As Indian enterprises accelerate cloud adoption, security must be built into every layer of the cloud architecture. Misconfigured cloud services are responsible for over 80% of cloud security incidents in India.
Common Cloud Security Mistakes in India
1. Public S3 Buckets / Blob Storage: Leaving storage publicly accessible exposes sensitive data 2. Overpermissioned IAM roles: Admin-level permissions for all services 3. Unencrypted databases: RDS instances without encryption at rest 4. No MFA for root accounts: Root/admin accounts accessible with just a password 5. Missing CloudTrail/Activity logs: No audit trail for security investigations
AWS Security Best Practices
- Enable AWS Organizations with Service Control Policies (SCPs)
- Enforce MFA on all IAM users and the root account
- Use IAM roles instead of long-term access keys
- Enable AWS Config and CloudTrail in all regions
- Use VPC with private subnets for sensitive workloads
- Enable Amazon GuardDuty for threat detection
Azure Security Best Practices
- Enable Azure Security Center / Defender for Cloud
- Use Azure AD Conditional Access policies
- Enable Azure Monitor and Activity Logs
- Use Managed Identities instead of service principals with secrets
- Apply Network Security Groups (NSGs) to all subnets
GCP Security Best Practices
- Enable Cloud Audit Logs for all services
- Use Workload Identity Federation
- Enforce Organization Policies
- Enable Security Command Center
- Use VPC Service Controls for sensitive data
Compliance Requirements for Cloud in India
Organizations using cloud in India must comply with:
- CERT-In guidelines for cloud security
- RBI guidelines for banking data in cloud
- SEBI cloud guidelines for financial services
- Data localization requirements under DPDP Act 2023