AWS compute and workload security

Every EC2 instance, container and Lambda function in your accounts should be hardened, patched and backed up. Our AWS compute security review checks each workload against that standard and lists the ones that fall short.

EC2 hardening & endpoint protection

On each EC2 instance we check that IMDSv2 is enforced and EBS volumes are encrypted, and we look at public IP exposure and instance profile permissions. Where endpoint protection agents are installed, we confirm they're healthy and still reporting in, and we flag any instances that don't have one.

Patch management

Unpatched servers are one of the most common ways attackers get in, so we use AWS Systems Manager Patch Manager to measure OS and application patch compliance across your EC2 fleet. The results show which instances are missing critical or security patches, which aren't enrolled in a patch baseline and where patching jobs have failed.

Container & ECS/EKS security

For containerised workloads we review ECR image scanning, ECS task role permissions and EKS cluster security settings, including pod security policies. We look for containers running as root and images with known vulnerabilities, as well as task or pod roles with permissions broad enough for an attacker to exploit.

Lambda & serverless configuration

Each Lambda function's execution role, VPC placement and runtime version gets checked, along with whether secrets are being passed in through environment variables. We flag functions on deprecated runtimes and any whose IAM role grants more than the function uses.

Backup & disaster recovery

We review AWS Backup vault configuration, backup plans and retention policies, and check that backup jobs are completing. Production resources without a backup are listed, and we assess whether the current set-up would meet your recovery point and recovery time objectives (RPO and RTO).

Other AWS reviews

Also on Azure? See our Azure endpoint and VM security review.

Talk to us