Skip to content

How cloud accounts actually go wrong

Containers, images and the cloud

Reading 1 of 5

Permissions granted too broadly

Cloud permissions are fine-grained and genuinely difficult. Something does not work, someone grants full access to make it work, and nobody narrows it afterwards.

The result is a service or a person able to do far more than their job requires. Least privilege is the principle of granting only what is needed, and it loses to deadlines constantly.

the four failures, in order of how often they happen

  1. Permissions widened at 6pm to unblock a deploynever narrowed afterwards
  2. A storage bucket made public for one fileleft public for everything
  3. An access key created in 2023 for a migrationstill works, owner has left
  4. Audit logging never switched onso nothing can be reconstructed

Cloud incidents are almost never clever. This is close to the whole list.

Broad permissions are almost never granted maliciously. They are granted at 6pm to unblock a deploy.