Cloud Security · AWS · Azure · GCP

Cloud Security Research

Cloud attack surface reference: common misconfigurations by provider, IAM privilege escalation paths, MITRE ATT&CK for Cloud technique coverage and defensive architecture patterns.

MITRE ATT&CK Cloud ↗·Pacu (AWS pentest) ↗·Cloud Security Wiki ↗

Common Misconfigurations by Cloud Provider

AWS— top misconfigurations

Severity	Misconfiguration	Impact	Fix
Critical	Public S3 bucket with sensitive data	Data exfiltration. PII, credentials, backups exposed.	Block public access at account level (S3 account-level block). Enable S3 Access Analyzer.
Critical	IMDSv1 enabled (no hop limit)	SSRF attacks can steal EC2 instance credentials from metadata service.	Enforce IMDSv2 with hop-limit=1 via Launch Template or instance metadata options.
High	Overly permissive IAM role (wildcards)	Privilege escalation via any compromised workload with this role.	Apply least privilege. Use IAM Access Analyzer to generate least-privilege policies from access logs.
High	No CloudTrail in all regions	Attacker activity in non-monitored regions goes undetected.	Enable CloudTrail as multi-region trail with S3 encryption and log file validation.
High	Security group 0.0.0.0/0 on port 22/3389	Brute force and credential stuffing against admin services.	Restrict SSH/RDP to VPN CIDR or use AWS Systems Manager Session Manager (no open ports).
Medium	No MFA on root account	Root account takeover gives full account control.	Enable MFA on root account. Delete root access keys. Use dedicated admin IAM users.

Azure— top misconfigurations

Severity	Misconfiguration	Impact	Fix
Critical	Blob storage with public access enabled	Data exfiltration from publicly readable blobs.	Disable 'Allow Blob Public Access' at storage account level in Azure Policy.
Critical	Guest user in Azure AD with high permissions	External attacker leverages guest invite chain to access tenant resources.	Restrict external collaboration settings. Audit guest user assignments in privileged roles.
High	No Conditional Access policies for Azure AD	Credential theft enables unrestricted access from any location/device.	Require MFA for all users. Enforce Compliant Device policy for admin access.
High	Service Principal with subscription Owner role	Compromised SP token grants full subscription control.	Scope service principals to minimum required resource scope. Rotate credentials regularly.
High	Legacy authentication protocols enabled	Basic Auth and SMTP/POP3/IMAP bypass Conditional Access and MFA.	Block legacy authentication via Conditional Access policy. Use Sign-in logs to identify usage first.

GCP— top misconfigurations

Severity	Misconfiguration	Impact	Fix
Critical	Default service account with Editor role	Any compromised GCE VM has project-wide Editor permissions.	Use custom service accounts per workload with minimum required IAM bindings.
High	Org Policy not restricting external service account keys	Long-lived SA keys exfiltrated and used for persistent access.	Org Policy: iam.disableServiceAccountKeyCreation. Use Workload Identity Federation instead.
High	GCS bucket with allUsers or allAuthenticatedUsers	Public data exposure or any Google-authenticated user can access.	Remove allUsers/allAuthenticatedUsers bindings. Use VPC Service Controls for sensitive buckets.
Medium	No Cloud Audit Logs for Data Access	Data access activity not logged — exfiltration goes undetected.	Enable Data Access audit logs for GCS, BigQuery and other data services in Audit Log Config.

IAM Privilege Escalation Paths

Cloud	Permission / Path	Technique	Outcome
AWS	iam:CreatePolicyVersion	Create new default policy version with admin permissions on existing policy	Full admin if policy attached to any principal
AWS	iam:PassRole + ec2:RunInstances	Launch EC2 instance with a more-privileged IAM role than attacker has directly	Assume escalated role via instance metadata
AWS	iam:CreateAccessKey	Create access key for another user (including admin user)	Persistent credential for target IAM user
AWS	lambda:CreateFunction + lambda:InvokeFunction	Create Lambda with highly privileged role, invoke to run arbitrary code	Arbitrary execution in context of target role
Azure	Microsoft.Authorization/roleAssignments/write	Assign Owner/Contributor role to attacker-controlled identity	Full subscription or resource group control
Azure	App Registration with admin consent	Create App Registration, grant admin consent to MS Graph API permissions	Graph API access as application with tenant-wide permissions
GCP	iam.serviceAccounts.actAs	Impersonate service account with higher permissions via service account token	All permissions of the target service account
GCP	cloudfunctions.functions.create + resourcemanager.projects.setIamPolicy	Deploy Cloud Function with privileged SA, use it to modify IAM policy	Arbitrary IAM modification at project level

CI/CD Supply Chain Attacks Targeting Cloud Credentials

GhostAction (Oct 2026)

Stolen maintainer credentials used to commit a malicious "security-audit.yml" GitHub Actions workflow — triggers on any push with no filters, then exfiltrates CI/CD secrets by name and sweeps full git history (git log -p --all) for previously-committed AWS keys, Anthropic/OpenAI/OpenRouter API keys, GitHub/GitLab PATs and SaaS tokens. 500+ accounts, tens of thousands of repos affected since Oct 7, including Uber's athenadriver and kitao/pyxel.

Defense: Rotate every exposed credential immediately, scan full git history (not just HEAD) for committed secrets, remove the workflow file and revert the commit, enforce phishing-resistant MFA on maintainer accounts, enable GitHub secret scanning with push protection, and block C2 IP 193.32.204.199.