Cybersecurity
AWS security
In AWS, nearly everything is an API call authorized by an IAM policy. Our reviews start with identity, then follow it into data, network and logging.
The problem this service solves
AWS environments grow by account and by team. Over time policies accumulate wildcard permissions, roles trust accounts that no longer exist, access keys outlive the people who made them, and logging is configured in some accounts and not others.
The common thread in AWS incidents is a credential with more permission than anyone remembered. We trace how identities can reach other identities, since the escalation path matters more than any single policy.
What is in scope
-
IAM
Policies, roles, trust relationships, permission boundaries, access keys, MFA, privilege escalation paths such as iam:PassRole and policy editing.
-
AWS Organizations
Account structure, service control policies, delegated administrators and guardrails.
-
Data protection
S3 bucket policies and public access settings, KMS key policies, RDS and snapshot sharing, secrets in Secrets Manager and Parameter Store.
-
Network
VPC design, security groups, NACLs, public endpoints, VPC endpoints, Transit Gateway and peering.
-
Logging and detection
CloudTrail coverage, log integrity and retention, GuardDuty, Security Hub, Config and alerting.
-
Compute
EC2 metadata service version, patching, container and Lambda permissions, image sources.
-
Delivery pipeline
CodeBuild, GitHub Actions or other CI roles, deployment permissions, state files.
How the work runs
Collect
Read-only visibility.
-
1
Audit role
Create a read-only role in each account for assessment.
-
2
Automated baseline
Run configuration checks against CIS and best practice, then triage results.
Analyze
Focus on identity paths.
-
3
Permission analysis
Evaluate effective permissions and build role-assumption and escalation graphs.
-
4
Manual review
Inspect high-risk areas that tools score poorly: trust policies, resource policies, pipelines.
Improve
Act.
-
5
Prioritized plan
Group fixes by impact and effort, with least-privilege policy suggestions.
-
6
Guardrails
Recommend SCPs and automation to prevent regression.
What you receive
- Executive summary
- Findings by service and account
- IAM escalation path analysis
- Least-privilege policy suggestions
- Logging and detection gap list
- Guardrail recommendations (SCPs, Config rules)
- Retest results
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Read-only audit access in the accounts in scope
- An account diagram and list of owners
- Description of sensitive data stores
- CI/CD and IaC repository access if pipelines are in scope
What this service is not
- A cost optimization review
- A compliance audit or attestation
- Changes to your accounts (we recommend, you apply)
What changes afterwards
- You can see how identities can reach other identities
- Permissions shrink where they enable escalation
- Logs cover every account and cannot be quietly disabled
Questions people ask
Do you need administrator access?
No. A read-only security audit role is enough for assessment. We do not need to change anything.
What is the usual first finding?
Over-broad IAM: wildcard actions, roles that anyone in the account can assume, and unused access keys. The fix is rarely hard, but it needs ownership.
Do you cover AWS Control Tower and Landing Zone?
Yes. We review guardrails, account factory permissions and logging architecture as part of the multi-account design.
Related
-
Cloud penetration testing
Starting from a defined foothold, test whether identity, permission and trust paths in AWS, Azure or Google Cloud lead to sensitive data or control.
-
DevSecOps
Add security checks to the delivery pipeline: source, dependencies, secrets, infrastructure as code, containers and deployment permissions.
-
Zero trust architecture
Plan and implement zero trust principles: strong identity, device health, segmentation, least privilege and continuous verification.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response