Cloud infrastructure security is the practice of protecting cloud-hosted resources, data, and workloads from unauthorized access, data breaches, misconfigurations, and operational failures. Unlike on-premises security where you control the physical perimeter, cloud security operates under a shared responsibility model: the cloud provider secures the infrastructure, and you secure everything you deploy on it.
The 2024 IBM Cost of a Data Breach Report found that the average cost of a cloud-related data breach is $4.88 million, and organizations with fully deployed security automation save $2.22 million per breach compared to those without. Security is not optional -- it is a financial imperative.
The Shared Responsibility Model
| Layer | Cloud Provider Responsibility | Your Responsibility |
| Physical | Data center security, hardware, power | N/A |
| Network | Global backbone, DDoS protection at network edge | VPC config, security groups, network policies |
| Hypervisor | VM isolation, host OS patching | N/A (for managed services) |
| Operating System | Patching (managed services only) | Patching (VMs, self-managed K8s nodes) |
| Application | N/A | Code security, dependency updates, auth |
| Data | Encryption infrastructure available | Encryption configuration, key management, access control |
| Identity | IAM service availability | IAM policy design, MFA enforcement, role management |
The 20-Item Security Checklist
Items are organized by priority level. P0 items should be completed immediately; P3 items are important but can be scheduled.
P0: Critical (Complete Within 24 Hours)
#### 1. Enable multi-factor authentication (MFA) for all human accounts
Every human account with console or API access must use MFA. Use hardware keys (YubiKey) for admin accounts and authenticator apps (TOTP) for all others. The 2025 Verizon DBIR found that 61% of breaches involve stolen credentials; MFA blocks 99.9% of credential-based attacks.
#### 2. Remove root account access keys
Cloud provider root accounts should never have API access keys. Use them only for initial setup, then lock them with MFA and never use them for daily operations. Create individual IAM users or roles instead.
#### 3. Encrypt all data at rest
Enable default encryption on all storage services: S3 buckets (SSE-S3 or SSE-KMS), EBS volumes (AES-256), RDS instances (encryption at creation time), and Kubernetes secrets (EncryptionConfiguration with a KMS provider). Data at rest encryption is a baseline compliance requirement for HIPAA, SOC 2, PCI DSS, and GDPR.
#### 4. Encrypt all data in transit
Enforce TLS 1.2+ on all external endpoints. Use TLS between internal services (mutual TLS via service mesh is ideal). Terminate TLS at load balancers or ingress controllers with managed certificates (Let's Encrypt, AWS ACM). Disable TLS 1.0 and 1.1 everywhere.
#### 5. Block public access to storage buckets
Enable S3 Block Public Access at the account level, not just the bucket level. Azure Blob and GCS have equivalent settings. Misconfigured storage buckets are the root cause of some of the largest data breaches in history. According to Qualys, 31% of S3 buckets are misconfigured.
P1: High Priority (Complete Within 1 Week)
#### 6. Implement least-privilege IAM policies
Every user, service, and application should have the minimum permissions required to perform its function. Start with zero permissions and add only what is needed. Review IAM policies quarterly. Use IAM Access Analyzer (AWS), Azure AD access reviews, or GCP Policy Analyzer to identify over-privileged accounts.
#### 7. Enable CloudTrail / Activity Logging
Log all API calls and management events. AWS CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs provide this capability. Store logs in a separate, immutable bucket that the application accounts cannot delete. Retain logs for at least 1 year (90 days minimum for SOC 2).
#### 8. Configure network segmentation
Separate workloads into VPC subnets by function: public (load balancers, ingress), private (application servers, APIs), and isolated (databases, internal services). Use security groups and network ACLs to restrict traffic between segments. In Kubernetes, apply NetworkPolicy resources to restrict pod-to-pod communication.
#### 9. Scan container images for vulnerabilities
Integrate image scanning into your CI/CD pipeline. Tools like Trivy, Grype, and Snyk Container detect known CVEs in base images and dependencies. Block deployment of images with critical or high-severity vulnerabilities. The 2024 Sysdig report found that 87% of container images contain high or critical vulnerabilities.
