Cloud Security Best Practices

Cloud Security Best Practices#

The flexibility and openness of the cloud is a great asset to research but can also open you up to the possibility of unintentionally providing access to data or resources to unauthorized users. A misconfigured cloud environment can lead to data exposure, unauthorized access, and unexpected costs, regardless of whether compliance requirements apply to your data. The practices below will help you reduce the risks associated with using the cloud.

Best Practices#

Follow these best practices when using the cloud in your research:

  • Grant only the necessary permissions. Follow the principle of least privilege: give users and services the minimum access needed to perform their tasks. In practice, this means when adding lab members or collaborators to your cloud account, assign them a role that matches what they actually need (such as read-only access to a storage bucket) rather than giving everyone administrator-level access. This reduces the risk of accidental or unauthorized changes.

  • Use IAM roles instead of hardcoded credentials. Identity and access management (IAM) roles are the cloud’s built-in way to control who and what can access your resources. When granting access to lab members, pipelines, or automated tools, assign them an IAM role rather than sharing or embedding access keys in code or configuration files. This is more secure, easier to manage, and makes it straightforward to revoke access when someone leaves the project.

  • Use individual credentials, not shared logins. Ensure every user has their own credentials and permissions. Avoid shared accounts and use IAM controls to track and manage access clearly.

  • Configure budget alerts. Use cloud-native tools, such as AWS Budgets, Azure Cost Management, or GCP Budgets, to set spending limits and receive alerts for unexpected costs. Review usage reports regularly to catch misconfigurations or unused resources early.

  • Enable multi-factor authentication (MFA). MFA requires a second verification step (such as a phone prompt) in addition to a password, making it significantly harder for unauthorized users to access your account. Northwestern enforces MFA for all Northwestern-affiliated cloud account logins by default, so no additional setup is required on your end. If you are adding external collaborators to your account, confirm that MFA is enforced for their access as well.

  • Manage API keys securely. API keys are credentials that allow scripts, pipelines, or external tools to access your cloud resources programmatically. If your research involves automated workflows, data pipelines, or any code that connects to cloud services, this applies to you. Avoid storing API keys directly in code or public repositories such as GitHub; if exposed, they can allow unauthorized access to your account and data. Use environment variables or a secrets manager, such as AWS Secrets Manager, Azure Key Vault, or Google Secret Manager, to store keys securely. Rotate API keys regularly and revoke any unused or exposed keys immediately.

For guidance on your specific environment, request a Research Cloud Consult to review your data storage needs, security configurations, and compliance requirements.

Working with Sensitive or Regulated Data#

Public cloud platforms, with appropriate security controls enabled, can support Northwestern Level 1 and Level 2 data, and in some cases Level 3 data. Level 3 data includes information subject to HIPAA, PII, PHI, or other regulatory requirements; additional controls and approvals are required before storing this data in the cloud. Review Northwestern’s data classification levels and approved storage options to determine your data’s classification level. If your data may be Level 3 or higher, review the available options for regulated research before proceeding.

Northwestern maintains a Business Associate Agreement (BAA) with both AWS and Microsoft Azure, which is required to store HIPAA-covered data (PHI) in those environments.

Feinberg School of Medicine researchers working with regulated data should consult FSM IT, which maintains a Business Associate Agreement with Microsoft and provides dedicated guidance for FSM research groups. Contact fsmhelp@northwestern.edu with questions about FSM data storage requirements.

If you are unsure whether your data can be stored in the cloud or which platform and controls are appropriate, request a Research Cloud Consult .