Most cloud firewalls evaluate rules in a defined order, and earlier allow rules can override later deny rules. Direction also matters—outbound rules are evaluated separately from inbound ones.

It’s common to focus on the presence of a rule without checking how it’s evaluated in context. Overlapping rules, defaults, or inherited policies can all affect the outcome.

Takeaway: Firewall behavior depends on evaluation order, not just rule intent.

Cloud IAM systems look unified on the surface, but each service evaluates permissions differently behind the scenes. Some services require additional implicit permissions, while others enforce stricter resource-level checks.

Cross-service interactions are especially tricky. A role might have permission to read from one service but still fail when that service tries to invoke another on its behalf. These dependencies aren’t always obvious when writing policies.

Effective troubleshooting means reviewing service-specific permission requirements rather than assuming a single policy behaves the same everywhere.

Takeaway: IAM consistency requires understanding how each service enforces access, not just writing valid policies.

Rate limiting controls how frequently a single source can make requests, but it doesn’t account for distributed or adaptive behavior. Attackers often spread traffic across multiple IPs, tokens, or accounts to stay below thresholds while still causing harm.

This makes rate limiting effective against simple abuse but insufficient on its own against determined attackers. Additional signals such as behavior patterns, authentication context, and anomaly detection are needed to distinguish normal use from abuse.

Relying on rate limiting alone often creates a false sense of protection.

Takeaway: Rate limits reduce noise, but they don’t stop intent-driven abuse.