What a cloud security review should cover
A practical checklist for enterprise teams building secure foundations across AWS, Azure, and GCP.
- Multi-Cloud Guardrails: 100% Infrastructure-as-Code (Terraform/OpenTofu) enforcement eliminates IAM policy drift across AWS, Azure, and GCP.
- CSPM & CWPP Integration: Pairing Wiz and Tenable agentless posture scanning provides instant risk prioritization for cloud workloads.
- Zero Trust SASE Alignment: Restricting administrative control planes to Entra ID / Okta PAM ensures audit readiness.
Most cloud security reviews start with good intentions and quickly dissolve into a checklist of tools, dashboards, and compliance findings. That’s useful, but it’s rarely what you need if your real question is: “Are we building securely, or are we just hoping for the best?”
This guide is a practitioner’s walkthrough of what a proper cloud security architecture review covers - written for security leaders, cloud engineers, and CTOs who want something they can actually act on.
“A cloud security review is not a compliance audit. It’s a design review - for the architecture you have today, and the architecture you’re building tomorrow.”
Identity & Access Management
Cloud security lives and dies by identity. If IAM is not locked down, nothing else matters.
A strong IAM review checks:
Are IAM policies and role assignments scoped as narrowly as possible? Are there service accounts with owner-level permissions running production workloads?
Is SAML or OIDC integrated with your corporate identity provider? Are external identities (guests, partners) governed with time-bound access?
Are break-glass accounts rotation, MFA enforcement, and just-in-time access controls in place for administrators?
Most cloud breaches involve compromised credentials or over-privileged access. If you’re not reviewing IAM first, you’re reviewing the wrong thing.
Network Architecture & Perimeter
“The network perimeter is not dead” is a tired statement, but the shift is real: your perimeter moved from the firewall to the API gateway, the IAM policy, and the service mesh. A cloud review must reflect that.
Key areas:
- VPC design: Are subnets segmented by environment (prod/non-prod)? Is there private connectivity to cloud services (VPC endpoints, Private Service Connect)?
- Traffic controls: Are default firewall rules restrictive? Is egress traffic filtered to known destinations?
- Load balancing: Are internet-facing load balancers necessary, or can they be internal-only behind a WAF?
- DNS security: Are DNS queries routed through secure resolvers? Is DNS tunneling a risk?
Logging, Monitoring & Detection
Cloud security controls are useless if you can’t detect when they’re bypassed. Logging is not an afterthought - it’s a primary control.
Are CloudTrail, Activity Logs, and Audit Logs flowing to a central SIEM or Security Command Center? Can you reconstruct a full attacker timeline?
Are logs written to immutable storage? Can administrators delete audit trails?
Are there active detections for privilege escalation, unexpected IAM changes, data exfiltration patterns, and unusual API activity?
Guardrails & Policy Enforcement
A cloud security review must examine how you prevent misconfigurations at scale. Manual reviews don’t scale; policy-as-code does.
- IaC scanning: Are Terraform, CloudFormation, or ARM templates checked for security issues in CI/CD?
- Cloud-native controls: Are AWS Organizations, Azure Policy, and GCP Organization Policy configured as the first line of defense?
- Budget alerts: Are there alerts for unexpected spend spikes that might indicate abuse?
Data Protection & Encryption
Encryption at rest and in transit is table stakes. A real data protection review goes further.
Are customer-managed keys (CMKs) used instead of defaults? Is key rotation automated?
Are S3 buckets, Blob containers, and Cloud Storage buckets private by default? Is there a process to detect exposed objects?
Can you identify high-value data stores? Are access logs enabled on sensitive datasets?
Containers & Serverless
Moving to Kubernetes or running serverless functions changes your attack surface dramatically. The review must cover:
- Image scanning: Are container images scanned for CVEs before deployment?
- Runtime security: Is there visibility into runtime behaviour (Falco, Aqua, Wiz)?
- Function permissions: Do Lambda/Azure Functions/GCP Functions run with least-privilege execution roles?
- Secrets management: Are secrets stored in native secret managers (SSM, Key Vault, Secret Manager) instead of environment variables?
Secure Engineering & DevOps
Ultimately, a cloud security review should ask: are your teams set up for success when they build and ship code?
This means:
- Security gates: Are security checks embedded in CI/CD pipelines with clear pass/fail criteria?
- Dependency scanning: Are SAST, SCA, and container image scans part of every build?
- Secrets scanning: Are there pre-commit hooks or CI checks to prevent secrets from landing in code?
- Posture as code: Is your security posture defined in version-controlled policy (e.g., Open Policy Agent, Sentinel, Prisma Cloud)?
How this applies to enterprise organisations
For enterprise organisations, the review takes on additional urgency around:
- GDPR and data residency: Are EU-bound data flows handled correctly across multi-cloud? Is there documented data processing?
- Financial services: Are you meeting PSR/FCA cloud security principles where applicable?
- Supply chain: Are third-party SaaS and IaaS providers assessed for security posture?
“The review should surface your top five risks, not your top fifty findings. Prioritise what matters now against what matters in six months.”