Home / Guides / Cloud security review checklist

Cloud security review checklist for AWS and Azure: what to check first

AWS, Microsoft and CIS each publish a cloud security baseline. The eight checks below appear in all three.

Published · Source: docs.aws.amazon.com

Last reviewed: · 5 min read

A cloud security review checks how your accounts are configured, without attacking them. Published baselines from AWS, Microsoft and CIS agree on the core areas, starting with the AWS Well-Architected Security Pillar. Those areas are identity and network exposure, data protection and logging, and backup and incident response. Start with identity, because it decides how far one mistake travels.

Key takeaways

  • AWS, Microsoft and CIS publish free cloud security baselines.
  • Identity and privileged access come first in every baseline.
  • A review reads configuration and needs read-only access only.
  • Each finding needs a severity, an effort estimate and an owner.

What do AWS, Microsoft and CIS publish?

The AWS Security Pillar (published 6 November 2024) groups its guidance into areas such as identity and access management and detection. Others cover infrastructure and data protection, incident response and application security. The Microsoft cloud security benchmark v2, currently in preview, lists twelve domains. They run from network security and privileged access to backup and recovery, and a new artificial intelligence security domain.

The CIS Benchmarks page lists the Amazon Web Services Foundations Benchmark 7.1.0 and the Microsoft Azure Foundations Benchmark 6.0.0. These are setting-by-setting configuration checks.

What should a cloud security review checklist cover?

These eight checks appear across all three baselines. Each is worded as something you can answer from the console or the infrastructure code.

  1. Identity: who and what can assume each privileged role.
  2. Privileged access: MFA on every human admin, and no long-lived root keys.
  3. Network exposure: which services are reachable from the internet, and why.
  4. Data protection: encryption at rest and in transit, and who holds the keys.
  5. Secrets: no credentials in code, images or environment files.
  6. Logging: audit logs on in every account, kept and read by someone.
  7. Backup and recovery: backups protected from deletion and restored at least once.
  8. Incident response: a named owner and a tested path when an alert fires.

Is a review the same as a penetration test?

No. A review reads configuration with read-only access. A penetration test tries to reach data from the outside or from a foothold inside. The Microsoft benchmark lists penetration testing under its posture and vulnerability management domain, as one control alongside configuration tracking. Our guide on cloud security review vs penetration test covers when to choose each.

Why does it matter for Australian cloud teams?

Customer questionnaires, ISO 27001 auditors and Essential Eight assessments all ask about identity, logging and backup. A review against a published baseline gives you evidence an auditor can read. Microsoft notes that mapping a control to a standard does not by itself mean full compliance with that standard.

Sorami’s view

This section is opinion. It reflects how we run reviews, not a statement from AWS, Microsoft or CIS.

Do not start by running every CIS check. Start with identity and the internet-facing list, because they decide how far one mistake travels. Then make every finding schedulable: a severity, an effort estimate and a named owner.

A configuration review is usually the right first step for a cloud estate. If you need to know what an attacker can actually reach, follow it with cloud penetration testing.

What to do now

  1. List every account and subscription, including ones nobody owns.
  2. Export privileged roles and who can assume them.
  3. List internet-facing services with a reason for each.
  4. Confirm audit logging is on everywhere and someone reads it.
  5. Restore one backup and record how long it took.
  6. Track each finding with a severity, effort and owner.

To have this checklist run against your own accounts, see our cloud security review, or contact us to discuss scope.

Sources

Facts on this page were checked against these sources on 22 October 2026. We update the page when the source changes.

Questions before you book

Practical answers.

What is a cloud security review?

A read-only review of how your cloud accounts are configured. It covers identity and network exposure, then data protection, logging and recovery. It does not attempt exploitation.

Which benchmark should we review against?

For configuration settings, the CIS Foundations Benchmarks for AWS and Azure. For design areas, the AWS Security Pillar or the Microsoft cloud security benchmark. Many reviews use one of each.

What access does a cloud security review need?

Read-only access to the accounts in scope, plus the infrastructure code where it exists. No write access is needed.

How often should we review our cloud security?

At least yearly, and after a major change such as a new account structure or a migration. Customer and audit deadlines often set the date.

Let’s scope it

Want your accounts reviewed?

Tell us how many accounts or subscriptions you run. We return a fixed scope in writing.

Send an enquiry