Cloud accounts become high-value targets the moment they can create billable resources. Strong authentication, limited privilege assignment, careful API key management, and regular review of permissions reduce risk. The first hour with a new account should be spent on exactly that, before any workload is deployed.
Step one: take ownership of access
Log in to the control panel, change the password, and enable multi-factor authentication wherever it is available. Review the account profile for accuracy and update contact information if necessary. If the platform supports recovery options, set them now.
Step two: apply least privilege
Create separate identities for people and for automation rather than sharing the root or owner credentials. Apply least-privilege principles, prefer short-lived credentials and federated identity where practical, and plan to review permissions regularly.
Step three: lock down API keys
Rotate any keys that came with the account, store new keys in a secrets manager rather than in code or chat, and scope each key to the smallest set of permissions its job needs.
Step four: restrict the network
Restrict network access with firewalls or security groups before the first server goes live. Configure public IPs, private networks, and firewalls deliberately rather than accepting defaults.
Step five: turn on visibility
Enable activity logging and monitoring for unusual behaviour. Set up billing alerts at the same time, since unexpected spend is often the first sign of compromised credentials.
Keep it going
Security is an ongoing practice rather than a setup task. Keep systems patched, review permissions on a schedule, define recovery objectives and test restoration processes. Document the configuration so that team members can maintain consistency, and treat infrastructure changes with the same care applied to application code.
