Cloud Misconfiguration Guide
The top 25 AWS misconfigurations we find in production environments. Each entry includes what the issue looks like, why it matters, and how to fix it.
S3 Buckets with Public Access
Buckets configured with public read or write ACLs, or bucket policies that grant access to everyone ('*' principal). This is the #1 cause of cloud data leaks.
Enable 'Block Public Access' at the account level and on each bucket. Use bucket policies that restrict access to specific IAM principals or VPC endpoints. Audit existing buckets with AWS Trusted Advisor or S3 Storage Lens.
Security Groups Open to 0.0.0.0/0
Security group rules allowing inbound traffic from any IP on sensitive ports like SSH (22), RDP (3389), MySQL (3306), or PostgreSQL (5432).
Restrict inbound rules to specific CIDR ranges (office VPN, VPC CIDR) or use AWS Systems Manager Session Manager for shell access instead of SSH. Implement a security group change monitoring process.
IAM Users with Active Long-Term Access Keys
Long-lived IAM user credentials that never rotate. These keys often end up in source code, CI/CD logs, or compromised developer machines.
Rotate keys every 90 days. Migrate to IAM roles for EC2/Lambda/ECS workloads. Use IAM Identity Center for human access. Set up an IAM credential report schedule and automated key rotation via AWS Config rules.
Overly Permissive IAM Policies (Star Actions)
IAM policies containing 'Effect: Allow, Action: *' or 'Resource: *' grant full access to all AWS services, violating the principle of least privilege.
Replace wildcards with specific actions. Use IAM Access Analyzer to identify overly broad policies. Implement permission boundaries and service control policies (SCPs) at the organization level.
Unencrypted EBS Volumes and Snapshots
Elastic Block Store volumes and snapshots without encryption at rest. Shared snapshots can leak data if made public accidentally.
Enable EBS encryption by default in all regions. Use AWS KMS customer-managed keys for sensitive workloads. Audit existing unencrypted volumes and create encrypted copies.
CloudTrail Not Enabled or Misconfigured
AWS CloudTrail disabled in some regions, or configured without log file validation, encryption, or multi-region aggregation.
Create an organization trail covering all regions with SSE-KMS encryption and log file validation enabled. Ship logs to a dedicated S3 bucket with restricted access. Set up CloudWatch alarms for trail changes.
RDS Databases Publicly Accessible
RDS instances with the 'Publicly Accessible' flag set to true, exposing databases directly to the internet.
Set PubliclyAccessible to false. Place RDS instances in private subnets. Use a bastion host or Session Manager for administrative access. Enable RDS encryption and deletion protection.
Missing VPC Flow Logs
VPCs without flow logs enabled, making network traffic analysis and incident investigation impossible.
Enable VPC flow logs on all VPCs. Publish to CloudWatch Logs or S3. Set up metric filters to alert on anomalous traffic patterns (port scans, excessive denied requests).
Default VPC Used in Production
Using the default VPC instead of custom VPCs with proper CIDR planning, subnet design, and network segmentation.
Design custom VPCs with properly sized CIDR blocks, public/private/database subnets across multiple AZs. Migrate resources from default VPCs. Tag custom VPCs clearly.
Unrestricted Lambda Permissions
Lambda execution roles with overly broad permissions, or function policies that allow invocation from any AWS account.
Scope Lambda execution roles to the minimum required actions and resources. Use resource-based policies to restrict cross-account invocation. Enable Lambda code signing and runtime version pinning.
EKS/K8s Clusters with Public Endpoints
EKS cluster API endpoints accessible from the internet without IP restrictions.
Set endpoint access to private-only or public+private with restricted CIDR ranges. Enable control plane logging (API server, audit, authenticator). Enforce pod security standards and network policies.
No AWS Config Rules for Compliance
AWS Config not enabled or configured without compliance rules, leaving configuration drift undetected.
Enable AWS Config in all regions. Deploy managed rules for CIS, PCI-DSS, and custom organizational requirements. Set up automatic remediation actions for common violations.
