, even if the repository is private.

Fix it once, with guardrails

Manual reviews age within days in a fast-moving cloud environment. Use organisation-level policies to block the riskiest settings outright, add infrastructure-as-code scanning to your pipelines and monitor continuously for drift. That way, each mistake gets fixed once rather than every quarter.