The Shared Responsibility Model: A Dangerous Misunderstanding
Many startup founders assume that migrating to AWS or Azure inherently makes them secure. This is a fatal misunderstanding of the Shared Responsibility Model. AWS is responsible for the security of the cloud (the physical data centers, the hypervisors, the network hardware). You, the fintech, are entirely responsible for security in the cloud (customer data, IAM policies, operating system patches, network firewall configurations).
When a Nigerian fintech leaks 50,000 KYC documents, it is almost never because AWS was hacked. It is because a junior developer accidentally attached a "Principal": "*" policy to an S3 bucket. This checklist prevents those exact unforced errors.
1. Identity and Access Management (IAM): The New Perimeter
In the cloud, your network firewall is secondary. Identity is your primary perimeter. Compromised cloud credentials are the primary vector for devastating infrastructure breaches.
- MFA Enforcement is Non-Negotiable: Multi-Factor Authentication (MFA) must be strictly enforced for all IAM users, with absolutely no exceptions. The root account must be secured with a hardware MFA token (like a YubiKey) and the credentials locked in a physical safe.
- Least Privilege Roles for Compute: Never attach broad, administrative IAM policies to EC2 instances or Lambda functions. If an instance only needs to read from a specific S3 bucket, its attached IAM role must explicitly restrict it to
s3:GetObjecton that specific bucket ARN. This prevents lateral movement if the instance is compromised via a web vulnerability. - No Hardcoded Credentials: Access keys must never be hardcoded in source code or committed to Git repositories. Developers should use AWS SSO or temporary STS tokens for local development.
- Automated Key Rotation: Establish a policy where programmatic access keys older than 90 days are automatically disabled or rotated. Monitor for unused IAM users and aggressively prune them.
2. Storage, Data Security, and Localization
Leaking KYC documents, BVN slips, or transaction logs from an open storage bucket is a career-ending event that triggers immediate CBN and NDPC investigations.
- Block Public Access at the Account Level: In AWS, enable "Block Public Access" at the account level. Any specific buckets requiring public access (e.g., serving frontend React assets) must be explicitly isolated and managed via CloudFront, not direct bucket access.
- Encryption Everywhere: All EBS volumes, RDS databases, and S3 buckets must be encrypted at rest using KMS (Key Management Service) or Azure Key Vault. Enforce encryption in transit (TLS 1.2 minimum) for all internal microservice communications.
- Database Isolation: Databases (RDS, Aurora, Postgres) must reside in deeply nested private subnets. They must have no public IP addresses assigned. Access should only be allowed via specific application security groups or a heavily monitored bastion host accessed via a VPN.
- Data Localization Compliance: Understand CBN's data localization rules. Core financial ledgers and sensitive PII of Nigerian citizens often need to be hosted domestically. Many successful Nigerian fintechs employ a hybrid cloud model: running stateless compute APIs in AWS eu-west-1 (Ireland) or eu-west-2 (London) while keeping the core transactional database in a local Tier III facility like MDXi or Rack Centre.
Need a professional review of your AWS or Azure infrastructure?
Book a Cloud Architecture Review3. Network Configuration (VPC)
A flat cloud network allows an attacker who compromises a single low-level web server to immediately pivot and attack the database layer.
Security Groups as Allow-Lists
Security groups must act as strict, default-deny allow-lists. Ensure management ports like 22 (SSH) and 3389 (RDP) are never open to the public internet (0.0.0.0/0).
Network ACLs
Use Network ACLs as a secondary, stateless defense layer to block known malicious IP ranges at the subnet boundary, effectively dropping bad traffic before it reaches your instances.
WAF Integration
A Web Application Firewall (AWS WAF, Azure Front Door, or Cloudflare) must be deployed in front of all public-facing payment APIs to block SQLi, XSS, and to rate-limit abusive automated fraud traffic.
4. Secrets Management
Fintechs run on API keys: Paystack, Flutterwave, Termii, Dojah, NIBSS integration certificates. If these leak, the attacker can drain funds or bypass KYC.
- Centralized Vaults: Never store secrets in environment variables on the server or in .env files. Use AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault.
- Dynamic Fetching: Applications should dynamically fetch secrets at runtime. The application authenticates to the Vault using its assigned IAM role, proving its identity before the secret is dispensed.
5. Logging, Monitoring, and Incident Response
If you are breached, logs are the only way to determine exactly what the attacker accessed. Without logs, you must assume total system compromise.
- CloudTrail Enabled Globally: AWS CloudTrail (or Azure Monitor) must be enabled in all regions (even regions you don't actively use), logging all API activity across the account.
- Immutable Log Storage: Logs must be stored in a dedicated, restricted S3 bucket in a separate, isolated AWS account. Enable MFA Delete and Object Lock to prevent attackers from modifying or deleting logs to cover their tracks.
- Threat Detection: Enable services like Amazon GuardDuty or Azure Security Center to alert on anomalous behavior, such as API calls originating from unusual Tor exit nodes or instances attempting to contact known crypto-mining command servers.
Aligning cloud posture with continuous compliance
Managing this checklist manually across hundreds of cloud resources is impossible. Tools like AWS Security Hub or third-party Cloud Security Posture Management (CSPM) platforms can continuously map your live infrastructure against compliance frameworks like PCI DSS, SOC 2, or the CIS Benchmarks. This transforms compliance from a stressful annual scramble into a continuous, measurable dashboard metric.
Frequently asked questions
Why do we need a cloud security checklist if we use managed services like AWS or Azure?
Under the Shared Responsibility Model, cloud providers secure the underlying hardware and hypervisors, but you are 100% responsible for how you configure your applications, network policies, IAM roles, and data storage. If you make an S3 bucket public, AWS will not stop you.
What is the most common cloud security failure in the Nigerian fintech sector?
Misconfigured storage buckets (like publicly accessible S3 buckets containing KYC documents or BVN slips) and overly permissive IAM roles that allow an attacker to move laterally across the network if a single EC2 instance is compromised.
Does the CBN mandate data localization, and how does that affect cloud choices?
Yes. The CBN and NDPC strongly prefer or mandate that core financial data and PII of Nigerian citizens reside within the country. Fintechs often navigate this by using hybrid architectures: storing core ledger data in local Tier III data centers (like MDXi or Rack Centre) while running stateless compute workloads in AWS eu-west-1 or similar regions.
How should a startup handle secrets like Paystack API keys?
Never hardcode them in your source code or .env files committed to Git. Use a managed service like AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault. Your application should dynamically fetch these secrets at runtime using IAM roles.
Related reading
Blog: 10-Point Security Checklist · PCI DSS Compliance Guide
Guides: Fintech Security Checklist · CBN Compliance Requirements
Services: Secure Architecture Review · Vulnerability Assessment