CloudSecOps

CloudSecOps (cloud security operations) is the continuous work of keeping a cloud estate secure through the provider’s own control plane: guardrails that stop unsafe configuration before it exists, posture checks that find drift, audit logs that record every administrative action, and detection and response for suspicious control-plane activity.

For cloud security and platform engineers, security architects, SOC leads, and leaders who decide what to enforce. Facts last checked 2026-10-17.

In the cloud, a bucket becomes public, a key is created or a log is switched off with one API call by anyone holding the right permission, including an attacker holding someone else’s. Three patterns recur:

• Configuration. The Cloud Security Alliance’s 2024 Top Threats ranking, built from a poll of more than 500 industry experts, put misconfiguration and inadequate change control first and identity and access management second.^[4] It is an expert ranking, not incident data.
• Credentials. Mandiant traced every incident it handled in the 2024 Snowflake customer campaign “back to compromised customer credentials”, on accounts without multi-factor authentication.^[5]
• Missing logs. In the 2023 Exchange Online intrusion reviewed by the US Cyber Safety Review Board, one victim agency “could not view past activity as these logs only captured data from the time that Microsoft enabled the advanced logging”.^[6]

• Not SecOps with a cloud connector. In this Atlas, SecOps is the collaboration hub between security and IT operations and governs hardening baselines; SOC Ops runs triage. CloudSecOps supplies them with cloud-specific controls, telemetry and runbooks.
• Not DevSecOps. DevSecOps catches misconfigurations in the pull request; CloudSecOps owns the deployed state, including changes made outside the pipeline.
• Not CloudOps. CloudOps owns the account structure, operational guardrails (Regions, tags, budgets) and teaches the shared responsibility model; CloudSecOps decides which security guardrails to enforce and watches them drift.
• Not identity engineering. How policies are written and evaluated → IAMOps; accounts and SSO → IdentityOps; just-in-time elevation → AccessOps.
• Not a product, not compliance. A posture tool gives findings, not owners or fixes; audit programmes belong to ComplianceOps, and CloudSecOps produces their evidence.

No founding document exists. These dated milestones can be verified:

The mental model: four questions at the API. Every cloud action is an authenticated API call. CloudSecOps keeps four answers current: who can call (the identity perimeter), what they may configure (preventive guardrails), what the estate looks like now (posture), and what happened (logs and detections). A perfect posture score says nothing about an attacker using valid keys. This model is this Atlas’s teaching device, not an industry framework.

This charter is this Atlas’s proposal; no official CloudSecOps manifesto exists.

Mission: make unsafe cloud configuration hard to create, quick to find and hard to hide.

1. Prevent centrally what must never happen; detect the rest. Organisation-level denies for a short list of catastrophic actions, detective checks for everything that has legitimate exceptions.
2. Every guardrail has an owner, a test, an exception path and a measurement. A rule without an exception path creates shadow accounts.
3. Collect logs before you need them, where workload administrators cannot change them.
4. Identity is the perimeter. Long-lived keys are debt with interest; federated, short-lived credentials are the default.
5. Know each control’s preconditions. Name the accounts, Regions and principals a control does not cover.
6. Fix in code. The next deployment reverts a console fix; remediate in the infrastructure as code (InfraOps).

Non-goals: writing application code, running the SOC, designing permission models for each workload.

CloudOps teaches the shared responsibility model; this table applies Microsoft’s matrix to security controls.^[18]

The building blocks follow the four questions: an identity perimeter of federated, short-lived credentials (designed in IAMOps and IdentityOps); preventive guardrails such as AWS SCPs, RCPs and declarative policies, Azure Policy deny and Google Organization Policy constraints;^{[13][14][19][20][21]} detective posture, including analysis of resources shared outside a “zone of trust”;^[22] and audit logs with detections. Keys and encryption cut across all four.

Defaults decide where the work starts (as of October 2026):

If identity is the perimeter, the identity row matters most, and Entra retention is not retroactive: after an upgrade from Free, “only data still within the free retention period (up to seven days) is available”.^[27]

Two other defaults matter. On AWS, instances accept both IMDSv1 and IMDSv2 unless a newer default requires IMDSv2.^[15][29] On Google Cloud, organisations created on or after 3 May 2024 start with baseline constraints such as disabled service-account key creation and uniform bucket-level access; older organisations may not have them.^[30]

Most services encrypt at rest by default, so the work is deciding who controls each key and who may use it. AWS owned keys cost nothing, but “you cannot change their policies, you cannot audit activities on these keys, and you cannot delete them”; customer managed keys give “full control over the lifecycle and usage” for a monthly fee.^[31] Azure and Google Cloud call these customer-managed keys (CMK, CMEK). Pay for one when you must see every use in your own logs, decide who may use it, or make data unreadable by disabling it. Three controls then matter more than rotation:

• Separate administering from using. AWS’s default key policy lets key administrators manage a key but not use it; because they can edit the policy, they “can give themselves and others” more access, so treat key administration as privileged.^[32]
• Guard deletion. Deleting a KMS key “is destructive and potentially dangerous”: the data it protects “becomes unrecoverable”, so each provider adds a delay. AWS KMS waits 7–30 days (default 30);^[33] AWS’s sample SCPs reserve kms:ScheduleKeyDeletion for a privileged role or forbid waiting periods under 30 days.^[34] Azure Key Vault keeps deleted keys recoverable for 7–90 days; add purge protection, which services such as Azure Storage require.^[35] Cloud KMS waits 30 days by default, and an organisation policy can enforce a minimum.^[36]
• Keep key-use logs. CloudTrail logs all AWS KMS actions by default, but a trail can exclude them all to cut volume;^[37] never exclude them from the trail covering accounts that hold sensitive data.

Secrets belong in the provider’s secret store (AWS Secrets Manager, Azure Key Vault, Google Secret Manager), never in code or instance user data; how pipelines fetch them belongs to DevSecOps.

