“To err is human, but to leave a company completely unsecure because a misconfigured policy is just…inhumane”
Configuring an infrastructure in the cloud in 2026 has become easier and more accessible than ever before. Configuring a secure cloud infrastructure, on the other hand, has always been far from simple. And the more complex a configuration process is, the more exponentially catastrophic a single mistake can be.
I’ll give you an example. In the days of on-prem servers, they were normally configured for local access. A technical failure usually meant a broken part or a simple reboot. Barring an outside attack, you worried about things such as backups and basic access to the server from inside the company. Because of this, your overall exposure, otherwise known as your attack surface, was not as large.
But now in the modern cloud era, a single mistake can be catastrophic. Can you imagine accidentally leaving an AWS S3 bucket public? Might as well just throw the company secrets on a reddit forum while you’re at it.
But in this case, I don’t even think the scariest part is the amount of damage that can occur so much as the way it can occur; with one simple misclick.
The Hidden Danger of the Console
I’ll admit that when you are building some sort of fun, temporary web app, you may actually want to uncheck the “Block all public access” in your AWS console. How else will the world see your genius? How will that girl see the cheesy, romantic Valentine’s Day proposal you made?
For a short-lived personal project with no sensitive data, simply giving the bucket a long, random name provides enough “Security through Obscurity”. This is because an attack would need to know the exact name of the bucket in order to even find it and access it.
But when an overworked, fatigued engineer (that totally NEVER happens! 🙂) leaves the company’s production database, customer record, or proprietary source code public…
…well that, my friends, is what we call a million-dollar typo.
Infrastructure as Code (IaC)
If you want to secure your cloud, you have to stop building it by hand.
The root of the problem isn’t that cloud providers are insecure, the problem is how we interact with them. Think about it like this: Imagine a car factory where instead of using precision molds, computerized measurements and strict variance levels to create car parts, they instead gave the workers a 20-page guide and told them to follow as closely as they could. If they forget one bolt, misread a cast fill line, or leave something at the wrong tightness, the machine may still look fine on the outside, but a massive failure is waiting to happen when that car starts up for the first time. The casts and tools aren’t an issue, neither is the assembly line. The problem lies in the seemingly small miscalculation that ripples into a larger catastrophe.
Just like in the example above, relying on humans to, repeatedly, manually click through web consoles, dropdown menus, and permission checkboxes is a recipe for disaster. We get distracted, feel pressured by deadlines, and somewhere down the line we end up making a typo that costs the company money and, in extreme circumstances, ourselves a job.
The solution is treating your infrastructure as code (IaC). Yes, I understand that the web interface is there. But instead of clicking through it, modern cloud security almost dictates that you write your architecture out using tools like AWS CloudFormation or HCL.
This allows you to pre-define your firewalls, servers, and IAM policies in code giving you massive security advantages:
- Peer Review: Something I would say is almost as valuable as the automation itself, the ability to review a misconfigured S3 bucket before it ever goes live.
- Version Control: If a change in accidentally exposes a vulnerability, you can simply roll back your infrastructure to the previous secure version, just like you would software (and per your change management plan of course!)
- Consistency: “If you have to do something more than once, automate it”. IaC ensures your development, testing and production environments are deployed identically every single time.
If you are still attempting to deploy secure infrastructure by clicking around in your web browser, you’re playing a dangerous game. In 2026, it’s time to stop relying on manual perfection, and start hardcoding your security.
Forge Shield Tech 