Why Cloud Security Audits Are Non-Negotiable
The average cost of a data breach reached $4.88 million (EUR 4.45 million) in 2024, according to IBM's Cost of a Data Breach Report. Cloud-specific breaches cost 13% more than on-premise breaches due to the larger blast radius and complexity of cloud environments. For European companies, GDPR fines add an additional layer of financial risk — the Dutch Data Protection Authority alone issued EUR 5.4 million in fines in a single quarter of 2025.
A structured security audit is the most effective way to identify vulnerabilities before attackers do. This guide provides a comprehensive framework that covers the six critical domains of cloud security.
Domain 1: Identity and Access Management (IAM)
IAM misconfigurations are the number one cause of cloud security breaches. CrowdStrike reports that 80% of cloud breaches in 2024 involved compromised credentials or excessive permissions.
Audit Checklist
- Enforce MFA on all human identities — Not just the root account. Every IAM user, federated identity, and SSO login must require multi-factor authentication. Use hardware security keys (FIDO2) for privileged accounts.
- Implement least privilege — Review IAM policies for overly permissive wildcards. AWS IAM Access Analyzer, Azure AD Privileged Identity Management, and GCP IAM Recommender can identify unused permissions.
- Eliminate long-lived credentials — Replace IAM access keys with IAM roles and temporary credentials wherever possible. For CI/CD pipelines, use OIDC federation (GitHub Actions, GitLab CI) instead of stored secrets.
- Audit service accounts — Service accounts with admin privileges are one of the most dangerous patterns. Enumerate all service accounts, verify their permissions follow least privilege, and ensure their keys are rotated regularly.
- Review cross-account access — Document all cross-account IAM roles and verify their trust policies. A misconfigured trust policy can grant external accounts full access to your environment.
Domain 2: Network Architecture
Cloud networking misconfigurations — particularly overly permissive security groups and public-facing resources — account for 25% of cloud incidents according to Palo Alto Unit 42.
Audit Checklist
- Eliminate public access to databases — No RDS, Azure SQL, or Cloud SQL instance should have a public IP unless there is a documented, risk-accepted business requirement. Use VPC endpoints and private connectivity instead.
- Review security group rules — Identify any security group allowing inbound 0.0.0.0/0 on ports other than 80 and 443. SSH (22) and RDP (3389) open to the internet are critical findings.
- Implement network segmentation — Separate workloads into distinct subnets and VPCs based on sensitivity. Production and development must never share a VPC.
- Enable VPC Flow Logs — Flow Logs provide network traffic visibility essential for incident investigation. Enable on all VPCs and route to a centralised logging account.
- DNS security — Enable DNSSEC where supported. Ensure Route53/Azure DNS/Cloud DNS hosted zones are not publicly modifiable.
Domain 3: Data Protection
Data protection spans encryption, access controls, and data lifecycle management. For EU companies, GDPR Article 32 explicitly requires "appropriate technical measures" including encryption.
Audit Checklist
- Encryption at rest — Verify all storage services use encryption: S3 (SSE-S3 or SSE-KMS), EBS volumes, RDS instances, and all managed databases. Use customer-managed KMS keys (CMKs) for sensitive data — not AWS-managed keys.
- Encryption in transit — Enforce TLS 1.2+ on all endpoints. Terminate TLS at the load balancer, not at individual instances. Check for internal traffic between services — encryption in transit within the VPC is often overlooked.
- S3 bucket policies — Run a comprehensive audit of all S3 bucket policies and ACLs. Use S3 Block Public Access at the account level. AWS reports that misconfigured S3 buckets were involved in 35% of AWS-related data breaches in 2024.
- Data classification — Implement tagging policies that classify data by sensitivity level. This enables policy-driven encryption, access controls, and retention rules.
- Backup encryption — Verify that automated backups (snapshots, RDS automated backups) inherit encryption from the source resource. Unencrypted backups of encrypted databases are a common gap.