#### 10. Implement secrets management
Never store secrets (passwords, API keys, tokens) in code, environment variables, or ConfigMaps. Use a dedicated secrets manager: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. In Kubernetes, use the External Secrets Operator to sync external secrets into K8s Secrets. Rotate all secrets at least every 90 days.
P2: Medium Priority (Complete Within 1 Month)
#### 11. Enable automated security scanning (CSPM)
Cloud Security Posture Management tools continuously scan your cloud accounts for misconfigurations.
| Tool | Type | Cloud Support | Key Feature |
| Checkov | Open source IaC scanner | All clouds | Pre-deployment scanning in CI |
| tfsec | Open source Terraform scanner | All Terraform providers | Fast, focused on Terraform |
| Prowler | Open source CSPM | AWS, Azure, GCP | 300+ security checks |
| AWS Security Hub | AWS native | AWS | Aggregates findings from multiple services |
| Wiz | Commercial CSPM | All clouds | Graph-based risk analysis |
| Orca | Commercial CSPM | All clouds | Agentless cloud-native security |
#### 12. Configure Web Application Firewall (WAF)
Deploy a WAF in front of all internet-facing applications. WAF rules block common attacks: SQL injection, cross-site scripting (XSS), request smuggling, and bot traffic. AWS WAF, Cloudflare WAF, and Azure Front Door provide managed rule sets that cover the OWASP Top 10.
#### 13. Implement pod security standards (Kubernetes)
Enforce Kubernetes Pod Security Standards (PSS) at the namespace level. At minimum, use the "restricted" profile for production namespaces, which prevents running as root, disallows privilege escalation, and requires dropping all capabilities.
#### 14. Set up vulnerability management for OS and dependencies
Patch operating systems within 30 days for critical CVEs and 90 days for others. Use automated patching: AWS Systems Manager Patch Manager, Azure Update Management, or unattended-upgrades for Linux. For application dependencies, enable Dependabot (GitHub) or Renovate to create automated PRs for vulnerable packages.
#### 15. Implement backup and disaster recovery
Automate database backups with point-in-time recovery. Test restoration monthly. Store backups in a separate region from production. Define and document RPO (Recovery Point Objective) and RTO (Recovery Time Objective) for each critical service. Zerto's 2024 survey found that 43% of organizations have never tested their DR plan.
P3: Important (Complete Within 1 Quarter)
#### 16. Implement runtime security monitoring
Deploy runtime security tools that detect anomalous behavior in running containers: unexpected processes, network connections to unknown endpoints, file system modifications in read-only directories. Falco (open source, CNCF incubating) and Sysdig Secure are the leading tools.
#### 17. Set up Security Information and Event Management (SIEM)
Aggregate security logs from all sources (CloudTrail, VPC Flow Logs, application logs, WAF logs) into a SIEM for correlation and alerting. Open-source options include Wazuh and the Elastic SIEM. Commercial options include Splunk, Datadog Security, and Microsoft Sentinel.
#### 18. Conduct penetration testing
Hire a third-party firm to conduct penetration testing annually (quarterly for high-risk applications). Most cloud providers allow penetration testing of your own resources without prior approval, but check provider-specific policies. Remediate all critical and high findings within 30 days.
#### 19. Implement supply chain security for container images
Sign container images using Sigstore cosign and verify signatures before deployment. Use admission controllers (Kyverno, OPA Gatekeeper) to reject unsigned or untrusted images. Pin base images to specific digests rather than mutable tags (e.g., node@sha256:abc123 instead of node:20).
#### 20. Create and test an incident response plan
Document procedures for: who is notified, how communication happens, how systems are isolated, how forensics are performed, and how post-incident reviews are conducted. Run tabletop exercises quarterly. The 2024 IBM CODB report found that organizations with tested incident response plans saved $1.49 million per breach compared to those without.