Microsoft’s Cloud Adoption Framework describes posture management as “the operational security team that focuses on security enablement for technical operations teams”.^[38] The RACI below is this Atlas’s proposal (R = responsible, A = accountable, C = consulted, I = informed).

Skills: IAM evaluation logic, policy as code, logging architecture, audit-log queries, incident handling. Small organisations combine these roles (see When to use).

• Day 0, design. Pick a baseline (a CIS Foundations benchmark or the provider’s), list the few actions to deny everywhere, design the log archive and its retention, decide the exception process.
• Day 1, roll out. Turn on organisation-wide logging and posture scanning first, then trial guardrails, then enforce OU by OU. Azure’s DoNotEnforce mode exists “when you want to evaluate the policy assignment before enforcement”,^[39] and Google supports dry-run organisation policies.^[21] AWS SCPs and RCPs have no documented evaluate-only mode, so on AWS the trial is a test OU and a review of its access-denied events.^[13]
• Day 2, run. The cadences below.

Release guardrails like software, from a test OU to ever broader OUs; CloudOps teaches that staged rollout.^[34] Exceptions use the exception request, capped at 90 days (this page’s suggestion).

CloudOps shows the landing zone; this view adds the security layers in AWS terms, and the table after it gives the Azure and Google Cloud counterparts.

flowchart TB
  MGMT["Management account: no workloads, outside SCPs and RCPs"] -->|"attaches"| POL
  POL["Organisation policies: SCP, RCP, declarative"]
  POL --> MEM["Member accounts: workloads and sandboxes"]
  MEM -->|"organisation trail"| LOG["Log archive account"]
  MEM -->|"findings"| SEC["Security tooling account"]
  LOG --> SIEM["Query store or SIEM"]
  SEC --> TRI["Triage queue"]
  TRI -->|"misconfiguration"| OWN["Workload owner: fix in IaC"]
  TRI -->|"threat"| SOC["SOC: incident"]
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  class POL,LOG,SEC,TRI core
  class MEM,SIEM,OWN,SOC neutral
  class MGMT risk

Design choices, with their evidence:

• Keep the management account empty. “SCPs don’t affect users or roles in the management account”, nor RCPs its resources.^[13][14]
• Log through the organisation. Member-account users “do not have sufficient permissions to delete organization trails, turn logging on or off, change what types of events are logged”.^[40] Only the security team administers the archive account.
• Cover every enabled Region. Security Hub CSPM “only receives and processes findings in the Region where you enabled” it, and AWS recommends enabling GuardDuty “in all AWS Regions”, including ones you do not use, because attackers can create resources there.^[41][42]

flowchart TB
  CHG["Change: pipeline, console, script or attacker"] --> PRE{"Preventive guardrail matches?"}
  PRE -->|"yes"| DENY["Call denied and logged"]
  DENY --> EXC{"Legitimate need?"}
  EXC -->|"yes"| REQ["Exception request: owner, reason, expiry"]
  EXC -->|"no"| STOP["Requester changes the design"]
  PRE -->|"no"| RES["Resource created or changed"]
  RES --> SCAN["Posture scan or detection"]
  SCAN --> TRI{"Finding type?"}
  TRI -->|"misconfiguration"| FIX["Owner fixes in IaC within SLA"]
  TRI -->|"suspicious activity"| INC["SOC incident and runbook"]
  FIX --> VER["Rescan confirms closure"]
  FIX -->|"SLA missed"| ESC["Escalate, or exception with expiry"]
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  class CHG,RES,SCAN,FIX,VER,REQ core
  class PRE,EXC,TRI decision
  class DENY,INC,ESC,STOP risk

Acceptance criteria (this page’s suggestion): every finding has an owner within one working day, and every closure is confirmed by a rescan, not a ticket comment.

Separate what binds you from what guides you:

Tools lag benchmarks. CIS lists AWS Foundations 7.1.0 as current,^[43] while Security Hub CSPM “supports CIS AWS Foundations Benchmark versions 5.0.0, 3.0.0, 1.4.0, and 1.2.0” and leaves some requirements, such as metric-filter alarms, as manual checks.^[49] A green dashboard means passes the automated subset of an earlier version; record the version.

This page maps the most consequential recurring mistakes to Security Hub CSPM control IDs and to a preventive option (AWS, as of October 2026).^[50]

Native tools now cross providers (as of October 2026). AWS runs two services. Security Hub CSPM, cited throughout this page, also scores Azure against CIS Azure Foundations v4.0 (CIS lists 6.0.0). The newer AWS Security Hub correlates CSPM, Inspector, Macie and GuardDuty findings into exposure findings with an attack path graph, in OCSF (Open Cybersecurity Schema Framework). AWS recommends enabling both.^[53][57]

Selection criteria: coverage of the benchmark version you need; organisation-wide and cross-Region aggregation; export in an open format (Prowler writes CSV and JSON-OCSF by default; its SARIF output, a static-analysis format, is for IaC scans only);^[58] routing to owners rather than to one security queue; cost model (per check, per resource, per role); and an exit plan if the vendor changes hands.

Automate prevention freely and remediation carefully: only what is reversible, high-confidence and narrow, such as re-enabling a public access block on a bucket tagged as private; never auto-delete data or rotate credentials in use. Azure Policy’s modify and deployIfNotExists effects remediate inside the platform;^[20] elsewhere, run automation as a dedicated, logged role. Language models can summarise findings and draft runbook steps, but their suggestions are changes that need review; see AIOps for Security.

Assumptions: an AWS organisation with all features enabled, a security tooling account, a log archive account, policies kept in Git and deployed by a pipeline role. The worked artefacts are AWS-first: for Azure and Google Cloud, item 3 gives the storage equivalent and the layer table names the policy and log mechanisms, without worked examples.

1. A service control policy that protects security telemetry. Adapted from AWS’s samples: member accounts cannot leave the organisation, stop or narrow audit and posture recording, disable detectors, or suppress findings (archive rules, filters, trusted-IP lists, or setting a Security Hub CSPM finding to SUPPRESSED), and only the deployer can alter the two exempt roles.^[34][59] IAMOps teaches how such policies are written; its example protects the trail and access keys, while this one covers posture, detection and the break-glass path.