Domain 4: Logging and Monitoring
You cannot secure what you cannot see. The mean time to detect a breach is 194 days according to IBM. Comprehensive logging reduces this dramatically.
Audit Checklist
- Enable CloudTrail / Azure Activity Log / Cloud Audit Logs — Ensure management event logging is enabled in all regions, including regions you do not use (attackers target unused regions precisely because they are unmonitored).
- Centralise logs — Ship all logs to a dedicated logging account with immutable storage. Use S3 Object Lock, Azure Immutable Blob Storage, or GCS Bucket Lock to prevent log tampering.
- Set up real-time alerting — At minimum, alert on: root account usage, IAM policy changes, security group modifications, failed authentication spikes, and API calls from unusual IP ranges.
- Enable GuardDuty / Microsoft Defender / Security Command Center — Cloud-native threat detection services analyse API activity, network flow, and DNS logs. These catch compromised credentials and crypto-mining within hours rather than months.
- Retain logs for compliance — GDPR does not specify log retention periods, but NIS2 (which applies from October 2024 across the EU) requires organisations to retain security-relevant logs. We recommend a minimum of 12 months of hot storage and 7 years of cold storage for audit logs.
Domain 5: Compute and Container Security
Compute security covers virtual machines, containers, and serverless functions. With Sysdig reporting that 87% of container images have high or critical vulnerabilities, this domain demands attention.
Audit Checklist
- Patch management — Verify automated patching is enabled for all EC2/VM instances via AWS Systems Manager, Azure Update Manager, or GCP OS Patch Management.
- Container image scanning — Scan all container images in CI/CD pipelines before push to registry. Use ECR image scanning, Azure Defender for containers, or Artifact Registry vulnerability scanning.
- No root containers — Kubernetes pods should never run as root. Enforce via PodSecurityStandards (PSS) or OPA/Gatekeeper policies.
- IMDSv2 enforcement — On AWS, require IMDSv2 (Instance Metadata Service v2) to prevent SSRF-based credential theft. This single setting would have prevented several high-profile breaches.
- Lambda/Function security — Review function IAM roles for over-permissioning. Serverless functions often accumulate permissions during development that are never scoped down for production.
Domain 6: Compliance and Governance
Technical controls must be backed by governance processes to be effective.
Audit Checklist
- Enable AWS Config / Azure Policy / GCP Organisation Policy — Automate compliance checking. Define rules that flag non-compliant resources (unencrypted volumes, public endpoints, missing tags) and remediate automatically where safe.
- Implement SCPs / Management Groups — Use Service Control Policies (AWS) or Azure Management Groups to set guardrails at the organisation level. Deny actions that should never happen in any account: disabling CloudTrail, creating public S3 buckets, launching instances in non-EU regions.
- Conduct regular access reviews — Review IAM permissions quarterly. Remove access for former employees within 24 hours of departure. Automate this through HR system integration.
- Document your shared responsibility model — Ensure your team understands which security controls are the cloud provider's responsibility and which are yours. This understanding gap causes the majority of compliance failures.
How to Run Your First Security Audit
Start with automated tools to establish a baseline:
- Run AWS Security Hub / Azure Secure Score / GCP Security Health Analytics — These give you an immediate compliance score against CIS Benchmarks.
- Deploy Prowler (open-source) — Prowler runs 300+ checks against AWS best practices and CIS benchmarks. It generates actionable reports in under an hour.
- Prioritise findings by blast radius — Not all findings are equal. Focus first on: public-facing resources, overly permissive IAM, unencrypted data stores, and disabled logging.
- Create a remediation plan with deadlines — Critical findings should be remediated within 48 hours. High findings within two weeks. Medium within 30 days.
If you need a comprehensive security audit conducted by experienced cloud architects, our technical due diligence service includes a full security assessment with prioritised remediation recommendations. We have conducted security audits for financial services, healthcare, and SaaS companies across Europe. Contact us to schedule your audit.