Implementation Timeline
| Week | Items | Focus |
| Week 1 | 1-5 (P0) | MFA, encryption, storage security |
| Week 2-3 | 6-10 (P1) | IAM, logging, networking, secrets |
| Week 4-8 | 11-15 (P2) | Scanning, WAF, pod security, patching, DR |
| Week 9-12 | 16-20 (P3) | Runtime security, SIEM, pen testing, supply chain, IR plan |
Security Tool Recommendations by Budget
| Budget | IAM | Scanning | Secrets | Monitoring | SIEM |
| Free/OSS | Cloud native IAM | Checkov, Trivy, Prowler | Sealed Secrets | Falco | Wazuh |
| $1-5K/mo | Cloud native IAM | Snyk (Team) | Vault (OSS) | Falco + Loki | Elastic SIEM |
| $5-20K/mo | Cloud native + Okta | Wiz or Orca | Vault Enterprise | Sysdig | Datadog Security |
| $20K+/mo | Okta/Azure AD + CyberArk | Wiz + Snyk | Vault Enterprise + CyberArk | Sysdig + CrowdStrike | Splunk |
Compliance Mapping
| Checklist Item | SOC 2 | HIPAA | PCI DSS | GDPR |
| MFA (#1) | CC6.1 | 164.312(d) | 8.3 | Art. 32 |
| Encryption at rest (#3) | CC6.1 | 164.312(a)(2)(iv) | 3.4 | Art. 32 |
| Encryption in transit (#4) | CC6.1 | 164.312(e)(1) | 4.1 | Art. 32 |
| Audit logging (#7) | CC7.2 | 164.312(b) | 10.1-10.3 | Art. 30 |
| Access control (#6) | CC6.3 | 164.312(a)(1) | 7.1 | Art. 25 |
| Backup/DR (#15) | CC7.5 | 164.308(a)(7) | 9.5 | Art. 32 |
For monitoring the security posture of your cloud infrastructure, our monitoring guide covers Prometheus alerting for security-relevant metrics. For automating security checks in your deployment pipeline, our CI/CD guide includes image scanning and policy enforcement steps. For a broader view of infrastructure management including security as a core component, see our cloud infrastructure management overview.
Frequently Asked Questions
What is the most common cloud security mistake?
Overly permissive IAM policies. The 2025 Datadog State of Cloud Security report found that 44% of organizations have at least one IAM user with administrator-level access that has not been used in 90+ days. Unused high-privilege accounts are prime targets for credential theft.
How much does cloud security cost?
A baseline security posture using open-source tools (Checkov, Trivy, Falco, Prowler) costs only engineering time. Commercial CSPM tools (Wiz, Orca) start at $5,000-15,000/month for mid-size organizations. However, the cost of a breach ($4.88 million average per IBM 2024) makes security investment a clear financial decision.
Is SOC 2 required for SaaS companies?
SOC 2 is not legally required, but it is a de facto requirement for selling to enterprise customers. 87% of enterprise procurement processes require SOC 2 Type II certification (or equivalent). The certification process typically takes 3-6 months and costs $20,000-50,000 for audit fees, plus the cost of implementing required controls.
How do I secure Kubernetes clusters specifically?
Start with the CIS Kubernetes Benchmark. Key actions: enable RBAC (default in modern K8s), enforce Pod Security Standards at namespace level, apply NetworkPolicy to restrict pod-to-pod communication, use Secrets encryption with a KMS provider, scan images in CI, run containers as non-root, and use admission controllers (Kyverno or OPA Gatekeeper) to enforce policies.
What is zero trust security?
Zero trust is a security model that assumes no implicit trust based on network location. Every request is authenticated and authorized regardless of whether it originates from inside or outside the network perimeter. In practice, this means: mutual TLS between all services, identity-based access (not IP-based), micro-segmentation of networks, and continuous verification of device health and user identity.
How often should I conduct security audits?
Automated security scanning (CSPM, image scanning) should run continuously in CI/CD pipelines. Manual security reviews should happen quarterly for critical systems and annually for all systems. Penetration testing should be conducted annually at minimum, quarterly for high-risk applications handling financial or health data.