Example status: JSON syntax-checked by the validator; not executed (requires an AWS organisation). Action names and the Security Hub condition key checked against AWS’s machine-readable service reference on 2026-10-17.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLeaveOrganization",
      "Effect": "Deny",
      "Action": "organizations:LeaveOrganization",
      "Resource": "*"
    },
    {
      "Sid": "ProtectAuditAndPosture",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:DeleteTrail",
        "cloudtrail:StopLogging",
        "cloudtrail:UpdateTrail",
        "cloudtrail:PutEventSelectors",
        "config:StopConfigurationRecorder",
        "config:DeleteConfigurationRecorder",
        "config:PutConfigurationRecorder",
        "config:DeleteDeliveryChannel",
        "config:PutDeliveryChannel",
        "securityhub:DisableSecurityHub",
        "securityhub:BatchDisableStandards",
        "securityhub:UpdateStandardsControl",
        "securityhub:BatchUpdateStandardsControlAssociations",
        "securityhub:DisassociateFromAdministratorAccount",
        "securityhub:DisassociateFromMasterAccount",
        "access-analyzer:DeleteAnalyzer",
        "access-analyzer:CreateArchiveRule",
        "access-analyzer:UpdateArchiveRule",
        "access-analyzer:ApplyArchiveRule",
        "access-analyzer:UpdateFindings"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": [
            "arn:aws:iam::*:role/security-breakglass",
            "arn:aws:iam::*:role/org-baseline-deployer"
          ]
        }
      }
    },
    {
      "Sid": "DenyFindingSuppression",
      "Effect": "Deny",
      "Action": "securityhub:BatchUpdateFindings",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "securityhub:ASFFSyntaxPath/Workflow.Status": "SUPPRESSED"
        },
        "ArnNotLike": {
          "aws:PrincipalARN": [
            "arn:aws:iam::*:role/security-breakglass",
            "arn:aws:iam::*:role/org-baseline-deployer"
          ]
        }
      }
    },
    {
      "Sid": "ProtectThreatDetection",
      "Effect": "Deny",
      "Action": [
        "guardduty:DeleteDetector",
        "guardduty:UpdateDetector",
        "guardduty:DisassociateFromAdministratorAccount",
        "guardduty:DisassociateFromMasterAccount",
        "guardduty:ArchiveFindings",
        "guardduty:CreateFilter",
        "guardduty:UpdateFilter",
        "guardduty:CreateIPSet",
        "guardduty:UpdateIPSet",
        "guardduty:CreateTrustedEntitySet",
        "guardduty:UpdateTrustedEntitySet"
      ],
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": [
            "arn:aws:iam::*:role/security-breakglass",
            "arn:aws:iam::*:role/org-baseline-deployer"
          ]
        }
      }
    },
    {
      "Sid": "ProtectExemptRoles",
      "Effect": "Deny",
      "Action": [
        "iam:CreateRole",
        "iam:DeleteRole",
        "iam:UpdateRole",
        "iam:UpdateAssumeRolePolicy",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:PutRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:PutRolePermissionsBoundary",
        "iam:DeleteRolePermissionsBoundary",
        "iam:TagRole",
        "iam:UntagRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/security-breakglass",
        "arn:aws:iam::*:role/org-baseline-deployer"
      ],
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalARN": "arn:aws:iam::*:role/org-baseline-deployer"
        }
      }
    }
  ]
}

Preconditions and limits:

• Scope. It binds only member accounts, and not service-linked roles.^[13] It does not cover Macie, Inspector, the EventBridge rules behind your detections, or the log archive’s key and bucket.
• Exempt roles. Each exemption matches a role name in any account, so both names are protected: create the roles while vending an account, before it joins a governed OU, and alert on every use.
• A second layer. Member accounts cannot change an organisation trail anyway,^[40] so the CloudTrail actions protect account-level trails. Manage GuardDuty and Security Hub CSPM through Organizations, where only the administrator manages GuardDuty’s lists and central configuration stops centrally managed accounts from disabling standards or controls.^[60][61]
• Finding suppression. DenyFindingSuppression closes the scoring trap under Metrics: a member account “can update findings only for their own account”. AWS documents this deny as an IAM policy, so validate it as an SCP (Lab 2, step 1) before attaching.^[59]

2. A resource control policy that requires TLS. A shortened version of AWS’s sample “Restrict access to only HTTPS connections to your resources” (the sample covers more services).^[16] RCPs apply to a listed subset of services and not to resources in the management account.^[14]

Example status: JSON syntax-checked; not executed.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EnforceSecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": ["s3:*", "sts:*", "kms:*", "sqs:*", "secretsmanager:*"],
      "Resource": "*",
      "Condition": {
        "BoolIfExists": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

3. The same intent on Google Cloud: prevent public Cloud Storage access across the organisation. When enforced, “no one can make data in applicable buckets public through IAM policies or ACLs”; existing public grants stay in place but are overridden.^[62]

Example status: YAML syntax-checked; not executed. Replace the organisation ID.

name: organizations/123456789012/policies/storage.publicAccessPrevention
spec:
  rules:
    - enforce: true

Apply it with gcloud org-policies set-policy policy.yaml; the same command accepts a dry-run specification for testing first.^[21] On Azure, assign a deny policy for the same intent with enforcementMode set to DoNotEnforce, review compliance, then switch to Default.^[39]

4. Validate before you attach. IAM Access Analyzer validates SCPs and RCPs against grammar and best practice and returns ERROR, SECURITY_WARNING, WARNING and SUGGESTION findings.^[63] Make an empty ERROR and SECURITY_WARNING list a pipeline gate.

Lab 1 runs anywhere with Python and was executed. Labs 2 and 3 need an AWS organisation and were not executed; their expected outputs come from the cited documentation.

