Skip to content

Misconfiguration Patterns

Common Cloud Misconfiguration Patterns

Cloud misconfigurations are a leading cause of security breaches and compliance violations. This section identifies frequent patterns across IAM, networking, and storage, along with their risks and remediation strategies.

1. IAM Misconfigurations

IAM misconfigurations often stem from overly permissive policies, orphaned roles, or lack of enforcement mechanisms.

Common Patterns

  • Overly Permissive Policies:
    Example: A policy granting s3:PutObject on a bucket without conditions.
    Impact: Unauthorized data ingestion or exposure.
    Fix: Use least-privilege principles and add conditions (e.g., aws:SourceIp or aws:ResourceTag).

  • Unused or Orphaned Roles/Keys:
    Example: A role with no attached policies but still active.
    Impact: Potential for credential misuse or privilege escalation.
    Fix: Regularly audit and decommission unused entities.

  • Lack of MFA Enforcement:
    Example: Admin accounts without multi-factor authentication (MFA).
    Impact: High-risk targets for credential theft.
    Fix: Enforce MFA for privileged accounts via IAM policies.

Example Command: Audit IAM Policies

aws iam get-account-authorization-details --query 'Users[?UserName==`admin`].User.UserName' --output text

2. Networking Misconfigurations

Misconfigured networks expose infrastructure to unauthorized access, data exfiltration, and DDoS attacks.

Common Patterns

  • Public Subnets Without Security Groups:
    Example: A subnet with no associated security group, allowing unrestricted access.
    Impact: Direct exposure to the internet.
    Fix: Assign security groups with strict ingress/egress rules (e.g., allow only specific IPs or ports).

  • Open Ports and Protocols:
    Example: A security group allowing tcp:0-65535 on all IPs.
    Impact: Vulnerability to port scanning and exploitation.
    Fix: Use default deny-all and explicitly allow only required traffic.

  • Misconfigured VPC Flow Logs:
    Example: Flow logs disabled on critical VPCs.
    Impact: Inability to detect lateral movement or unauthorized traffic.
    Fix: Enable flow logs and monitor with tools like AWS CloudWatch or Azure Monitor.

Example Command: Check Security Group Rules

aws ec2 describe-security-groups --query 'SecurityGroups[?GroupName==`public-sg`].Groups[0].IpPermissions' --output json

3. Storage Misconfigurations

Storage misconfigurations often involve insecure access controls, lack of encryption, or improper retention policies.

Common Patterns

  • Publicly Accessible S3 Buckets:
    Example: A bucket with acl:public-read permissions.
    Impact: Data exposure via direct URLs.
    Fix: Use bucket policies with aws:Referer conditions and enable encryption.

  • Unencrypted Data at Rest:
    Example: An S3 bucket without ServerSideEncryption enabled.
    Impact: Data breaches if buckets are compromised.
    Fix: Enforce encryption via bucket policies or object-level encryption.

  • Improper Retention Policies:
    Example: A bucket with no versioning or lifecycle rules.
    None: Risk of accidental deletion or data loss.
    Fix: Implement versioning and lifecycle rules for compliance (e.g., GDPR’s data retention requirements).

Example Command: Audit S3 Bucket Policies

aws s3api get-bucket-policy --bucket my-bucket --query 'Policy' --output json

Key takeaways

  • Regular audits are critical for identifying misconfigurations in IAM, networking, and storage.
  • Least-privilege principles and default deny-all policies mitigate risks.
  • Automation tools (e.g., AWS Config, Azure Security Center) enable continuous compliance monitoring.
  • Encryption and access controls are non-negotiable for protecting sensitive data.
  • Training and awareness reduce human errors in configuration management.