Cloud breaches are overwhelmingly not exploits of the provider. They are customer misconfigurations, and a small set of them recurs so consistently that you can predict the findings before reading the report. This chapter is that set.

In a data centre, network position implied a great deal — being inside meant something. In cloud, the control plane is a public API and a credential is reachable from anywhere on earth. So the question ‘is this traffic inside our network?’ has largely been replaced by ‘what is this identity allowed to do, and how did it prove who it is?’

Everything below follows from that. The high-value target is not a server; it is a role.

• Wildcards. Action: "*" or Resource: "*" in a policy that is attached to something reachable. Every cloud provider offers an analyser that compares granted permissions against permissions actually used over a period, and the gap is routinely 95% or more. Right-sizing from observed usage is the single highest-value cloud security exercise available and it takes days rather than quarters.
• The confused deputy. A role that a third party can assume, without an external ID or a condition constraining who may assume it, can be assumed by anyone who learns the role's identifier. This is the classic SaaS-integration flaw and the fix is one condition key.
• Privilege escalation paths. A role that cannot read your data but can create a new role, or attach a policy, or pass a role to a compute service, is effectively an administrator with extra steps. There are a couple of dozen known escalation primitives per provider and open tools that enumerate them — running one against your own account is a genuinely revealing afternoon.
• Long-lived static keys. The credential that appears in every breach. Workload identity federation and short-lived role assumption remove the class entirely: there is no key to leak because nothing holds one.
• The permission boundary and service control policy are the guardrails: a ceiling that no policy beneath can exceed. They are the difference between ‘we ask teams not to do that’ and ‘teams cannot do that’.

Public object storage remains a recurring headline. The providers have all shipped account-level blocks that override every individual setting, so the fix is a single organisation-wide control rather than a per-bucket audit.

The ones that still catch people are subtler: a database or cache exposed to 0.0.0.0/0 because a security group was widened during a debugging session and never narrowed; a snapshot or machine image shared publicly, which is an under-appreciated data-exfiltration path since a snapshot contains the whole volume; and internal services exposed through a load balancer that was created public by default.

The structural fix is prevention rather than detection: policy-as-code in the deployment pipeline that refuses the change, plus an organisation-level guardrail so that even a manual console action cannot do it. Detecting a public bucket four hours later is much less valuable than never having created one.

• In source control — and note that removing the commit is not remediation. The value is in every clone, and public repositories are scanned by bots within minutes of a push. Rotation is mandatory.
• In environment variables — better than in code, and still visible to anything that can read the process environment, frequently including crash reporters, debugging endpoints and container inspection.
• In CI logs — a build that echoes its environment, or a verbose failure that prints a request with an authorization header. Masking helps and is not complete.
• In container images — a secret in an intermediate layer persists even if a later layer deletes it, because layers are additive.
• The answer is a secrets manager with short-lived, automatically rotated credentials injected at runtime, and ideally workload identity so that no static secret exists at all. Plus scanning in the pipeline and as a pre-commit hook, because catching it before the push is worth far more than catching it after.

During an incident there are three questions: what did this identity do, what did it access, and when did it start. Answering them requires that the logs existed before the incident, and this is where most organisations discover a gap.

• Control-plane audit logs on in every region, not only the ones you use. Attackers deliberately operate in unused regions precisely because nobody is looking there.
• Data-plane logs — object-level access logging — are usually off by default and are the ones that answer ‘what did they actually read?’. Without them you may be legally obliged to assume the worst, which is a materially more expensive outcome than the logging would have been.
• Logs written to an account the workload cannot modify. If the compromised role can delete the audit trail, you have an audit trail for exactly as long as the attacker permits.
• Retention long enough to matter. Median dwell time before detection is measured in weeks; thirty days of retention frequently means the beginning of the intrusion has already aged out.
• And test it. Take a question you would need to answer in an incident and try to answer it from the logs today. Most teams discover in that exercise that they cannot.

Containers and functions bring their own recurring findings, and they are mostly about defaults.

• Running as root inside the container. Combined with any container-escape primitive this becomes root on the node. Set a non-root user, a read-only root filesystem, and drop all capabilities you do not need — which is nearly all of them.
• Privileged containers and host mounts. A container with the Docker socket mounted is a container that can start another container with the host filesystem mounted. That is not a container escape; it is the intended behaviour of a privilege you granted.
• Kubernetes RBAC that grants more than intended. Permission to create pods is effectively permission to run arbitrary code on a node; permission to read secrets in a namespace is permission to read every credential in it; and permission to create a ServiceAccount token is a lateral-movement primitive.
• Image provenance. Pin by digest rather than by tag — a tag is mutable — and verify signatures. ‘We deployed :latest’ is an unreproducible build and a supply-chain gap in one line.

Companion chapter: this one is about what actually goes wrong in a cloud account. For the tooling market that sells you a console for it — what CNAPP genuinely merged and what was bolted on, agentless versus agent, and which three things really reduce ten thousand findings — read Cloud security — CNAPP, agents, and the alert-volume problem.