Cloud Misconfigurations

What it is

Cloud misconfigurations expose resources through incorrect access, network, or service settings. Examples include public storage, overly broad roles, and management interfaces accessible beyond their intended users. This is not necessarily a flaw in the cloud provider: security responsibilities are shared, and customers control many settings that determine access to their data.

How it works

A sharing toggle, permissive policy, or unused credential opens a path to records or operations. Internet scanning or a leaked link can reveal the exposure. Multiple layers may interact: a public endpoint can still require authorization, while a private-looking resource may be accessible through an overly broad identity.

How people get tricked

Convenient settings used during development remain in production. Teams assume 'hosted in the cloud' means automatically private, or believe an obscure resource name is an access control.

Example scenario

A storage policy allows anonymous reads of customer documents. No password guessing is needed because the configured policy explicitly permits the requests.

Warning signs

• Resources or records are reachable without the intended authorization.
• Configuration scanners flag public access or excessive permissions.
• Audit logs show unexpected identities, regions, or download volume.

If it happens to you

Restrict the exposure, preserve logs, and determine which records or operations were accessible and actually used. Rotate compromised secrets and assess notification obligations. Check related resources created from the same configuration template so the same gap does not remain elsewhere.