Cybersecurity glossary
What is Cloud Misconfiguration?
Learn what cloud misconfiguration is, which control-plane settings cause breaches, how it differs from OWASP A05, and how IaC plus CSPM keep accounts from drifting open.
Definition
Cloud misconfiguration is an insecure, incomplete, or drifted setting in a cloud control plane—identity policies, storage ACLs, network exposure, encryption, logging, or tenant isolation—that leaves resources reachable or over-privileged without requiring a software exploit.
Why cloud misconfiguration matters
Most cloud breaches in public write-ups are not 0-days. They are a public snapshot, an access key in a Git repo combined with a wild IAM role, or a database security group that named the internet.
Cloud misconfiguration is that class of failure: the control plane told the truth, and the truth was unsafe. Unlike an application bug, it often exposes all objects in a store or all APIs in an account at once.
How a safe design becomes an open account
A default or tutorial is copied
Public website buckets, allow-all security groups, and AdministratorAccess roles spread through modules.
A console hotfix is not reversed
Someone opens 22/tcp “for an hour.” The group stays attached to the launch template.
New regions and accounts appear
Guardrails were set in the first account only. The sandbox in another org unit has none.
Scanners and attackers enumerate
Public buckets, open ports, and metadata-accessible roles are found without exploiting the app.
The setting is the exploit
Data leaves, ransomware uses the role, or crypto-mining starts on the public compute.
High-frequency cloud misconfigurations
Identity
Action:*, Resource:*, public resource policies, unused access keys, no MFA on humans.
Data
Public buckets, unencrypted disks, snapshots shared to all accounts, backups in the same expose path.
Network
0.0.0.0/0 on SSH, RDP, SQL, Redis, or the Kubernetes API.
Visibility
CloudTrail-style logs off, no flow logs, no object-access logs, no alert owner.
Detecting versus preventing recurrence
| Layer | Catches | Misses |
|---|---|---|
| Org / SCP / Azure Policy | Forbidden settings at creation time | Resources created before the policy existed |
| IaC scanning | Declared public ACLs and wild IAM in PRs | Console edits and unmanaged accounts |
| CSPM on the live API | Drift and forgotten sandboxes | Application logic and unknown-unknown services without rules |
| Penetration tests | Chained impact of a specific finding | The other 200 accounts not in scope |
Cloud misconfiguration checklist
- Turn on organization guardrails: block public storage, require IMDS hardening, deny wide 0.0.0.0/0 on admin ports.
- Encode every account in IaC; treat console changes as incidents until they are imported or reverted.
- Scan both plans and live posture; assign owners and SLAs to high findings.
- Separate data buckets from website buckets; never mix backups with public assets.
- Replace standing admin and access keys with federated humans and workload identity.
- Enable management, storage, and network logs in every region, with immutable retention.
- Cover sandbox and suspended accounts—the forgotten ones are where public IPs live.
- After a fix, add a policy test so the same module cannot merge again.
The practical takeaway
Cloud misconfiguration is an unsafe control-plane setting: identity, storage, network, encryption, or logging. It is the cloud-shaped form of security misconfiguration, and it is how many “sophisticated” breaches actually start.
Prevent it with org policies, find it with CSPM, and freeze the fix in IaC. If a setting can be clicked open, assume it will be—unless the organization policy makes that click fail.
Related security terms
Security Misconfiguration
The broader OWASP A05 category; this page focuses on hyperscaler control planes.
Cloud Security Posture Management (CSPM)
The control that continuously finds live-account misconfigurations.
Public Storage Bucket
One of the highest-impact and most scanned cloud misconfigurations.
Cloud IAM
Wildcard policies and public resource policies are identity misconfigurations.
IaC Security Scanning
Catches the same classes of error in Terraform and Kubernetes YAML before apply.
Frequently asked questions
What is cloud misconfiguration in simple terms?
A cloud switch was left in the unsafe position: public storage, an open admin port, a wildcard IAM role, logging off, or encryption disabled. Attackers use the setting, not a novel bug.
How is this different from security misconfiguration (OWASP A05)?
A05 includes frameworks, servers, and verbose errors. Cloud misconfiguration is the subset that lives in provider APIs: IAM, VPC, object storage, KMS, and account guardrails.
Why is cloud especially prone to this?
Every service is an API with defaults that favor getting started. Copy-pasted modules, console hotfixes, and multi-account sprawl multiply settings faster than review.
Does a CVE scanner find cloud misconfiguration?
Usually not. CVE scanners look at packages. Misconfiguration is about who can reach a resource and with which identity. That is CSPM, IaC policy, and architecture review.
What is configuration drift?
Live resources no longer match the IaC or baseline. A console “temporary” public ACL or extra security-group rule is drift until it is reconciled or deleted.
Is “private” the same as “safe”?
No. A private bucket with Principal:* from another account, or a private VM with an instance role of AdministratorAccess, is still misconfigured.
Where should fixes land?
In IaC and organization policies so the mistake cannot be re-clicked. Console-only remediations return with the next incident.
References
Explore authoritative guidance and frameworks related to cloud misconfiguration.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.