Cloud Security Baseline for Institutions (AWS, Azure, GCP)
The minimum controls every institutional cloud account should have in place before hosting student data or production systems.
Identity
- Root/owner account: MFA on, no access keys, used only for emergencies.
- Every person has their own identity; access is granted through roles/groups, not shared credentials.
- Least privilege: review permissions quarterly and remove what is unused.
Logging and monitoring
- Account-wide audit logging enabled (CloudTrail, Azure Activity Log, Cloud Audit Logs) and stored in a protected bucket/workspace.
- Alerts for: root login, new admin user, security group opened to the internet, logging disabled.
Network and exposure
- No database, storage bucket or admin port exposed to 0.0.0.0/0.
- Public storage is the exception and documented; default is private.
- Web applications sit behind a managed load balancer or CDN with TLS 1.2+.
Data
- Encryption at rest enabled by default; keys managed by the platform or your KMS.
- Backups are automated, tested by restoring at least twice a year, and stored in a second region or account.
- Personal data is classified and its location is documented.
Operations
- Patch/upgrade policy for managed services and virtual machines.
- Infrastructure defined as code and reviewed before changes.
- Cost and security budgets alert the owner before surprises.
Governance
- A named owner for every account and subscription.
- A written access-removal process for leavers and contract end.
- Annual review against this baseline, with findings tracked to closure.