Performing changes

Beyond using policies and tags to control compliant management of resources, these same features, along with others, may be used to restrict changes. Each of the cloud providers offers a way of grouping resources together for ease of classification. Both at a group and individual level, settings can be applied to lock the resource against changes or to restrict the level of changes that can be made (as shown in Figure 5.7), in addition to role assignments and access policies, as covered in Chapter 3, Identity and Access Management Controls:

Figure 5.7 – Example Microsoft Azure read-only lock applied

This level of restriction may not be readily apparent when discussing access controls, which is why organizations must document their system architecture. As auditors, we must understand that cloud providers offer a complex mix of controls that can be applied.

Now that we have looked at additional options for controlling changes...