Objective: learn how layered public-access settings combine, why a “fixed value” condition matters, and why exceptions need expiry dates. Prerequisites: Python 3.8 or later; no cloud account, cost or risk; 40 minutes.

The script is a teaching approximation of the Amazon S3 rules for what counts as “public”:^[64] a statement that allows Principal: "*" is public unless a listed condition key has a fixed value, and an aws:SourceIp range broader than /8 still counts as public. It treats negated operators (StringNotEquals, NotIpAddress) as not narrowing, and ignores aws:userid, access points and the ForAnyValue/ForAllValues set operators. Use IAM Access Analyzer or S3’s own policy status for real decisions.

1. Save the three files below as exposure_check.py, inventory.json and exceptions.json.
2. Run python3 exposure_check.py inventory.json exceptions.json 2026-10-16, then echo $?.
3. In inventory.json, set the account’s IgnorePublicAcls to false and run again.
4. Restore it, set "org_bpa": {"enforced": true} and run again. Ask what happens to marketing-site, which serves a website.

Example status: verified by execution (Python 3.8.10, 2026-10-16; re-run after the r1 change, 2026-10-17); outputs below are verbatim.

"""Teaching approximation of S3 public-exposure evaluation (not a replacement
for IAM Access Analyzer or S3's own policy-status check)."""
import ipaddress
import json
import sys
from datetime import date

FIXED_KEYS = {  # condition keys that can make a policy non-public (AWS S3 docs)
    "aws:principalorgid", "aws:sourceip", "aws:sourcearn", "aws:sourcevpc",
    "aws:sourcevpce", "aws:sourceowner", "aws:sourceaccount",
    "s3:dataaccesspointarn", "s3:dataaccesspointaccount",
}
BPA = ["BlockPublicAcls", "IgnorePublicAcls", "BlockPublicPolicy",
       "RestrictPublicBuckets"]
PUBLIC_GROUPS = ("AllUsers", "AuthenticatedUsers")


def effective_bpa(org, account, bucket):
    """Most restrictive combination: a setting is on if any level turns it on."""
    org_all = org.get("enforced", False)  # org level is all-or-nothing
    return {k: org_all or account.get(k, False) or bucket.get(k, False) for k in BPA}


def is_fixed(value):
    values = value if isinstance(value, list) else [value]
    return all(isinstance(v, str) and not any(c in v for c in "*?$") for v in values)


RFC1918 = [ipaddress.ip_network(n) for n in
           ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]


def too_broad(cidrs):
    """Broader than /8 (IPv4) or /32 (IPv6), RFC 1918 ranges excepted."""
    cidrs = cidrs if isinstance(cidrs, list) else [cidrs]
    for c in cidrs:
        net = ipaddress.ip_network(c, strict=False)
        if net.version == 4 and any(net.subnet_of(p) for p in RFC1918):
            continue
        if net.prefixlen < (8 if net.version == 4 else 32):
            return True
    return False


def statement_is_public(stmt):
    if stmt.get("Effect") != "Allow":
        return False
    principal = stmt.get("Principal")
    if isinstance(principal, dict):
        principal = principal.get("AWS")
    principals = principal if isinstance(principal, list) else [principal]
    if "*" not in principals:
        return False
    for op_name, operator in stmt.get("Condition", {}).items():
        if "Not" in op_name:  # negated operators never narrow a grant
            continue
        for key, value in operator.items():
            if key.lower() not in FIXED_KEYS or not is_fixed(value):
                continue
            if key.lower() == "aws:sourceip" and too_broad(value):
                continue
            return False  # one fixed-value key narrows the grant
    return True


def assess(bucket, org, account):
    bpa = effective_bpa(org, account, bucket.get("bpa", {}))
    stmts = bucket.get("policy", {}).get("Statement", [])
    policy_public = any(statement_is_public(s) for s in stmts)
    acl_public = any(g in PUBLIC_GROUPS for g in bucket.get("acl_grantees", []))
    exposed = []
    if policy_public and not bpa["RestrictPublicBuckets"]:
        exposed.append("bucket policy")
    if acl_public and not bpa["IgnorePublicAcls"]:
        exposed.append("ACL")
    return exposed, bpa


def main(inventory_path, exceptions_path, today):
    inv = json.load(open(inventory_path))
    exceptions = {e["bucket"]: e for e in json.load(open(exceptions_path))}
    failures = 0
    for b in inv["buckets"]:
        exposed, _ = assess(b, inv.get("org_bpa", {}), inv.get("account_bpa", {}))
        exc = exceptions.get(b["name"])
        if not exposed:
            status = "OK"
        elif exc and date.fromisoformat(exc["expires"]) >= today:
            status = f"PUBLIC, excepted to {exc['expires']} ({exc['owner']})"
        elif exc:
            status = f"PUBLIC, exception EXPIRED {exc['expires']}"
            failures += 1
        else:
            status = "PUBLIC, no exception"
            failures += 1
        via = f" via {', '.join(exposed)}" if exposed else ""
        print(f"{b['name']:<18} {status}{via}")
    print(f"summary: {len(inv['buckets'])} buckets, {failures} need action")
    return 1 if failures else 0


if __name__ == "__main__":
    as_of = date.fromisoformat(sys.argv[3]) if len(sys.argv) > 3 else date.today()
    sys.exit(main(sys.argv[1], sys.argv[2], as_of))

{
  "org_bpa": {"enforced": false},
  "account_bpa": {"BlockPublicAcls": true, "IgnorePublicAcls": true},
  "buckets": [
    {"name": "app-logs-prod",
     "policy": {"Statement": [{"Effect": "Allow",
       "Principal": {"Service": "logging.s3.amazonaws.com"},
       "Action": "s3:PutObject", "Resource": "*"}]}},
    {"name": "partner-drop",
     "policy": {"Statement": [{"Effect": "Allow", "Principal": "*",
       "Action": "s3:GetObject", "Resource": "*",
       "Condition": {"StringEquals": {"aws:PrincipalOrgID": "o-exampleorg1"}}}]}},
    {"name": "marketing-site",
     "policy": {"Statement": [{"Effect": "Allow", "Principal": "*",
       "Action": "s3:GetObject", "Resource": "*"}]}},
    {"name": "legacy-exports",
     "acl_grantees": ["AllUsers"],
     "policy": {"Statement": [{"Effect": "Allow", "Principal": {"AWS": "*"},
       "Action": "s3:GetObject", "Resource": "*",
       "Condition": {"IpAddress": {"aws:SourceIp": "0.0.0.0/1"}}}]}},
    {"name": "data-science-tmp",
     "bpa": {"RestrictPublicBuckets": true},
     "policy": {"Statement": [{"Effect": "Allow", "Principal": "*",
       "Action": "s3:GetObject", "Resource": "*"}]}}
  ]
}

