Skip to main content
OpsRoadmaps

Checklists / cloud-account-security-baseline

Cloud Account Security Baseline Checklist

The controls that must be true for every cloud account before workloads land in it — identity, logging, network exposure, and drift.

9 steps · 8 required · last reviewed (next review 2027-03-20) · updated 2026-09-20

Related focus areas:CloudSecOps

Roadmaps covering the same ground:AWS Security ImprovementDevSecOps Rollout

Sign in to run this checklist

Apply this to each account or subscription, including the ones nobody claims. The accounts that cause incidents are rarely the flagship production account; they are the sandbox somebody opened for a spike two years ago and never closed.

Every item here is checkable by a posture tool. If you are answering from memory rather than from a report, that is the first finding.

  1. Root/owner credentials have hardware MFA and are not used for day-to-day work

    required

    The root account is the one identity that can undo every other control. It should be boring and almost never used.

  2. Human access is federated through the identity provider — no standing local users with long-lived keys

    required

    A long-lived access key is a credential that leaks eventually. Federation makes offboarding real.

  3. Audit logging is on, delivered to an account the workload owners cannot delete from

    required

    Logs that an attacker with workload access can erase are not evidence. Separation of the log destination is the control.

  4. No storage bucket, database, or management port is reachable from the public internet unintentionally

    required

    Public exposure is the most common cloud finding and the cheapest to fix — but only if something checks continuously.

  5. Encryption at rest is on by default and keys are managed, not defaulted-and-forgotten

    required

    Default encryption satisfies most obligations; unmanaged keys fail the next question the auditor asks.

  6. A posture tool scans the account continuously and its findings have owners

    required

    A scanner with an unowned backlog measures your problem without reducing it.

  7. Infrastructure is defined as code and drift from that definition is detected

    required

    Console changes are how a reviewed baseline quietly stops being true.

  8. Privileged role assignments are reviewed on a cadence and the review is recorded

    required

    Access accretes. Without a review, permissions only ever grow.

  9. Guardrails are preventive where possible (policy denies) rather than only detective

    optional

    Detecting a public bucket is good; making a public bucket impossible is better.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-20 — adapt them to your own environment.