Cloud Security Hardening Checklist

20-point checklist for AWS, Azure, and GCP workloads

1. Identity and Access Management

1.1Enforce MFA on all human accounts (no exceptions for admins)1.2Use short-lived credentials (OIDC federation, workload identity) instead of static keys1.3Audit service account permissions quarterly: remove unused accounts and over-privileged roles1.4Implement least-privilege with resource-scoped roles, not tenant-wide admin

2. Network Security

2.1Deny all inbound by default in NSGs/security groups: allowlist only required ports and sources2.2Segment workloads into separate VPCs/VNets per environment (dev, staging, prod)2.3Enable VPC Flow Logs / NSG Flow Logs and forward to your SIEM2.4Use Private Endpoints / Private Link for all PaaS services (storage, databases, key vaults)

3. Data Protection

3.1Enable encryption at rest with customer-managed keys for sensitive data stores3.2Enforce TLS 1.2+ on all endpoints: disable TLS 1.0/1.1 in load balancers and app services3.3Classify data stores by sensitivity: apply DLP policies to high-sensitivity storage3.4Enable soft delete and versioning on blob/object storage to protect against ransomware

4. Monitoring and Detection

4.1Enable cloud-native threat detection (Defender for Cloud, GuardDuty, Security Command Center)4.2Centralize logs in a SIEM with at least 90-day retention for audit trails4.3Set alerts for high-risk events: root/global admin sign-ins, key vault access, policy changes4.4Run a CSPM tool and review the secure score weekly: track trend, not just current number

5. Workload Security

5.1Scan container images in CI/CD before deployment: block critical CVEs from reaching production5.2Use managed identities / IAM roles for workloads: never embed credentials in code or environment variables5.3Enable runtime protection on VMs and containers (EDR agent or cloud-native equivalent)5.4Review IaC templates (Terraform, Bicep, CloudFormation) with a security linter before apply

protego.me | Cloud Security Hardening Checklist