The First Hour After Taking Over a Cloud Account

The order of operations matters here. Several common checklists are correct in content and wrong in sequence, which leaves a window where you have alerted anyone watching without yet removing their access.

The sequence below closes the identity doors first, then the programmatic ones, then looks around.

1. Change the password

Set a long unique password stored in a password manager. This is first because everything else assumes you are the only person who can sign in.

2. Reconfigure the second factor

Do not merely confirm that two-factor authentication is enabled. Remove existing factors and enrol your own device. An existing factor registered to someone else is equivalent to them still holding the password.

Store any recovery codes offline and treat them as credentials in their own right.

3. Take the recovery paths

This is the step most often skipped, and the one that undoes the first two if it is missed. Update:

• The primary account email address.
• Any secondary or recovery email.
• Recovery phone numbers.
• Security questions, where they still exist.

A password reset sent to an address you do not control hands the account straight back.

4. Revoke programmatic access

API keys, personal access tokens and service credentials bypass passwords and second factors entirely. List every one and revoke anything you did not create. Generate fresh credentials for your own automation afterwards, not before. See rotating credentials and API keys.

5. Review human and machine identities

Check IAM users, roles, service accounts and any directory entries. Remove principals you cannot account for. On providers with several layers, such as Azure’s tenant and subscription split, check both.

6. Inventory what is running

Only now look at resources, and look in every region rather than the one you intend to use. Note compute, storage, reserved addresses, snapshots and scheduled tasks. The method is in auditing an unfamiliar cloud account.

7. Turn on logging

Enable the provider’s audit trail across all regions and direct it somewhere durable. Logging started now answers questions asked next month; logging started next month does not.

8. Set budget alerts

Set a threshold meaningfully below your expected monthly spend. An alert that fires at your expected total arrives too late to be useful.

9. Write it down

Record what you received, what you changed and when. Ten minutes now saves an afternoon later, as described in documenting a cloud account handover.

A note on scope

None of this changes the fact that the provider’s terms of service govern the account. Securing an account is about controlling access to something you are responsible for, not about avoiding provider rules.