[
  {"bucket": "marketing-site", "owner": "web-team", "reason": "static site",
   "expires": "2026-12-31"},
  {"bucket": "legacy-exports", "owner": "finance-it", "reason": "vendor migration",
   "expires": "2026-09-30"}
]

Expected output (step 2), exit code 1:

app-logs-prod      OK
partner-drop       OK
marketing-site     PUBLIC, excepted to 2026-12-31 (web-team) via bucket policy
legacy-exports     PUBLIC, exception EXPIRED 2026-09-30 via bucket policy
data-science-tmp   OK
summary: 5 buckets, 1 need action

Validation. Step 3 changes one line to legacy-exports PUBLIC, exception EXPIRED 2026-09-30 via bucket policy, ACL (exit code 1): with IgnorePublicAcls off, the public ACL counts again. Step 4 prints OK for all five buckets and summary: 5 buckets, 0 need action (exit code 0), because the organisation level applies all four settings together.^[64] What to notice: partner-drop is not public because its condition uses a fixed aws:PrincipalOrgID; legacy-exports is public because 0.0.0.0/1 is broader than /8; data-science-tmp relies on a bucket setting that its editors could remove. In step 4 the website stops serving the public, the trade-off examined in A judgement call. Troubleshooting: JSONDecodeError usually means a trailing comma; AttributeError: … subnet_of means Python older than 3.7. Teardown: delete the three files.

Objective: release the reference SCP and RCP to one test OU and prove they work.^[65] Prerequisites:

• an AWS organisation with all features;
• a pipeline role limited to Organizations policy actions, or a member account made a delegated administrator for policies, not management-account administrator credentials;^[66]
• a test OU with one sandbox account holding a test role, an account-level trail named sandbox-trail and a bucket with one throw-away object.

Cost and risk: negligible cost; a wrong attachment can lock users out, so attach only to the test OU.^[13] Time: 60 minutes.

Example status: syntax-checked; not executed (no AWS organisation available). IDs such as r-exam and ou-exam-test1234 are placeholders.

# 1. Validate both policies (expect no ERROR or SECURITY_WARNING findings).
aws accessanalyzer validate-policy --policy-type SERVICE_CONTROL_POLICY \
  --policy-document file://scp-protect.json
aws accessanalyzer validate-policy --policy-type RESOURCE_CONTROL_POLICY \
  --policy-document file://rcp-tls.json

# 2. Enable RCPs once for the organisation root.
aws organizations enable-policy-type --root-id r-exam \
  --policy-type RESOURCE_CONTROL_POLICY

# 3. Create the policies and attach them to the test OU only.
SCP_ID=$(aws organizations create-policy --type SERVICE_CONTROL_POLICY \
  --name protect-security-telemetry --description "Lab 2 SCP" \
  --content file://scp-protect.json --query Policy.PolicySummary.Id --output text)
RCP_ID=$(aws organizations create-policy --type RESOURCE_CONTROL_POLICY \
  --name require-tls --description "Lab 2 RCP" \
  --content file://rcp-tls.json --query Policy.PolicySummary.Id --output text)
aws organizations attach-policy --policy-id "$SCP_ID" --target-id ou-exam-test1234
aws organizations attach-policy --policy-id "$RCP_ID" --target-id ou-exam-test1234

# 4. From the sandbox account's test role: both calls should be denied.
#    The second sends a signed request over plain HTTP on purpose; use the
#    bucket's own Region in the endpoint URL.
aws cloudtrail stop-logging --name sandbox-trail
aws s3api get-object --bucket example-lab-bucket --key test.txt out.txt \
  --endpoint-url http://s3.eu-west-1.amazonaws.com

# 5. Confirm the trail is still logging and HTTPS access still works.
aws cloudtrail get-trail-status --name sandbox-trail --query IsLogging
aws s3api get-object --bucket example-lab-bucket --key test.txt out.txt

Expected output: step 1 returns an empty or suggestion-only findings list; step 4 returns two access-denied errors (the first should name an explicit deny in a service control policy); step 5 prints true and downloads the object. Validation: the denied calls appear in the sandbox account’s event history with an access-denied error code. Troubleshooting: if step 4 succeeds, check that the account really sits in the test OU and that the role has neither exempt name; if step 3 fails with a policy-type error, step 2 has not completed. Teardown: aws organizations detach-policy for both IDs, then aws organizations delete-policy; disable the RCP type if nothing else uses it.

Objective: alert within minutes when anyone stops or changes a trail, and measure the time to alert. Prerequisites: a sandbox account with an active trail, permission to manage EventBridge and SNS, and a way to run cloudtrail stop-logging there (the break-glass role, or detach the Lab 2 SCP first). Cost: negligible. Time: 45 minutes.

To receive these events in EventBridge “you must enable a CloudTrail trail with logging”; they reach the account’s default event bus, and rules in the default ENABLED state match write management events.^[67] ATT&CK v20 files this behaviour as T1685.002, Disable or Modify Cloud Log.^[11]

Example status: JSON syntax-checked; not executed.

