Confidential Cloud-Native Company
Cloud Environment Security Review
Sanitized case study — client details withheld for confidentiality.
The ask.
A cloud-native company running production entirely on a major cloud provider wanted an independent review of their environment configuration — not a penetration test of an app, but a review of the relationships between identity, data, and network controls that most teams don’t have time to audit themselves.
Approach.
Configuration and privilege-relationship review across four domains: IAM (roles, policies, trust relationships, and privilege escalation paths between them), storage (bucket policies, encryption-at-rest, public access configuration), network (security group rules, VPC segmentation, exposed management interfaces), and logging/monitoring (what’s actually being logged, retained, and alerted on).
What we found.
An IAM role with an overly permissive trust policy allowing privilege escalation from a low-privilege service role to near-account-admin through role chaining; a storage bucket with encryption enabled but public read access misconfigured on a subset of objects; and a security group rule allowing unrestricted inbound access to an internal management interface.
Excessive standing privileges on human user accounts (violating least-privilege), inconsistent MFA enforcement across the identity provider, and insufficient logging on data access events for sensitive storage — meaning an actual breach in that bucket would have been very hard to detect after the fact.
Unused IAM credentials that were never deactivated, missing resource tagging for security ownership, and log retention shorter than the client’s own incident response policy required.
Why it mattered.
Cloud misconfigurations rarely get exploited through some exotic zero-day — they get exploited through exactly this kind of quiet privilege-chaining and logging gap. The IAM escalation path in particular meant a compromised low-privilege service credential (the kind that leaks in a misconfigured CI pipeline all the time) had a realistic path to near-full account control.
Outcome.
We provided a remediation roadmap ordered by blast radius rather than raw severity count, since some Medium findings (the logging gap) mattered more strategically than some Highs. The client used this as the baseline for a broader least-privilege IAM initiative.
Similar exposure in your environment?
This engagement began with a conversation about scope. Start yours the same way.