Securing Website Infrastructure on the Cloud: A Hardening Checklist

Start with identity, not firewalls

Most cloud compromises begin with an identity that has too much access. Require phishing-resistant MFA for administrators, prohibit long-lived access keys, and use short-lived workload identities rather than credentials stored in deployment pipelines.

Lock down the public edge

• Expose only the CDN or load balancer; keep origins on private networks
• Restrict origin access to the edge provider's identity or IP ranges
• Enable managed WAF rules, bot controls and rate limits
• Redirect HTTP to HTTPS and enforce modern TLS

Protect storage and databases

Object storage buckets and managed databases should be private by default. Use signed URLs for temporary file access, enable encryption, and prevent public access at the account or organisation level.

Reduce blast radius

Separate production from development accounts, use least-privilege roles per workload, and segment databases, queues and internal services. A compromised frontend container should not be able to enumerate the entire cloud estate.

Detect drift

Infrastructure-as-code scanning and cloud posture management should run continuously. Alert on newly public resources, disabled logging, permissive security groups and unexpected identity-policy changes.

Backups and recovery

Use immutable, cross-account backups and test restoration. A backup that has never been restored is an assumption, not a recovery capability.