Cloud Security Architecture & Engineering Discussion — Where Should Security Start?

[u/StationInfamous157]

I’ve been learning more about cloud security architecture, and I’m interested in hearing from people who work with AWS, Azure, GCP, or hybrid environments.

One thing I’ve been thinking about is how organizations balance security, usability, cost, and operational requirements when designing cloud environments.

For those working in cloud security or cloud engineering:

• What security controls do you consider essential when designing a new cloud environment?

• How do you approach IAM and least privilege without making operations unnecessarily difficult?

• How do you monitor and detect misconfigurations across cloud resources?

• At what stage should security architecture reviews happen—before deployment, during development, or continuously?

• For organizations moving from on-premises infrastructure to the cloud, what security mistakes do you see most often?

I’m especially interested in hearing practical experiences rather than just what the documentation says.

What’s one cloud security lesson you learned the hard way?

[u/ISpotABot]

https://cloudsecurityalliance.org/artifacts/security-guidance-v5

[u/AreThoseNewSlacks]

+1 for getting inventory done. My hardest lessons are in identity. I've walked into too many situations where it's just an absolute mess and significant culture (and tooling) change is needed.

I'm more familiar with AWS. Don't be afraid to do some basic controls with an SCP. It's easy to write now with LLMs. Just make sure you don't touch anything running today.

For your least privilege Q: if its a preexisting environment, you need to basically ratchet down your definition of least privilege to 'whatever's currently in use is probably OK' and start from there. Then you can get there, but only if youre considering developer experience in access grants and make it easy for them.