Unrotated KMS Keys
Customer-managed KMS keys without automatic rotation enabled, increasing exposure window if a key is compromised.
Enable automatic key rotation on all customer-managed KMS keys (rotates annually). For higher security, implement manual rotation every 90 days for highly sensitive data encryption keys.
GuardDuty Not Enabled
Amazon GuardDuty threat detection service not activated in all regions, missing critical threat intelligence.
Enable GuardDuty in all regions supported. Configure findings export to S3. Integrate with Security Hub and EventBridge for automated response to threat findings.
No Backup Strategy for Critical Data
Mission-critical resources (RDS, DynamoDB, EFS, S3) without automated backups or cross-region disaster recovery.
Use AWS Backup to create automated backup plans with cross-region copies. Define recovery point objectives (RPO) and recovery time objectives (RTO). Test restores quarterly.
Hardcoded Secrets in Code or Environment
API keys, database passwords, and access tokens stored in plaintext in code repositories, Lambda env vars, or EC2 user data.
Use AWS Secrets Manager or Parameter Store (SecureString) for all secrets. Implement secret rotation. Scan repositories with tools like git-secrets. Use IAM roles instead of static credentials.
Unused or Orphaned Resources
Unused EBS volumes, elastic IPs, load balancers, and ENIs accumulating costs and creating security blind spots.
Regularly audit resources with AWS Resource Explorer and Trusted Advisor. Tag all resources with owner and project. Implement automated cleanup for non-production resources.
Missing HTTPS on CloudFront Distributions
CloudFront distributions accepting HTTP traffic or using deprecated SSL protocols.
Redirect HTTP to HTTPS. Use the latest TLS security policy. Enable SNI. Configure Origin Shield for additional caching layer. Set minimum SSL protocol to TLSv1.2.
Cross-Account Role Chains Without External ID
Cross-account IAM roles that trust another AWS account without requiring an external ID, vulnerable to confused deputy attacks.
Add sts:ExternalId condition to all cross-account trust policies. Use unique, unguessable external IDs. Audit cross-account roles regularly.
No AWS Organization SCPs
AWS Organizations without Service Control Policies, leaving member accounts free to disable security services.
Apply SCPs that deny disabling CloudTrail, Config, GuardDuty, and Security Hub. Restrict root user actions. Prevent leaving the organization without approval. Start with allow-list approach for new accounts.
Redshift Clusters Not Encrypted or Public
Redshift data warehouse clusters without encryption at rest or publicly accessible.
Enable encryption with KMS. Place clusters in private subnets. Enable audit logging and require SSL connections. Rotate database credentials with Secrets Manager.
Too Many Root Account Actions
Using the AWS root account for day-to-day operations instead of IAM users/roles with appropriate permissions.
Lock away root credentials. Enable MFA on root. Create IAM users with admin permissions for daily tasks. Set up CloudWatch alarms for any root activity. Follow the security best practice of zero standing root usage.
No WAF on Public Endpoints
Public-facing applications (ALB, CloudFront, API Gateway) without AWS WAF protection against common exploits like SQL injection and XSS.
Deploy AWS WAF with managed rules (AWS Core, SQL injection, XSS). Enable rate-based rules for DDoS protection. Configure logging to S3 or CloudWatch. Review and update rules monthly.
Insufficient Network Segmentation
Flat network design where all workloads share the same subnets, allowing lateral movement if one resource is compromised.
Design multi-tier VPC architecture: public subnets for load balancers, private for application, isolated for databases. Use security groups as micro-segmentation. Implement VPC endpoints for AWS service access.
No Incident Response Automation
No automated response to security findings — manual processes lead to slow remediation times.
Set up EventBridge rules to trigger Lambda functions for automated response (e.g., isolate compromised instance, revoke exposed keys, snapshot forensic evidence). Integrate with PagerDuty or Slack for alerts. Document and test runbooks.
Ready to run this automatically?
Pavora scans your entire AWS infrastructure in minutes with a single read-only integration. Start your free audit today.