{
  "source": ["aws.cloudtrail"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["cloudtrail.amazonaws.com"],
    "eventName": ["StopLogging", "DeleteTrail", "UpdateTrail", "PutEventSelectors"]
  }
}

Save the pattern above as pattern.json and the topic policy below as topic-policy.json, with your Region and account ID. AWS documents this EventBridge statement without a condition, so keep the topic for this rule alone.^[68]

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublishEventsToMyTopic",
      "Effect": "Allow",
      "Principal": {"Service": "events.amazonaws.com"},
      "Action": "sns:Publish",
      "Resource": "arn:aws:sns:eu-west-1:111122223333:cloud-log-tamper"
    }
  ]
}

TOPIC_ARN=$(aws sns create-topic --name cloud-log-tamper --query TopicArn --output text)
aws sns set-topic-attributes --topic-arn "$TOPIC_ARN" --attribute-name Policy \
  --attribute-value file://topic-policy.json
aws sns subscribe --topic-arn "$TOPIC_ARN" --protocol email \
  --notification-endpoint secops-oncall@example.com
aws events put-rule --name cloud-log-tamper --event-pattern file://pattern.json
aws events put-targets --rule cloud-log-tamper --targets "Id=sns,Arn=$TOPIC_ARN"

# Game day: note the time, stop logging, wait for the e-mail, restart logging.
date -u +%H:%M:%S
aws cloudtrail stop-logging --name sandbox-trail
aws cloudtrail start-logging --name sandbox-trail

Expected output: an SNS e-mail containing "eventName": "StopLogging" and the caller’s ARN. Validation: record the minutes between the date output and the e-mail; get-trail-status shows IsLogging true after the restart. Troubleshooting: no e-mail usually means an unconfirmed subscription, a missing topic policy, or a rule created in a different Region from the call. The lesson: if the stopped trail were the account’s only trail, later calls might never reach EventBridge; the organisation trail and GuardDuty, whose consumption your CloudTrail settings do not affect, cover that gap.^[42] Teardown: aws events remove-targets --rule cloud-log-tamper --ids sns, aws events delete-rule --name cloud-log-tamper, aws sns delete-topic --topic-arn "$TOPIC_ARN".

For the sourced cases, the lessons drawn are this page’s mapping, not the investigators’ findings.

The last row is a trap. AWS defines its security score as “the proportion of Passed controls to enabled controls” and warns that “if you suppress all failed findings for a control, its status becomes Passed”.^[71] A score is a lagging, gameable view of an automated subset; dwell time, open-finding age and exception debt show whether the operating model works.

The main quality risk is self-inflicted: a deny at the wrong level locks out a team or a pipeline, which is why AWS “strongly recommends” testing SCPs before attaching them to the root.^[13] Regulation is jurisdictional: BOD 25-01 binds only US federal civilian agencies.^[9] Audit logs contain personal data such as user names and IP addresses, so set their retention with PrivacyOps and their evidence use with ComplianceOps. Accepting a residual risk is its owner’s decision (RiskOps), not the finder’s. This page is not legal advice.

Logging and posture costs shape design (as of October 2026):

• CloudTrail delivers one copy of management events without a CloudTrail charge (storage is billed); scope the extra-cost data events to sensitive data stores.^[23][25]
• Azure charges no ingestion for activity logs in Log Analytics, only retention beyond 90 days.^[12] Google leaves Data Access logs off “because they can generate large volumes of data”.^[24]
• Security Hub CSPM charges per check and finding after a 30-day trial; Access Analyzer charges for unused and internal access analysis; Defender’s foundational CSPM and SCC Standard cost nothing extra.^{[41][22][17][54]}

Price logging by the investigations it enables: a missing log cannot be bought during an incident. Cost allocation belongs to FinOps.

Assure the guardrails themselves: run the Lab 3 game day quarterly for each critical detection; diff attached organisation policies against Git weekly; enable a new benchmark version before disabling the old one, as AWS advises.^[49] Risk indicators: denials that teams work around by moving accounts between OUs, exceptions renewed rather than closed, findings closed without a rescan, detectors off in newly enabled Regions, and growing counts of long-lived keys.

Trigger: the Lab 3 rule reports StopLogging on a production account trail, and threat detection reports API calls from an access key in a country where the team does not work. Severity: high until scoped. Incident command follows IncidentOps; evidence and eradication depth follow ResponseOps.

sequenceDiagram
  participant S as SOC lead
  participant E as On-call engineer
  participant P as Cloud APIs and log archive
  Note over E: Alert: StopLogging and odd key use
  E->>P: Query activity since key creation
  P-->>E: Calls and resources touched
  E->>S: Declare incident with scope
  E->>P: Disable key, deny user, revoke sessions
  P-->>E: Confirmed
  E->>P: Remove persistence, restart logging
  E->>S: Hand over evidence and timeline

1. Confirm and preserve. Check that the organisation trail is still logging (member accounts cannot stop it).^[40] Do not delete anything; snapshot evidence before changing resources.
2. Scope. In the log archive, list every call made with the access key ID, every role it assumed, and every GetSessionToken or GetFederationToken call: those return temporary keys (IDs starting ASIA) that keep working after the long-term key is disabled, so follow their key IDs too.^[72] Note created users, keys, roles, trust-policy changes and data reads.
3. Contain. Deactivate the key (aws iam update-access-key --user-name <user> --access-key-id <key-id> --status Inactive), then attach the AWS managed policy AWSDenyAll to the user. Temporary credentials “are valid until they expire” (up to 36 hours), and AWS says “you must also change permissions for the IAM user or role” to stop them; sessions the user created are evaluated against the user’s own policies, so the deny ends them. Root-user sessions cannot be stopped this way, one more reason for IAM.4.^[73] For roles the key assumed, revoke sessions: AWS attaches a deny on aws:TokenIssueTime, which does not stop sessions assumed afterwards, so first remove the attacker’s ability to re-assume the role.^[74]
4. Eradicate. Delete persistence found in step 2; check for new resources in Regions you do not use.
5. Recover and verify. Restart the trail, confirm IsLogging is true, rerun the posture scan, watch for the key ID for 30 days.
6. Learn. Why did a long-lived key exist, and why could its holder stop logging? Usually both lead to a guardrail (the reference SCP) and a credential-hygiene backlog item.

