AWS account security
and cost, reviewed.
We review how your AWS accounts are protected and billed, using exports and screenshots you choose to share, and give you a written report of root account, IAM, logging, network exposure and idle-resource findings, ranked by what to fix first.
Who it is for
Organisations running workloads in AWS, alone or alongside Microsoft 365 and Azure, that want an independent check of account hygiene and spend.
What we review
- Root user protection. AWS’s root user guidance covers multi-factor authentication, no access keys for the root user, a group email address, restricted account recovery and monitored use. The report checks each point for every account.
- MFA for people. whether IAM users and other human sign-ins use MFA. AWS recommends phishing-resistant MFA such as passkeys and security keys where possible.
- Human and workload access. AWS recommends federation with an identity provider and temporary credentials for people, and roles for workloads. The report counts IAM users and long-lived access keys that remain.
- Access keys. age, last use and ownership of long-term access keys, and keys no one uses.
- Least privilege. how often broad administrator permissions are used, and whether IAM Access Analyzer is used to review and generate narrower policies.
- AWS Organizations and SCPs. account structure and service control policies. AWS notes SCPs set permission guardrails, do not grant permissions and do not affect the management account.
- Logging. whether CloudTrail trails exist, which events and regions they cover, where logs are stored and who can change or delete them.
- Threat detection and posture. whether GuardDuty is enabled (its foundational sources include CloudTrail management events, VPC flow logs and DNS logs) and whether Security Hub is used for posture findings, as applicable.
- Network exposure. security groups open to the internet on administrative ports, public IP addresses and public storage. AWS documents S3 Block Public Access, and CISA advises not exposing remote desktop services on the web.
- Cost and idle resources. unattached volumes, idle load balancers, stopped instances still incurring storage, and savings plan or reservation coverage in the exports. Trusted Advisor checks depend on your support plan, so the report notes which you have. AWS Budgets can track spend and take action.
- Backup and recovery. which resources have backups or snapshots and whether restores have been tested.
What you get
A written report, delivered through the channel agreed in the quote. It contains:
- An executive summary in plain language
- An account-by-account table of root, MFA, logging and detection status
- Findings with severity and the evidence behind each one
- Cost findings with their evidence (no savings are promised)
- A fix-first list, a 30/60/90-day plan, and a list of what was not checked
See the format in the fictional report sample (sample, fictional data).
What we need from you
- A named contact with authority over the AWS accounts
- Exports or screenshots named in the scope, such as the IAM credential report, Organizations structure, CloudTrail and GuardDuty status, security group listings and a cost export
- A list of accounts and their purposes
How it works
- Send an enquiry. Tell us the question. Keep credentials and customer data out of it.
- Agree the written scope. We propose scope, fee and timing in writing. Nothing starts until both sides accept it.
- We review what you choose to share. We read only the exports and screenshots in the agreed scope. We do not sign in to your AWS accounts or use cross-account roles.
- You get a written report. It says what was checked, what was not, and suggested next steps.
- Any change is approved separately. A report does not authorize changes; anything that changes needs its own written approval.
See what the report looks like: Read a fictional report sample (sample, fictional data). How we handle your information: Trust and data handling.
What we need from you. A named contact with authority, and a small set of evidence you choose to share through a channel we agree in writing first. Please do not send credentials, access tokens or customer exports through the enquiry form.
What we do not do. We do not sign in to AWS, create roles, change settings, delete resources or deploy anything. We promise no savings and give no security guarantee.
What needs separate approval. Any change to IAM, SCPs, logging, networking or resources, any deployment, and any follow-up check after changes.
Questions before an enquiry
Do you need access to our AWS accounts?
No. Your administrator exports the reports named in the scope and shares them through the agreed channel.
Will you tell us how much we will save?
No. The report lists idle or oversized resources with the evidence so you can decide. We do not promise savings.
Is this a penetration test?
No. It is a configuration review of the evidence you share.
Do you cover Azure and Microsoft 365 as well?
Not in this review. See the Azure landing zone and cost review and the Microsoft 365 reviews.
Which AWS documentation do you follow?
AWS’s own IAM, Organizations, CloudTrail, GuardDuty and Security Hub guidance, as linked on this page. Check current AWS documentation, as services change.
Free tools, reading and vendor documentation
Microsoft documentation (opens in a new tab). Product behaviour and licensing change, so check current Microsoft documentation before acting:
Ready to start?
Tell us what you need. We reply to confirm fit and to propose scope, fee and timing in writing.