“Cloud migration without rethinking security is just moving problems to a new address.”

Summary

Lift and shift can be fast, but it rarely makes the platform safer. A secure cloud foundation is planned first. Use Single Sign-On (SSO) with Multi-Factor Authentication (MFA) to secure all accounts and simplify access management. Apply the principle of least privilege so users and systems only have the permissions they need. Encrypt all data both in transit (using TLS) and at rest.

Enable centralized logging, metrics, and tracing across your environment to monitor activity and detect issues quickly. Manage infrastructure and configurations as code to ensure consistency, version control, and automated compliance.

Why lift and shift falls short

Moving virtual machines to the cloud reduces data center work, but it keeps old assumptions. On prem trust based on networks and firewalls does not fit cloud. The result is broad access, unknown paths, and weak visibility. Treat the move as a chance to reset identity, network boundaries, data protection, and operations so day one is safer and easier to run.

Principles for a secure cloud

1. Identity first. Trust identities, not IP addresses. Require strong sign in and narrow authorization.
2. Least privilege. Start with deny. Grant only what a role needs. Use short lived access with approvals and logs.
3. Protect data. Encrypt in transit and at rest with a managed key service. Classify data. Isolate sensitive stores. Limit who can use keys.
4. Observability. Centralize logs, metrics, and traces. Define alerts that lead to action. Practice the response.
5. Everything as code. Keep infrastructure, policies, and guardrails in version control. Run checks in CI and at deploy. Detect and fix drift.
6. Shared responsibility: The provider secures the platform. You secure what runs on it. Make that clear in policy, code, and daily work.

A reference foundation for any major cloud

• Accounts and projects: Separate dev, staging, and prod. Use a landing zone to standardize guardrails and provisioning.
• Identity and access: Central identity provider with SSO and MFA. Least privilege roles for people and workloads. Short lived credentials and regular access reviews.
• Network: Virtual networks per environment with private subnets and default deny rules. Private service endpoints. Segmentation for east west traffic and managed gateways at the edge.
• Secrets and keysCentral secrets manager with rotation. Key management service with customer managed keys and clear ownership.
• Data: Object storage with public access blocked by default. Managed databases with encryption and automatic backups. Disk encryption and point in time recovery where available. Backups are tested.
• Observability: Central metrics, logs, traces, and activity logs. Configuration inventory and drift detection. Alert routing and runbooks.
• Protection services: Posture management, workload and container scanning, sensitive data discovery, web app firewall, and DDoS protection.
• Delivery and policy as code: Pipelines that deploy infrastructure as code such as Terraform or a native framework. Policy checks with tools like Open Policy Agent or native controls.

The migration playbook

Plan
Run an architecture review on target workloads. Classify data. Map dependencies. Set guardrails and KPIs. Choose the account and project model and define the landing zone.

Prepare
Stand up in the landing zone. Enable activity logging and configuration recording across the organization. Turn on posture management and threat detection in a central space. Create log archive and security tooling spaces. Define network baselines, a key plan, and permission models.

Pilot
Migrate a sample workload into a non production environment. Validate access paths, logging, dashboards, backups, and rollback. Run incident drills and fix gaps.

Migrate
Move in waves. Use replication tools for servers when a direct move fits. Use managed database migration for data. Cut over with blue green or canary patterns and controlled routing. Keep rollback plans ready and rehearsed.

Operate and improve
Enable baseline standards across all environments. Close findings quickly. Clean up access. Measure progress. Track compliance with policy packs.

Five pitfalls to avoid

1. Do not copy your on premises setup to the cloud. Use cloud native controls like granular permissions, encryption by default, and clear network segmentation.
2. Do not ship with broad roles or admin access. Limit permissions and review them often.
3. The provider secures the platform and you secure what runs on it. Patch compute, lock down storage, and turn on logging.
4. Monitor from day one. Centralize logs, metrics, and traces. Add alerts, health checks, dashboards, and regular audits.
5. Protect data during moves. Encrypt in transit and at rest, use private transfer paths, mask sensitive fields, validate integrity, enforce least privilege, and run dry runs with rollback plans.

What good looks like on day one

• All users sign in through the central identity provider with MFA and roles mapped to least privilege. Break glass credentials are locked down.
• Production changes flow through CI with infrastructure as code, policy checks, and approvals.
• Secrets live in a central manager and rotate on a schedule.
• Public access is blocked by default in object storage. Data stores are encrypted. Backups are tested.
• Activity logs and configuration recorders are on across all environments. Logs land in a central encrypted store.
• Posture and threat detection are on across the organization. Findings are routed and tracked to closure.

KPIs to prove progress

• Share of accounts and projects enrolled in landing zone guardrails
• Share of users covered by SSO and MFA
• Share of storage with public access blocked and encryption on
• Organization wide activity log coverage
• Time to close high severity findings
• Vulnerability scan coverage and mean time to patch critical issues
• Share of resources compliant with policy packs
• Number of active break glass credentials and number of public storage buckets both at zero

Your next step

Ready to trade lift and shift for a secure foundation. Read our Cloud Migration Playbook and see how we add zero trust to every journey.