Cloud Security Audit: IAM, posture and vulnerabilities in 2 weeks

Context

Most SMBs I meet already have a tool telling them they have a problem: Security Hub reporting 2,800 findings, a trial CSPM showing a 43% score, a customer security questionnaire sitting unanswered for three weeks. What’s missing isn’t detection. It’s someone to say what actually matters, in which order, and how to fix it without stopping the roadmap.

The typical picture: access keys from 2021 still active, an AdministratorAccess role assumable from a dev account, buckets encrypted with the default key, logs that exist but nobody could use on the day of an incident, and a team fixing findings in dashboard order rather than risk order.

This audit is a 2-week baseline, production focus. The scope: who can do what, on what, with which traces, and where an attacker would go first.

Who it’s for

• A cloud organisation of 3 to 50 accounts or subscriptions, with production in it
• A SOC2, ISO 27001, NIS2 or DORA audit announced in the next 6 to 12 months
• An enterprise customer sending a security questionnaire or requiring an attestation
• A CSPM (native or third-party) reporting thousands of findings with no usable prioritisation
• Fast growth where every team created its own roles, VPCs and secrets its own way
• A recent incident, or serious doubt about the ability to reconstruct one

What’s delivered

Week 1 — Mapping and identities

• Inventory of accounts, subscriptions, OUs, main workloads and sensitive data
• Full IAM review: human users, machine roles, access keys, cross-account, federation, MFA, effective permissions
• Privilege escalation paths and blast radius analysis (which compromised role gives access to what)
• Organisational guardrails review: SCPs, Azure policies, GCP org policies, root and break-glass accounts
• Collection and normalisation of existing CSPM findings

Week 2 — Posture, vulnerabilities and action plan

• Network architecture: public exposure, segmentation, cross-account flows, private endpoints
• Data protection: encryption, key management, backups, retention, backup access
• Logging and detection: CloudTrail or equivalent, centralisation, integrity, real ability to investigate
• Vulnerability management: images, hosts, dependencies, patching, prioritisation by exploitability (KEV, EPSS, actual exposure) rather than raw CVSS score
• CSPM recommendation: stay native, or move to a third-party tool, with an honest cost estimate
• 30/60/90-day action plan prioritised by exploitability and business impact, with estimated effort and dependencies

What’s not included

• Implementing the recommendations (covered by the retainer or a specialised engagement)
• Offensive penetration testing (we scope the engagement with a qualified partner if needed)
• Line-by-line application code review
• In-depth CI/CD pipeline and Kubernetes cluster hardening, covered by the Supply Chain & CI/CD offer

Format and timeline

Fixed price set after a 15-minute scoping call, 2 weeks from kick-off to deliverable. Scope, duration and deliverable are frozen before we start.

Access is via a dedicated read-only role, traced in your logs, revoked on the last day. No static keys.

The audit naturally leads into a security retainer to drive execution of the action plan if needed.

Why Distribuée

6 AWS certifications including 3 Professional/Specialty (Solutions Architect Pro, DevOps Pro, Security Specialty). Senior DevSecOps, 10 years of regulated platforms. Independent from CSPM vendors: the deliverable says what to pick and why, not what to buy.