1. MFA on every account
Turn on multi-factor authentication for every human account that can reach your cloud, including the old admin account created on day one. Keep one or two "break-glass" accounts for emergencies, with strong MFA, stored credentials and an alert whenever they are used.
2. Get rid of long-lived keys
A downloaded service account key is a password that never expires and often ends up in a repository, a CI variable or a laptop. List the keys that exist, find out what uses each one, and replace them with short-lived credentials: workload identity for workloads, and impersonation for people and pipelines. Then delete the keys.
3. Nothing public by accident
Look for storage buckets readable by anyone, and firewall rules that allow 0.0.0.0/0 on SSH (22), RDP (3389) or database ports. Each one should either have a clear reason to be public, or be closed today. Databases in particular should only be reachable from your own services.
4. Replace Owner and Editor
The basic Owner and Editor roles grant almost everything. They are convenient, which is exactly why they spread. Review who has them, keep Owner for very few people, and give everyone else the predefined roles that match what they do. Access recommendations in your cloud console often point out permissions that were never used.
5. Audit logs and alerts on access changes
Make sure admin activity logs are kept somewhere application teams cannot delete, and add alerts for the changes that matter: new owners, new service account keys, and changes to firewall rules or bucket permissions. You do not need a security operations centre to get a message when someone becomes an owner of production.
Make it stick with guardrails
Fixes drift back unless something prevents it. On Google Cloud, organisation policies such as iam.disableServiceAccountKeyCreation (no new keys) and storage.publicAccessPrevention (no public buckets) turn today's cleanup into a rule. Apply them to a test folder first, then to everything.
If you would like help finding where your real risks are, book a Cloud Security Review and Hardening Audit: we review your setup, rank what we find and fix the important things with you.