PS Product SecurityKnowledge Base

☁️ Cloud Change Review Checklist

Intro: Use this checklist when the change is primarily in IAM, networking, storage, logging, or managed-service configuration rather than application code.

Best time to use this checklist

Use it for new roles, trust policies, network exposure changes, storage-policy edits, managed database changes, or cluster/platform changes.

Stop-the-line conditions

  • broadened IAM trust without a strong reason or short-lived identity model;
  • public exposure of a storage, API, or control-plane endpoint without compensating controls;
  • removal or weakening of auditability;
  • a privilege path that now lets CI/CD or automation reach production more directly than intended.

Text-first review prompts

  • Which identity or role changed, and what new action can it now perform?
  • What network path or public exposure changed?
  • Does the change affect encryption, logging, retention, or access to sensitive data?
  • What is the blast radius if this role, security group, bucket policy, or route is wrong?
  • How will we detect misuse after the change?
  • Is there a rollback path for the infrastructure change?

Evidence table

Control area What to verify Typical evidence
IAM Trust policy, principals, and permissions are minimized role definition, policy diff
Network Ingress, egress, and private access assumptions are reviewed security group diff, route table, policy
Storage/data Bucket, object, DB, or key access is restricted and logged policy diff, audit setting
Observability CloudTrail / Activity Log / Audit Logs coverage is preserved logging config, dashboard
Rollback The infrastructure change can be reverted safely IaC rollback, change ticket

Common misses

  • reviewing only resource config and ignoring who can change it later;
  • forgetting that network egress can be as important as ingress;
  • assuming managed-service defaults are already safe;
  • not asking whether build or deployment identities just gained a new path into production.

---Author attribution: Ivan Piskunov, 2026 - Educational and defensive-engineering use.