Wiz outlines cloud VPC lateral-movement risks and five defenses

Summary

Wiz describes how attackers can move between cloud workloads and VPCs using exposed credentials, IAM permissions, peering, and vulnerabilities, and recommends five network defenses. Its research found exposed workloads with cleartext long-term cloud keys in about 58% of

Key points

Wiz Research found that about 58% of cloud environments had at least one publicly exposed workload containing a cleartext long-term cloud key; about 35% had one containing a cleartext private SSH key.
Attackers who compromise a workload may use stored credentials, remote services, IAM permissions, or vulnerabilities to reach other workloads and cloud resources.
VPC peering can enable movement between networks when it permits unrestricted access; the article contrasts this with more restricted, unidirectional private-link connections.
The article recommends applying least privilege to security-group and network ACL rules, and removing cleartext long-term cloud and private keys from workloads.
Other recommended measures include promptly remediating critical vulnerabilities, separating environments into distinct VPCs, and using bastion hosts or cloud-provider access services for remote access.

Article Details

Defense Focus: Reduce cloud VPC lateral-movement risk by limiting network access, removing exposed long-term credentials, remediating critical vulnerabilities, and isolating environments.
Detection Methods: Inventory publicly exposed workloads and identify those containing cleartext long-term cloud keys or private SSH keys.
Map VPC connections, resource relationships, and effective IAM permissions to identify lateral-movement paths and high-value assets.
Scan workloads for critical vulnerabilities and security misconfigurations, including network-reachable internal VMs and weak authentication.
Review security-group and ACL rules for unnecessarily broad access.
Data Sources: Cloud-provider APIs and resource inventory
IAM identities, effective permissions, and attached roles
VPC, subnet, security-group, and ACL configurations
Workload storage and configuration containing cloud keys or private SSH keys
Vulnerability and exposure data for cloud workloads
Platforms: AWS
Azure
GCP
Defensive Actions: Apply least privilege to security-group and ACL rules, restricting access to specific IP addresses and required ports.
Remove cleartext long-term cloud keys and private SSH keys from workloads; use least-privileged roles that issue temporary credentials.
Use Bastion hosts or provider services such as AWS SSM API and GCP Identity-Aware Proxy for remote access rather than exposing ports or relying on password authentication.
Remediate critical vulnerabilities on both internet-exposed and non-exposed workloads promptly.
Separate environments into VPCs by function or group to improve visibility and limit breach impact.
Prefer restrictive, unidirectional Private Link connections over broad bidirectional VPC peering where appropriate.