AWS Security Baseline Check

Who it is for

A startup or agency with one to three AWS accounts set up quickly over the years by different people, now facing a customer security questionnaire, a first enterprise deal, or India's DPDP Rules.

The problem

• Public buckets, SSH open to the internet and secrets in Lambda variables are found by automated scanners within hours.
• Nobody switched on CloudTrail, GuardDuty or spend alerts, so a stolen key would be noticed on the monthly bill.
• Generic scanners print hundreds of findings with no priorities, and nobody has time to turn them into fixes.

What I do

• A read-only role with an external ID and an explicit deny on reading data; your own CloudTrail records every call.
• Prowler runs 48 curated checks; two native checks add spend alerts and CI/CD keys; every finding is reviewed by a person.
• A scored report (A-F) with the top five risks in plain English and the evidence for each control.
• Fixes as code: inputs of an open-source Terraform security-baseline module, or one reviewed command. You apply them; I never need write access.
• A retest scan shows the new score, what was fixed and what is still open.

How it works

1. 1Authorisation letter and read-only role
2. 2Scan: 25 controls, read-only
3. 3Human review and top-5 risks
4. 4Fix pack: Terraform or commands
5. 5Walkthrough, you apply the fixes
6. 6Retest and access removed

Day by day

1. Day 0We sign a short authorisation letter naming the account, regions and dates; you create the read-only role from my CloudFormation template.
2. Days 1-2I run the scan and review every finding by hand: false positives out, intended exceptions noted, risks ranked for your business.
3. Day 3Report, fix pack and a 45-minute walkthrough. You apply the fixes, with my help on a screen share if you like.
4. Day 7-14Retest scan and updated report; you delete the role and I confirm the scan files are deleted.

Evidence from the demo

The evidence below comes from my own demo project with synthetic data. It shows exactly what you receive; it is not a story about a client.

• On a simulated account seeded with a fictional company's typical mistakes, the baseline scores 31/100 (F) before and 97/100 (A) after the fix pack - both reports are on this site.
• The demo runs the real Prowler checks against a simulated AWS account, and a Terraform sandbox builds a real, deliberately misconfigured account that is scanned and destroyed in one command.
• The fix pack is a tested Terraform module with one input per control; my own AWS account runs the same module.

Demo project: AWS Bill Doctor kit (cost + security)

Questions