• “The provider secures the cloud for us.” The provider secures its infrastructure; configurations, identities and data stay with you in every model.^[18]
• Dashboard-driven security. Chasing a score invites suppression, which raises it.^[71] Manage dwell time and exceptions.
• Deny everything at the root on day one. It locks out teams and produces exception sprawl; stage by OU.^[34]
• Exempting a role name without protecting it. Anyone who can create a role with that name inherits the bypass.
• “Key rotation protects our data.” AWS states that rotation “has no effect on the data that the KMS key protects” and “will not mitigate the effect of a compromised data key”; KMS keys are mostly wrapping keys “almost never reused enough to risk key exhaustion”.^[75] Rotate where rules require it, but spend effort on who can use the key.
• “GuardDuty keeps our logs.” It extracts fields “and then discards these logs”; investigations need your own archive.^[42]

Use a deliberate CloudSecOps practice when several hold: more than a handful of accounts or subscriptions; production or regulated data in the cloud; many teams with API access; a security team that cannot review every change; auditors who expect continuous control evidence.

Do not build a separate function when the estate is one or two accounts run by one small team. For small organisations Microsoft’s guidance is to “Combine cloud platform engineering and security responsibilities into a single function”;^[38] free native posture tiers and an organisation-wide log are enough to start. Do not buy a CNAPP first if nobody owns findings: it will produce a backlog without a workflow. Hidden responsibilities: maintaining exceptions, benchmark upgrades, detector coverage in new Regions, and the on-call rota for control-plane alerts.

Most decisions in CloudSecOps are about where a control should live. The tree below is this Atlas’s proposal.

flowchart TB
  Q1{"Could this action cause severe harm in any account?"}
  Q1 -->|"no"| D1["Detective check, routed to owner"]
  Q1 -->|"yes"| Q2{"Any legitimate use in some accounts?"}
  Q2 -->|"yes"| Q3{"Can those accounts sit in their own OU?"}
  Q2 -->|"no"| P1["Preventive at organisation root, staged"]
  Q3 -->|"yes"| P2["Preventive on other OUs; detective there"]
  Q3 -->|"no"| Q4{"Can a condition express the exception?"}
  Q4 -->|"no"| D2["Detective with fast SLA and auto-alert"]
  Q4 -->|"yes"| P3["Preventive with tested condition"]
  D1 --> R["Review quarterly: promote or retire"]
  D2 --> R
  classDef decision fill:#fdf3e3,stroke:#c9800f,color:#122029
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef neutral fill:#f1f4f6,stroke:#5b7a87,color:#122029
  class Q1,Q2,Q3,Q4 decision
  class P1,P2,P3 core
  class D1,D2,R neutral

Assumptions: preventive controls can be tested in a non-production OU, and the people a condition constrains cannot set it themselves; if a tag drives the exception, protect the tag or it becomes a bypass.

This maturity model is this Atlas’s proposal, not an industry standard.

flowchart TB
  L0["0 Ad hoc"] -->|"turn on org logging and scans"| L1["1 Visible"]
  L1 -->|"owners and SLAs"| L2["2 Baselined"]
  L2 -->|"enforce by OU"| L3["3 Enforced"]
  L3 -->|"test guardrails and detections"| L4["4 Engineered"]
  L3 -.->|"exceptions renewed, not closed"| L2
  L2 -.->|"triage stops, backlog grows"| L1
  classDef core fill:#e8f3f2,stroke:#16756f,color:#122029
  classDef risk fill:#fbeceb,stroke:#b4332b,color:#122029
  class L0,L1,L2,L3,L4 core

Quick wins: storage blocks on OUs with no public buckets; no root access keys; threat detection in unused Regions. Dependency: an IaC pipeline for organisation policies (InfraOps).

Quick start

• Organisation-wide control-plane logging into an account workload admins cannot change
• Posture scanning and threat detection in every enabled Region
• One benchmark version chosen and recorded
• Critical-finding routing to owners, with a service-level target

Guardrail preflight

• Policy validated (no ERROR or SECURITY_WARNING findings)
• Exempt principals listed and protected; management account and service-linked roles noted as not covered
• Attached to a test OU for at least one week with access-denied events reviewed
• Rollback is a one-line detach in the pipeline

Logging readiness

• Data-plane logs enabled for sensitive data stores
• Identity-provider sign-in and directory logs exported beyond their default retention
• Retention set with privacy and compliance owners
• A test event found in the archive in under one hour

Quarterly review

• Each critical detection passed its game day
• Exceptions past expiry: zero
• Benchmark and tool versions re-checked

Guardrail record (one per guardrail, kept next to the policy code):

id: GR-007
intent: Member accounts cannot disable, narrow or suppress audit, posture or detection
type: preventive (second layer)
mechanism: AWS SCP protect-security-telemetry (incl. DenyFindingSuppression)
preconditions: [GuardDuty and Security Hub CSPM managed via Organizations]
scope: all OUs except Sandbox (detective there)
not_covered: [management account, service-linked roles, Macie, Inspector, detection rules]
exempt_principals: [role/security-breakglass, role/org-baseline-deployer]
owner: cloud-security
test: Lab 3 game day, quarterly
exceptions: none
last_reviewed: 2026-10-16

Exception request:

Exception ID:        EX-2026-031
Guardrail:           GR-012 (no public object storage)
Resource / account:  marketing-site / web-prod
Reason:              Static website; CDN migration planned
Compensating control: Bucket holds public assets only; data events logged
Risk owner:          Head of Web (accepts the residual risk)
Expires:             2026-12-31 (max 90 days; renewal needs a new review)

Quarterly scorecard: guardrail, logging and detection coverage, median and mean critical dwell time, open critical finding age, exception debt, long-lived credential count, detection test pass rate, benchmark version assessed, top three risks and decisions needed.

Is CloudSecOps a job title or a team? Both appear; the label is not standardised. What matters is that someone owns guardrails, posture, logging and cloud detections.

