AWS network and infrastructure review
Our AWS network review traces how traffic moves between your VPCs, subnets and the internet. We then check whether the boundaries and controls you have in place would stop unauthorised access, or stop an attacker who got in from moving sideways to other systems.
VPC design & security groups
We review VPC topology, subnet design and security group rules in every account and region. Problems we look for include overly permissive rules such as 0.0.0.0/0 ingress on management ports, and flat networks where workloads that should be isolated can reach each other freely. Unused or duplicate security groups are listed too, since they make the rules harder to audit.
Network ACLs & traffic flow
At subnet level, NACLs add a second layer of defence on top of security groups. We point out subnets that still rely on the default allow-all NACL and trace traffic between public, private and isolated subnets to confirm the boundaries match the architecture you intended.
Transit Gateway & VPC peering
In environments with several VPCs or accounts, we review Transit Gateway route tables, attachments and propagation settings. Routes that are too broad let traffic pass between VPCs that should be kept apart, so we identify those and check that peering connections and route tables give each VPC only the connectivity it needs.
WAF & DDoS protection
We assess the AWS WAF rule sets attached to CloudFront distributions and Application Load Balancers, along with those on API Gateways and your AWS Shield coverage. The aim is to confirm that every web-facing resource is protected against common attacks such as SQL injection, XSS and volumetric DDoS.
PrivateLink & VPC endpoints
We find places where workloads reach AWS services such as S3 or DynamoDB over the public internet when a VPC Endpoint or PrivateLink connection is available. Private connectivity keeps that traffic on the AWS backbone, which reduces exposure and can cut data transfer costs.
Other AWS reviews
Also on Azure? See our Azure network and infrastructure review.