This is not a compliance framework. It is the set of things that, if you do them, remove the failure modes that actually hit small teams: leaked keys, public storage, an unmonitored account, and no budget alarm.
Guides · Cloud
Cloud Security Starter Checklist (AWS / GCP)
The baseline controls that catch the most common ways a small team's cloud account gets compromised or runs up a surprise bill.
8 min · updated 29 Aug 2026Identity
- Root / owner account has MFA and is not used for daily work.
- Humans log in via SSO and assume roles — no individual IAM users with passwords where avoidable.
- No long-lived access keys; CI authenticates via OIDC / Workload Identity Federation.
- Permissions are scoped to what each role needs, not AdministratorAccess by default.
- Unused users, roles, and keys are removed on a schedule.
Network & data
- Databases and caches are on private subnets with no public IP.
- Object storage buckets default to private; public access is an explicit, reviewed exception.
- Secrets live in Secrets Manager / Secret Manager, never in env files, AMIs, or repos.
- Traffic to the internet is through a known egress path, not wide-open.
- Storage and database encryption at rest is on (it is usually default now — confirm it).
Visibility
- Audit logging (CloudTrail / Cloud Audit Logs) is enabled in every region/project and retained.
- A billing budget with alerts at 50/80/100% goes to a channel someone reads.
- An anomaly alert fires on sudden spend or unusual API activity.
- You have a documented answer to 'who can access production and how'.
Recovery
- Backups exist for stateful resources and a restore has actually been tested.
- Infrastructure is in code, so a region or account can be rebuilt from the repo.
- There is a written, short incident runbook: revoke access, rotate secrets, who to call.
Rather not do this yourself?
Hosting, launch, performance, and cloud hardening are all services here. Hand it over.