Do we need a CNAPP? Not to start: the free tiers and trial under Cost are enough to begin. Attack-path analysis no longer needs one: AWS Security Hub, the paid Defender CSPM plan and SCC Premium offer it.^[57][17][54] A CNAPP earns its cost through one workflow across several providers.

Should every CIS check be enforced? No. Your baseline chooses among the recommendations and records exceptions.

Does SaaS belong here? It is a close neighbour: CISA’s BOD 25-01 sets baselines for Microsoft 365 tenants.^[9] This page covers infrastructure and platform providers, but the guardrail-and-evidence pattern carries over.

What if the provider itself is compromised? You cannot prevent it, but your logs, keys you control and detections on your own tenancy are what let you see it. The CSRB report describes a customer whose own logs first revealed an intrusion that turned out to stem from a provider key compromise.^[6]

• Data perimeters: combining SCPs, RCPs and network conditions so only trusted identities reach trusted resources.^[16]
• Configuration that survives new APIs: AWS declarative policies are enforced “in the service’s control plane”, so the baseline holds “even when the service introduces new features or APIs”.^[19]
• AI workloads: AI posture management in Defender for Cloud and an AI domain in the Microsoft benchmark v2 preview are early signs.^[17][46]
• Provider logging norms: the CSRB asked cloud providers for default audit logs without extra charge, kept at least six months.^[6] Microsoft raised Purview Audit (Standard) retention from 90 to 180 days for records from 17 October 2023;^[76] this page found no cross-provider standard for the wider ask (as of October 2026).
• Shifting vocabulary: ATT&CK v20 moved cloud log tampering to T1685.002 under a “Defense Impairment” tactic;^[11] update detection mappings that use the old ID.

• Prerequisites: CloudOps for hierarchy and accounts; one provider’s IAM evaluation logic (IAMOps).
• One day: Lab 1; read your provider’s SCP or Azure Policy documentation and its audit-log defaults.
• One week: Labs 2 and 3 in a sandbox organisation; run Prowler with --compliance against a test account and triage the output.^[55][77]
• 30 days: write a baseline mapped to one CIS benchmark, an exception process and the scorecard; run one game day.
• Specialise: cluster security (KubernetesSecOps), detections (DetectionOps), telemetry (SecDataOps) or response (ResponseOps).
• Portfolio: a public repository with tested guardrail policies, a logging standard and a game-day report.

Situation (illustrative): an AWS estate of 60 accounts has 14 publicly readable buckets. Nine hold website assets; five are unexplained. The CISO asks for an organisation-level S3 block “today”.

Option A, enforce at the root now. Organisation-level S3 policies apply all four block settings together and override account settings.^[52] Every unexplained exposure closes at once, but the nine website buckets stop serving too, and the pressure to restore them can produce exemptions by moving accounts out of the OU, weakening every guardrail for those accounts.

Option B, detect and fix first. Triage all 14 within days, move websites behind a CDN with private origins, then enforce. The estate stays exposed during the work, and “temporary” can become permanent.

Assumptions that decide it: whether the five unexplained buckets hold sensitive data (unknown until triaged), and whether OUs can be split so website accounts sit apart. A reasoned choice: close the five unexplained exposures now with account- or bucket-level blocks, enforce the organisation-level block today on every OU without a public bucket (Lab 1’s step 4 shows the effect), and give the website OU a dated plan to move behind a CDN, with a detective rule meanwhile. Option A looks safest, but breaking production on day one is how guardrails lose their sponsors. Uncertainty: if an unexplained bucket holds personal data, that account moves to Option A and to incident handling.

You can now explain what CloudSecOps covers and where its label is unsettled; design a guardrail set with exceptions; operate logging, posture triage and control-plane detections; and evaluate posture metrics and tools critically.

1. An SCP denies cloudtrail:StopLogging, yet a trail was stopped. Name two ways this can happen.

2. Your posture score rose from 71% to 90% in a week with no deployments. What do you check first?

3. Why does BlockPublicPolicy alone not close an existing public bucket?

4. During an investigation you need object reads from six months ago on AWS and Google Cloud. What do you probably lack, and why?

5. A team revoked active sessions on a compromised role, yet the attacker is back an hour later. Why? And what else must you do when the stolen credential is an IAM user’s access key?

6. Your tool reports full CIS compliance on AWS. What two caveats belong in the report?

CloudSecOps is a young name for an old problem in a new place. The name will keep shifting; trade press and a certification body already use it differently. The place will not: every cloud resource, permission and log setting passes through a provider API, and the cases that teach most (an over-permissioned role, valid stolen passwords, logs nobody switched on) were failures of configuration, identity and evidence at that layer. This page’s proposal is simple to state: enforce centrally a short list of things that must never happen, let owners fix everything else in code against a clock, and test guardrails and detections like applications. Start with logs you can trust; then make dangerous things impossible, one OU at a time.

Claim-by-claim evidence: research/cloudsecops-ledger.md. Re-verify dated facts (versions, retention defaults, prices) quarterly or when CIS, AWS, Microsoft or Google announce changes, and re-check neighbour anchors on each rebuild.

Changelog. 2026-10-16, r0: first version; Lab 1 executed, Labs 2–3 not executed. 2026-10-17, r1: revised after independent review reviews/cloudsecops-r1.md (item-by-item response in reviews/cloudsecops-r1-response.md): TechTarget definition, stolen-key containment, telemetry SCP, identity-log defaults, keys and misconfiguration sections, Security Hub split; Lab 1 re-run. 2026-10-17, r1.1: score follow-ups S1, S2, S5, S6 (reviews/cloudsecops-score-superseded-20261017T0519.md): the DenyFindingSuppression statement, IdentityOps link, decision-tree title, re-check cadence. 2026-10-17, post-score polish (reviews/cloudsecops-polish.md): worked artefacts labelled AWS-first; SCP action names and condition key re-checked against AWS’s service reference; dense passages split into lists; decision tree narrowed; restatements trimmed.