47
Misconfigurations
Identified
IAM least privilege
Most common AWS gap fixed
CIS AWS
Benchmark assessment
CloudTrail
Audit logging configured
GuardDuty
Threat detection enabled
AWS IAM Security Assessment & Hardening
AWS IAM is the most common source of cloud security failures. We assess IAM policies, roles, and trust relationships for overly permissive access, privilege escalation paths, cross-account trust issues, and unused credentials. Remediation includes least-privilege IAM policies, SCP guardrails, and IAM Access Analyzer configuration.
S3 Bucket Security & Data Exposure
Public S3 buckets remain among the most common causes of enterprise data breaches. We audit every bucket's ACL, bucket policy, public access block settings, encryption configuration, and access logging. We identify data exposure paths that organizations frequently overlook: including resource-based policies and cross-account access.
AWS Security Hub & GuardDuty Configuration
AWS Security Hub aggregates findings across services. GuardDuty detects threats using machine learning and threat intelligence. We enable, configure, and tune these services: connecting them to your SIEM or SOC workflow so findings are actually acted on rather than sitting in a console nobody checks.
CIS AWS Benchmark Assessment
The CIS Foundations Benchmark for AWS provides a prescriptive set of security configurations across IAM, logging, monitoring, networking, and storage. We assess your environment against the benchmark, document each finding with remediation steps, and implement the required configuration changes.
AWS Compliance: SOC 2, PCI DSS, HIPAA
Cloud environments have specific compliance requirements beyond on-premises controls. We assess your AWS environment against the controls required for SOC 2, PCI DSS, and HIPAA: covering encryption, access logging, network segmentation, and the specific AWS service configurations each standard requires.
Secure AWS Architecture Review
New AWS deployments should be reviewed against security best practices before workloads go live. We review infrastructure-as-code (Terraform, CloudFormation) and AWS architecture for security design flaws: VPC configuration, security group rules, public subnet placement, and secrets management: before they become production problems.
What Makes Us Different From Others
- IAM Privilege Escalation Analysis Most AWS assessments check for publicly accessible resources. We also enumerate IAM privilege escalation paths: the attack chains that let low-privilege accounts reach administrative access.
- Infrastructure-as-Code Review We review Terraform and CloudFormation before deployment so misconfigurations are caught in code, not in production.
- GuardDuty + Security Hub Tuning We configure and tune AWS-native detection tools so they are actually generating actionable alerts, not noise.
- Compliance Evidence Package Every AWS assessment produces evidence artifacts mapped to specific SOC 2, PCI DSS, or HIPAA controls: ready for your next audit.
- Remediation Included We do not just produce findings lists. Technical remediation of identified misconfigurations is included in our AWS security engagements.
Our AWS environment had grown organically for three years and nobody had ever done a security review. garrisonOne found 47 misconfigurations in a single assessment: public S3 buckets, overly permissive IAM roles, unencrypted data at rest. Everything was remediated in six weeks and we passed our SOC 2 cloud controls section without a single finding.
Client results
See how we have helped
Technology / SaaS
SaaS Startup — AWS Security Hardening
A seed-stage SaaS startup had customer data in a public S3 bucket. garrisonOne conducted a full AWS security assessment against CIS benchmarks and hardened the environment in 4 weeks.
3
Public S3 buckets closed
19
Overprivileged IAM roles fixed
100%
Security review passed
Industry focus
Industries we serve
Related Services: Cloud Security | Azure Security | Cloud Security Assessment | Cloud Pen Testing
See How We Have Helped Similar Organisations
AWS Security Assessment for B2B SaaS
SaaS/Technology: 47 misconfigurations found and fixed, SOC 2 cloud controls passed with zero findings
Read Case StudyFrequently asked questions
What are the most common AWS security misconfigurations?
The most commonly exploited AWS misconfigurations are: overly permissive IAM roles and policies, public S3 buckets or objects, disabled CloudTrail logging, security groups allowing unrestricted inbound access, unencrypted EBS volumes and S3 buckets, exposed EC2 instance metadata, and IAM users with long-lived access keys that are never rotated.
What is AWS IAM privilege escalation?
IAM privilege escalation refers to attack chains where a low-privilege AWS principal can use existing permissions to grant themselves additional permissions: effectively becoming an admin. Common paths include iam:PassRole with ec2:RunInstances, iam:CreateLoginProfile on existing admin users, and lambda:CreateFunction with iam:PassRole. These paths are often present in environments with broadly scoped IAM policies.
What is the CIS AWS Foundations Benchmark?
The CIS Foundations Benchmark for AWS is a set of prescriptive security configurations published by the Center for Internet Security. It covers IAM, logging, monitoring, networking, and storage configuration. The benchmark is used as a baseline for AWS security assessments and maps to compliance requirements in SOC 2, PCI DSS, and HIPAA.
How does AWS GuardDuty work?
AWS GuardDuty is a threat detection service that continuously monitors CloudTrail, VPC Flow Logs, and DNS logs for malicious activity. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats like crypto mining, unauthorized access, and compromised EC2 instances. GuardDuty findings should be integrated into your security operations workflow.
Is AWS responsible for cloud security?
AWS operates under the Shared Responsibility Model. AWS is responsible for security of the cloud: the underlying infrastructure, hardware, and global network. Customers are responsible for security in the cloud: the data they store, the applications they run, IAM configurations, network controls, and encryption. Most cloud breaches result from customer-side misconfigurations, not AWS infrastructure failures.
How long does an AWS security assessment take?
A focused AWS security assessment of a single-account environment typically takes one to two weeks. Multi-account AWS Organizations environments with complex architectures take two to four weeks. The assessment includes discovery, finding documentation, and a remediation roadmap.
Resources
Company
Contact
- US: 4752 Euclid Rd Suite 11,
Virginia Beach, VA 23462 - India: Orchard Street, Sector 61,
Gurgaon, Haryana - Phone: (301) 825-5518
- info@garrisonone.com
