The Silent Cloud Bills: Open Buckets and Leaky Defaults

Most of the cloud incidents we are called into are not the result of advanced attackers. They are misconfigurations: a bucket that was set to public for a one-time test and never closed, an IAM role with * on actions because someone wanted the demo to "just work", a forgotten lambda with a credential printed in plaintext.

The three patterns we see most

• Public S3 buckets with internal data. Often discovered by competitors before defenders find them. Search engines and bucket-listing services index them quickly.
• IAM roles that can assume each other. A low-risk role used by a marketing tool ends up with a chain that reaches production. Map the graph; it always surprises.
• Forgotten services left in default config. Old EC2 instances, unused RDS snapshots, container registries open to the world. Inventory beats firewalls.

Ten-minute audit you can do today

1. List every bucket in your account and confirm none have public-read or open bucket policies.
2. Pull every IAM policy that contains "*" on Action or Resource. If there are more than five, you have homework.
3. Check for access keys older than 90 days. Rotate or retire them.
4. Run CloudTrail event lookup for AssumeRole calls from unexpected principals in the last 30 days.
5. Confirm MFA is enforced on the root and on every human user. Yes, even the "just for testing" ones.

Cloud security is mostly hygiene. The teams that do well are the ones that schedule the boring review—not the ones with the fanciest tools.