Cloud misconfiguration

The recurring classes are well known. Storage exposure: an S3 bucket policy with Principal "*", an ACL granting AllUsers, anonymous blob access in Azure Storage, or a Google Cloud Storage binding to allUsers or allAuthenticatedUsers (the latter means any Google account at all, not "our users", a classic misreading). Network exposure: security groups allowing 0.0.0.0/0 on SSH, RDP or database ports, managed databases with public endpoints, Kubernetes API servers or dashboards open to the internet. Identity: wildcard IAM policies, routine use of the root account, long-lived access keys. Visibility: audit logging, storage access logs or flow logs switched off. OWASP files the web-facing variant under A02:2025 Security Misconfiguration, and MITRE ATT&CK describes exploitation as T1530 Data from Cloud Storage.

Misconfiguration is so common because the control plane lets many principals change security-relevant state in seconds, defaults differ between services, and live state drifts from the infrastructure-as-code that supposedly defines it through console changes and emergency fixes that are never reverted. Providers have tightened defaults: S3 Block Public Access arrived in 2018, and since April 2023 new buckets have Block Public Access enabled and ACLs disabled by default. The 2019 Capital One breach illustrates how misconfigurations chain: a misconfigured web application firewall on EC2 allowed SSRF against the instance metadata service (IMDSv1), which returned credentials for a role broad enough to list and copy S3 data on roughly 100 million people. IMDSv2, with a session token obtained by PUT, was released later that year as a direct countermeasure.

Prevention works at three points. Before deployment, policy-as-code scanners such as Checkov, Trivy or OPA/Conftest check Terraform and Kubernetes manifests in the pipeline. At the organisation level, preventive guardrails block classes of error outright: AWS service control policies, Azure Policy with the deny effect, Google Cloud organisation policy constraints such as storage.publicAccessPrevention. At runtime, cloud security posture management (AWS Config and Security Hub, Microsoft Defender for Cloud, Google Security Command Center, or third-party CSPM) continuously evaluates live resources against the CIS Foundations Benchmarks and flags drift.

A misconfiguration is not a CVE: there is no vendor patch, because the software works as designed and the weakness lies on the customer's side of the shared responsibility model. When personal data has been exposed, GDPR treats this as a personal data breach under Art. 4(12) even without proof of access, and Art. 33(1) requires notification to Datatilsynet within 72 hours unless the breach is unlikely to result in a risk. If access logging was disabled, the controller usually cannot demonstrate that nobody downloaded the data, which pushes the assessment towards notification.