Cloud Misconfigurations in the Wild

This survey documents the cloud misconfigurations our team encounters most frequently across real-world assessments of AWS, Azure, and GCP environments. Each finding is ranked by exploitability and potential blast radius.

• Over-permissive IAM policies remain the most common and highest-impact finding across AWS environments.
• Public S3 buckets continue to appear despite years of awareness campaigns.
• IMDSv1 exposure allows credential theft via SSRF in environments that haven't migrated to IMDSv2.

• Unrestricted management port access (RDP/SSH exposed to the internet) is common in development environments that reach production.
• Missing conditional access policies leave administrative accounts exposed.

• Default service account usage with broad permissions is the most common finding in GCP environments.
• Cloud Storage bucket misconfigurations mirror the S3 problem on AWS.

Across all three providers, the most impactful findings share a common theme: excessive permissions granted out of convenience during initial setup that are never tightened before production deployment.