Cloud misconfiguration
In cloud security, a cloud misconfiguration is a permissive or mistaken setting that exposes resources or grants more access than intended: over-broad roles, unrestricted trust between accounts, mis-scoped identity federation and exposed storage. It is a leading cause of public-cloud compromise, and one a scanner finds long before an attacker needs an exploit.
How it works
Cloud platforms are configured through identity and policy, and a misconfiguration is a setting that opens more than it should. The emblematic example of the past decade was the public storage bucket, and exposed storage still occurs, but in current estates the misconfigurations that get exploited are about identity: a role with permissions far wider than its task, a trust relationship that lets one account assume a role in another (cross-account trust) without a tight condition, an OIDC federation whose subject and audience conditions are loose enough that the wrong external workload can assume a role, and long-lived access keys that never rotate. Each is a valid setting; the fault is that it grants access the owner did not intend.
What goes wrong
The reason this dominates cloud breaches is that no exploit is required. The attacker does not break the platform; they use it exactly as designed, with permissions it was misconfigured to grant. In the assessments we run, the interesting misconfiguration is rarely a single open resource. It is a chain: a modestly scoped foothold whose role can assume another role, which can read a secret, which unlocks the account. The individual settings each look defensible in isolation, which is why they survive review, and the escalation only becomes visible when someone follows the identity graph the way an attacker does rather than auditing resources one at a time.
Where this shows up in an audit
We do not stop at listing exposed resources. We map the identity relationships and demonstrate the cloud attack path a misconfiguration enables, from foothold to sensitive data, so the finding shows impact rather than a lone flagged setting. Results from a posture management tool are validated and prioritised against real reachability, and each finding is written against the specific setting and the access it grants. This is part of how we find and chain cloud misconfigurations.