These eight AWS configuration errors appear repeatedly in Intelliroot cloud security assessments and have led to significant data breaches at major organisations.
Cloud misconfigurations remain the leading cause of cloud security incidents. In our cloud security assessments across AWS environments, we consistently encounter the same critical errors — mistakes that expose sensitive data, enable lateral movement, and in the worst cases, allow complete account takeover.
1. Overly Permissive IAM Policies
The principle of least privilege is violated in virtually every AWS environment we assess. Developers attach AdministratorAccess to service accounts "temporarily" and it becomes permanent. Lambda functions have S3:* permissions when they only need to read one specific bucket prefix.
2. Public S3 Buckets with Sensitive Data
Despite AWS's account-level block public access settings, S3 bucket misconfigurations continue to expose sensitive data. The issue is often not the bucket itself, but pre-signed URL generation without expiry controls, or cross-account access policies that are too broad.