Topic starter
06/01/2026 4:31 pm
TL;DR: Recurring risks including unencrypted RDS data, IAM misconfigurations, plaintext secrets, non-compliant data flows, and weak logging across S3, EC2, IAM, and Secrets Manager surfaced in Cyera Research Labs' 2025 telemetry from enterprise AWS environments, according to Cyera. The finding is not that AWS is inherently unsafe, but that control failure accumulates where data, identity, and policy drift apart.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Assessing the Top Data Security Risks in AWS Environments”.
Key questions
Q: What breaks when AWS data security controls are managed separately from IAM?
A: The main failure is that permissions can expand the real attack surface faster than data owners realise.
Q: Why do plaintext secrets and unencrypted cloud data create so much risk?
A: Because they preserve value for an attacker even when other controls hold.
Q: How do security teams know if cloud logging is actually working?
A: Cloud logging is working when teams can reconstruct who accessed critical assets, when the access happened, and what was touched across the full environment.
Practitioner guidance
- Map effective AWS access paths Inventory which IAM roles, service accounts, and federated users can reach each sensitive data store, then compare those paths to the data classification of each asset.
- Eliminate plaintext secret storage Search workloads, attached volumes, and deployment artefacts for embedded usernames, passwords, and credentials, then replace them with managed secret retrieval patterns.
- Require encryption for sensitive RDS instances Make encryption a baseline creation control for databases that store regulated or high-value data, and verify that exceptions are formally approved and time-bound.
Bottom line: The core AWS risk in this research is control drift across IAM, secrets, logging, and data placement rather than an inherent flaw in the platform.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:30 pm
Control drift, not cloud complexity, is the dominant AWS data security failure mode. The article’s central pattern is that identity permissions, secrets handling, and data placement are being managed independently even though attackers and accidental exposure exploit their overlap. Cyera’s telemetry points to the operational gap: organisations secure the service, but not the effective access path. The practitioner conclusion is that AWS risk is governed by how controls drift together, not by any single service defect.
A few things that frame the scale:
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: Should organisations prioritise IAM cleanup or data encryption first in AWS?
A: If sensitive data is already exposed through broad permissions, IAM cleanup usually comes first because it reduces who can reach the asset at all. If data is sitting unencrypted in a high-value store, encryption becomes urgent because it reduces the value of any successful access. In practice, the right order depends on which exposure path is currently widest.
👉 Read our full editorial: AWS data security risks expose IAM and secrets gaps at scale