An insurer runs its private cloud behind a VPN-connected perimeter, but the cloud provider's admin portal for all customers is reachable from the internet. What does that mean, and what can still be done?

Question

Accepted Answer

The admin portal is a public backdoor into the private cloud perimeter. Since the provider serves many customers it can't be made private, and moving back on-premises is no longer an option, so the public admin access must be secured as well as possible: multi-factor authentication, monitoring of access, and minimising organisational risks such as those from staff changes.

* The provider's management plane sits outside any perimeter the customer builds, so it must be hardened instead. *
The case continues the insurer from the perimeter example, whose private cloud was set up through exactly that portal. A routine audit of all privileged (admin) accounts asked how access to admin tools is organised, and found that whoever logs into the portal controls the whole cloud network, firewalls and VPN included, regardless of how closed the perimeter is.
The general lesson: a perimeter is only as closed as its management plane. Cloud resources come with a provider-run control interface, usually on the internet, that sits outside any perimeter you build. Since you cannot remove it, you harden the access to it instead. Staff changes are named explicitly because people who leave often keep admin credentials or MFA devices longer than they should.
Go deeper:

MITRE ATT&CK T1078.004 — Valid Accounts: Cloud Accounts — attackers using stolen cloud admin credentials.
 Multi-factor authentication — Wikipedia — the first of the minimum measures.
 NCSC — Cloud security shared responsibility model — which parts of a cloud setup the provider controls and which you do.