Walk into almost any Kenyan enterprise running production workloads on AWS or Azure, and you will find the same handful of cloud security misconfigurations. Not zero-days. Not nation-state tradecraft. Just publicly exposed storage buckets, over-privileged IAM roles, and logging that was never switched on. This is what continues to drive most cloud incidents across East Africa — and what regulators under the Kenya Data Protection Act are starting to ask hard questions about.
The shift to AWS and Azure across African banks, fintechs, telcos, and government agencies has outpaced the maturity of the teams managing those environments. The result: cloud security misconfigurations that would fail any serious audit, quietly sitting in production.
The Misconfigurations We Find Again and Again
After running cloud posture reviews for financial services and SaaS clients across the region, the same issues surface. These are not theoretical.
1. Publicly exposed storage
S3 buckets and Azure Blob containers holding customer KYC documents, loan applications, or call recordings — set to public or with permissive ACLs left over from a developer test. In one common pattern, a team enables "public read" to share a file with a vendor and never reverses it. Under the Kenya Data Protection Act, that single misconfiguration is a reportable breach the moment personal data is involved.
2. IAM roles with `*:*` permissions
Over-privileged identities remain the single biggest lateral movement risk in African cloud environments. We regularly see:
- Human users with `AdministratorAccess` instead of scoped roles
- Service accounts and CI/CD pipelines granted full account permissions "to make deployments work"
- Long-lived access keys never rotated, sometimes committed to public GitHub repos
3. Disabled or unmonitored logging
CloudTrail switched off in secondary regions. Azure Activity Logs not exported to a SIEM. GuardDuty or Microsoft Defender for Cloud enabled but with no one triaging alerts. If you cannot reconstruct what happened in the 72 hours before an incident, your incident response plan is fiction.
4. Unrestricted security groups and NSGs
SSH (port 22) and RDP (port 3389) open to `0.0.0.0/0`. Databases with public endpoints. Management planes reachable from the internet without a bastion, VPN, or Azure Bastion in front.
5. No encryption discipline
EBS volumes, RDS instances, and Azure managed disks running without encryption at rest, or using default keys where customer-managed keys (CMK) are required for regulatory alignment.
Why African Enterprises Keep Getting This Wrong
The root causes are structural, not technical.
Cloud misconfiguration is a governance problem dressed up as an engineering problem. Fix the ownership model and most of the technical debt resolves itself.
- No cloud security ownership. Infrastructure teams assume DevOps owns it. DevOps assumes security owns it. No one owns it.
- Lift-and-shift without redesign. On-prem network thinking gets ported to the cloud, so teams rely on perimeter controls that no longer exist.
- Skills gap. Certified AWS and Azure security engineers are scarce in the East African market, and internal upskilling budgets are thin.
- No baseline standard. Teams deploy without a documented secure configuration baseline mapped to ISO 27001, CIS Benchmarks, or the AWS/Azure Well-Architected security pillars.
- Compliance treated as a once-a-year event. Configurations drift the day after the audit closes.
What Good Looks Like
You do not need a million-shilling tooling stack to fix this. You need discipline and a baseline.
Start with a cloud configuration baseline
Adopt CIS Benchmarks for AWS and Azure as your minimum. Map controls to ISO 27001 Annex A and the Kenya Data Protection Act's security safeguards so one control satisfies multiple obligations. ISO 27001 Compliance Services
Turn on the native tooling first
Before buying a third-party CSPM, use what you already pay for:
- AWS: Security Hub, Config, GuardDuty, IAM Access Analyzer, CloudTrail across all regions
- Azure: Microsoft Defender for Cloud, Azure Policy, Entra ID Conditional Access, Activity Log export to Log Analytics
Enforce least privilege and short-lived credentials
Move human access to SSO with MFA. Replace long-lived access keys with IAM Identity Center or Azure Managed Identities. Review privileged access quarterly.
Build detection and response before you need it
A misconfiguration becomes a breach when no one is watching. Feed logs into a SIEM, define playbooks for the top five cloud incident scenarios, and rehearse them. Incident Response Planning
Continuous, not annual, assurance
Run automated configuration scans weekly. Track drift. Treat every finding as a ticket with an owner and a deadline.
The Bottom Line
Cloud security misconfigurations are the single most preventable cause of breaches facing African enterprises today. The technology to fix them is already in your AWS or Azure subscription. What is usually missing is ownership, a baseline, and a rhythm of review.
Want to know where your organisation stands? SecureZaidi offers a structured gap assessment to get you started.