Cloud Security Checklist

Require MFA for all user accounts, especially administrators and users with elevated privileges

Grant users only the minimum permissions necessary to perform their job functions

Enforce complex passwords (min 12 characters, mix of upper/lower/numbers/special chars)

Conduct quarterly reviews of user access and remove unnecessary permissions

Deactivate or delete accounts for employees who have left or no longer need access

Assign permissions based on roles rather than individual users

Use SSO to centralize authentication and reduce password fatigue

Log and monitor all privileged account activities

Enable encryption for all databases, storage buckets, and file systems

Use TLS/SSL for all data transmission (minimum TLS 1.2, prefer TLS 1.3)

Use cloud key management services (AWS KMS, Azure Key Vault, GCP KMS) and rotate keys regularly

Categorize data (public, internal, confidential, restricted) and apply appropriate controls

Use DLP tools to detect and prevent unauthorized data exfiltration

Automate backups with tested restore procedures. Follow 3-2-1 backup rule

Enable versioning for storage buckets to recover from accidental deletions

Define and enforce policies for data lifecycle management

Use VPCs, subnets, and security groups to isolate resources

Use security groups and network ACLs to restrict traffic (deny by default, allow by exception)

Place databases and sensitive resources in private subnets without public IPs

Deploy WAF to protect against common web exploits and attacks

Establish secure connections between on-premises and cloud environments

Use cloud-native DDoS protection services (AWS Shield, Azure DDoS Protection)

Use flow logs and network monitoring tools to detect anomalies

Use NAT gateways and limit direct internet access from private subnets

Identify applicable regulations (GDPR, HIPAA, PCI-DSS, SOC 2, etc.)

Enable comprehensive logging for all cloud services and API calls

Conduct penetration testing and vulnerability assessments annually

Maintain up-to-date security policies, procedures, and incident response plans

Ensure data storage and processing comply with regional data residency laws

Assess and monitor security posture of cloud service providers and vendors

Conduct internal and external audits to verify compliance

Log all API calls and administrative actions (AWS CloudTrail, Azure Activity Log, GCP Audit Logs)

Centralize log collection and analysis for threat detection

Configure alerts for suspicious activities, failed logins, and policy violations

Track resource consumption to detect anomalies and potential attacks

Use IDS/IPS to detect and prevent malicious activities

Schedule regular reviews of security logs and investigate anomalies

Retain logs according to compliance requirements (typically 90 days minimum, 1 year for critical)

Apply security patches promptly. Use automated patch management where possible

Deploy from security-hardened base images and maintain custom images

Remove or disable unused services, ports, and protocols

Use Terraform, CloudFormation, or ARM templates for consistent, version-controlled deployments

Regularly scan containers, images, and infrastructure for known vulnerabilities

Scan container images, use minimal base images, and implement runtime security

Use auto-scaling to handle traffic spikes and reduce attack surface

Prefer managed services over self-managed to reduce operational security burden

Implement authentication, authorization, rate limiting, and input validation for all APIs

Follow OWASP Top 10 guidelines and conduct secure code reviews

Store secrets in secure vaults (AWS Secrets Manager, Azure Key Vault) - never hardcode

Validate and sanitize all user inputs to prevent injection attacks

Force HTTPS for all web applications and APIs

Use CSP headers to prevent XSS attacks

Keep application dependencies and libraries updated to patch vulnerabilities

Create and document a comprehensive incident response plan with roles and procedures

Define roles and responsibilities for security incident response

Conduct tabletop exercises and simulations to test response procedures

Test backup and disaster recovery procedures regularly

Define how to communicate incidents internally and externally