AWS identity and access review
In the cloud, identity is the main security perimeter. This AWS identity and access review looks at who can reach what in your accounts and whether they should be able to, and at how you store and manage credentials and secrets.
IAM policies, roles & least privilege
Across your accounts we go through IAM users, groups, roles and policies looking for access that's broader than it needs to be. Common problems are policies with wildcard actions or resources and inline policies that sit outside central management. Unused roles and access keys are listed for removal, and we point out accounts where least privilege isn't being followed.
SSO & multi-factor authentication
We assess your AWS IAM Identity Center (SSO) configuration and permission sets. The checks cover MFA on the root account and whether every person signs in through SSO with no one using an IAM user, as well as whether session durations and access controls are appropriate.
Secrets Manager & Parameter Store
Credentials, API keys and connection strings belong in AWS Secrets Manager or Systems Manager Parameter Store. We check whether that happens consistently or whether some secrets sit in plain text in environment variables, code or CloudFormation templates, and we review rotation policies and who can read the stored secrets.
Other AWS reviews
- Security & compliance
- Network & infrastructure
- Compute & workloads
- Architecture & operations
- Cost optimisation
Also on Azure? See our Azure identity and access review.