Security · Zero Trust & Secure Architecture · 06
Cloud access controls
Cloud access controls govern who and what can reach cloud consoles, resources, storage and services, and under what conditions: identity federation, role design, service principals, network restrictions, key handling and the guardrails that prevent accidental exposure. It is needed when cloud accounts were created by projects with their own identities, when administrators hold standing root or owner rights, when storage or services have been found publicly exposed, or when a customer, auditor or insurer asks how cloud access is governed. The work produces a reviewed access model across the cloud estate, hardened role and policy definitions, the removal of standing privilege where elevation will do, detection of exposure and privilege drift, and the evidence that cloud access matches the policy.
Scope
What the review covers.
- Cloud account and subscription inventory and ownership
- Identity federation, role design and least privilege
- Service principals, keys and secrets handling
- Network and resource exposure: public storage, open services, overly broad policies
- Guardrails: organization policies, conditional access, logging
- Drift detection and periodic review
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Access model review | Who can reach what, with findings |
| Role and policy baseline | Hardened definitions with reasoning |
| Exposure report | Public or over-permissive resources with fixes |
| Review procedure | Drift detection and audit evidence |
Prerequisites
What we need from you.
- Read access to the cloud management consoles and identity provider
- The account and subscription inventory, or the billing view to derive it
- Owners for the workloads whose access will change
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Which cloud platforms?
The ones you use. Principles are shared; configuration is specific, and we work in the native tooling.
Can this find public storage buckets?
Yes. Exposure review is part of the scope and is often the first thing fixed.
How does this relate to identity architecture?
Cloud access is where identity architecture meets the resources it protects. The two are designed together where possible.