Cloud environments change rapidly: permissions, storage policies, API keys and service principals often drift from the intended security baseline. This leads to data exposure or privilege escalation.
Typical signals
- Public buckets/containers, overly broad IAM roles, exposed keys
- New external sharing links, failed CA/MFA enforcement
- Unexpected API calls (enumeration), anomalous role assumptions
Current-state check
- Guardrails: CSPM + IaC scanning + policy-as-code (deny by default)
- Secrets hygiene: short-lived creds, vaulting, key rotation, workload identity
- Logging: correlate cloud trail, IdP logs and SaaS audit logs centrally
