Cloud Security Review (AWS)
Most cloud breaches are not caused by clever exploits. They come from misconfiguration: an over-permissive IAM role, a public S3 bucket, a forgotten access key. A cloud security review finds these issues in your AWS account before someone else does.
During five years at INDmoney I worked on securing AWS infrastructure for a fintech platform, and I bring the same practical approach to your environment.
What I review
- Identity and access (IAM): over-privileged users and roles, unused access keys, missing MFA and privilege escalation paths.
- Storage: S3 bucket policies, public access, encryption and versioning.
- Network exposure: security groups, public instances, load balancers and VPC design.
- Logging and detection: CloudTrail, GuardDuty, Config and alerting coverage.
- Secrets and data: secrets in code, environment variables and instance metadata, and KMS usage.
- Compute and containers: EC2, Lambda, ECS/EKS configuration and the IMDS settings.
How I work
- Access: you provide read-only (SecurityAudit) access to the accounts in scope.
- Automated baseline: a configuration review against the CIS AWS Foundations Benchmark.
- Manual review: I look for the attack paths automated tools miss, such as chained IAM permissions.
- Optional testing: penetration testing of internet-facing cloud assets.
- Reporting and retest.
What you get
- A prioritised list of misconfigurations with the risk each one creates.
- Exact remediation steps (console, CLI or Terraform guidance).
- A short list of quick wins you can fix the same day.
- A recheck after fixes.
Related services
Many teams pair this with DevSecOps work so misconfigurations are caught in the pipeline, not in production.
Get started
Tell me what you want tested, how large it is and when you need it, and we can agree a scope. Based in India? See how I work with companies across India. Contact me to discuss your AWS environment.