IAM is the real perimeter
Every cloud API call is an authorisation decision over principal, action, resource and condition. Grant least privilege, prefer roles that are assumed temporarily over long-lived keys, and require MFA on human accounts.
Workload identity
Applications should receive short-lived credentials from an instance role, a Kubernetes service account bound to a cloud identity, or OIDC federation from CI. Static access keys in environment variables or repositories are the most common root cause of cloud compromise.
Data protection
Encrypt at rest with managed keys (or customer-managed keys where policy requires) and in transit with TLS everywhere, including internal service-to-service traffic. Keep secrets in a secret manager with rotation and audit logging — never in images, config files or source control.