Cloud Audit Checklist
A Cloud Audit Checklist provides a structured
framework for evaluating security, compliance, operational performance, and
cost management across AWS, Azure, GCP, or multi-cloud environments.
1. Identity & Access Management (IAM)
- Enforce Least Privilege:
Verify all users, service accounts, and roles have the minimum permissions
needed to perform their job functions. Eliminate wildcard (*) permissions.
- Multi-Factor
Authentication (MFA): Ensure MFA is mandatory for all console logins,
especially for privileged and root accounts.
- Eliminate Long-Lived
Credentials: Audit and rotate static access keys and API tokens every
90 days or shift to temporary short-lived credentials (e.g., AWS STS,
Azure Managed Identities).
- Orphaned Account Removal:
Audit active directories to revoke access for former employees, dormant
accounts, and unassigned roles.
2. Network & Perimeter Security
- Restrict Public Exposure:
Audit storage buckets (AWS S3, Azure Blobs), database instances, and
management ports (SSH/22, RDP/3389) to prevent unintended internet
exposure.
- VPC / VNet Architecture:
Validate microsegmentation between production, staging, and development
environments.
- Inbound/Outbound Rules:
Clean up open security groups, permissive firewall rules, and obsolete
route tables.
- WAF & DDoS
Protection: Ensure Web Application Firewalls (WAF) and automated
anti-DDoS mitigations are configured for edge services and load balancers.
3. Data Protection & Encryption
- Encryption at Rest:
Confirm all block stores, object storage, databases, and backup snapshots
are encrypted using strong algorithms (e.g., AES-256).
- Encryption in Transit:
Enforce TLS 1.2+ across all microservices, API routes, and external data
pipelines.
- Key Management (KMS):
Audit access permissions to Encryption Keys and ensure regular key
rotation policies.
- Secrets Management:
Verify passwords, API keys, and database strings are kept in dedicated
Vaults (e.g., AWS Secrets Manager, HashiCorp Vault) and removed from
hardcoded scripts/repos.
4. Logging, Monitoring & Incident Response
- Control Plane Logging:
Ensure core auditing logs (AWS CloudTrail, Azure Activity Log, GCP Audit
Logs) are turned on across all active regions.
- Tamper-Proof Storage:
Store security logs in dedicated, write-once-read-many (WORM) or immutable
storage buckets with restricted delete privileges.
- SIEM & Real-Time
Alerts: Feed logs into a centralized SIEM/CSPM for continuous anomaly
detection (e.g., unusual privilege escalations, new admin roles).
- Incident Response
Testing: Test emergency access keys, backup recovery procedures
(RTO/RPO), and hold regular tabletop breach response drills.
5. Compliance & Governance
- Benchmark Alignment: Compare
current cloud configurations against established benchmarks like CIS
Foundations, NIST CSF, SOC 2, or ISO 27001.
- Regulatory Requirements:
Audit sensitive workloads for domain-specific mandates like GDPR, HIPAA,
or PCI DSS 4.0.
- Automated Compliance
Checks: Deploy Cloud Security Posture Management (CSPM) tools to run
real-time checks for drift from your baseline.
6. Financial & Operational Efficiency (FinOps)
- Unattached Assets: Identify
and delete unattached elastic IPs, orphaned EBS volumes, and outdated
snapshots.
- Resource Optimization:
Right-size compute instances, serverless configurations, and database
nodes based on historical metrics.