Checklist · AWS · Azure · GCP
Cloud Security Posture Checklist
A cloud-neutral baseline used in Dephiant cloud reviews across AWS, Azure, and Google Cloud. Aligned to CIS Benchmarks, CSA Cloud Controls Matrix, and ISO/IEC 27017 / 27018.
Identity & Access
- Federated identity (SSO/OIDC) is the only path into cloud consoles; no long-lived local users.
- Root / global-admin accounts have FIDO2 MFA, are alarmed on use, and never used for daily work.
- Workload identity (IAM Roles, Managed Identities, Workload Identity Federation) replaces static access keys.
- Privileged access is just-in-time via PIM / IAM Identity Center / GCP IAM Conditions, with approval workflows.
- Cross-account / cross-subscription / cross-project access is least-privileged and externally restricted.
Account / Tenant / Project Hygiene
- Multi-account or multi-subscription structure with Org / Management Group / Folder hierarchy.
- Service Control Policies / Azure Policy / GCP Org Policy enforce guardrails (region pinning, public-resource bans).
- New accounts/subscriptions/projects bootstrap from an opinionated baseline (IaC).
- Service quotas reviewed and alerted; cost anomaly detection enabled.
Network
- Default VPCs / VNets removed or hardened; environments are explicitly segmented.
- No internet-exposed admin ports (SSH/RDP/WinRM); access via SSM / Bastion / IAP / Just-in-Time VM.
- Egress controlled with explicit allow-lists at the perimeter (NAT + firewall / Azure Firewall / Cloud NGFW).
- Private endpoints used for managed services (PrivateLink / Private Endpoint / PSC) where supported.
- WAF and DDoS protection in front of every public web entry point.
Data Protection
- Default encryption-at-rest verified; customer-managed keys (KMS / Key Vault / Cloud KMS) for sensitive data.
- All storage and database services scanned for public exposure (S3, Blob, GCS, DBs, snapshots).
- Key rotation enforced; key access logged and reviewed.
- Backups exist for tier-1 data; restore tests documented; cross-region copy for critical workloads.
- Data classification labels drive DLP / Purview / DSPM enforcement.
Workload Security
- All container images scanned in CI and at registry; admission control blocks unsigned/critical images.
- Runtime protection on hosts and containers (EDR, Defender for Cloud, GKE/EKS/AKS hardening).
- Serverless functions follow least privilege; secrets pulled from secret manager, not env vars committed to repos.
- Patching SLAs enforced for VMs and managed-service supported versions.
- Production deploys require code review, signed commits, and provenance (SLSA-aware pipeline).
Logging, Detection & Posture
- Org-wide audit trail enabled (CloudTrail org trail, Azure Activity + Diagnostic settings, GCP Cloud Audit Logs) to centralized account.
- Centralized log destination is immutable / write-once, with separate access from production.
- Cloud-native posture management on (Security Hub + Config / Defender for Cloud / Security Command Center).
- CSPM findings tracked to closure with SLA by severity; drift detection alerts on guardrail bypass.
- Detections include identity-attack patterns (impossible travel, MFA fatigue, key abuse).
Resilience & Governance
- Region and availability-zone strategy documented and tested for tier-1 services.
- Tagging policy enforced (owner, environment, data class, cost center) and used in incident response.
- Change-management gates for production IaC; emergency-change path documented.
- Annual cloud-incident tabletop exercise; quarterly access reviews of privileged roles.
- Mapping to CIS Benchmark (per cloud), CSA CCM, ISO 27017/27018, and applicable regional regimes.
Want a cloud posture review with scored results?
Dephiant runs cloud security reviews across AWS, Azure, and GCP with prioritized remediation backlog, IaC fixes, and CSPM tuning. We also run our own company operations on Google Cloud Platform, and we hold this same checklist against our own estate.