Identity and access
- Root account MFA and unused root access keys
- IAM users without MFA
- Access keys that are old or no longer used
- Password policy strength
- Policies that grant far more than they need
Free AWS security assessment
Find the gaps in your AWS before someone else does.
Public storage, unused access keys and logging that was never switched on are behind most cloud incidents. We review your AWS account configuration across every region and map what we find to the frameworks your customers and auditors ask about.
What we check
Hundreds of automated checks, grouped into six areas
Every check looks at how things are configured, never at your data. Here's what each area covers.
Logging and detection
- CloudTrail recording in every region, with log integrity
- AWS Config recording changes
- GuardDuty threat detection switched on
- Security Hub and alerting on key events
Data protection
- S3 buckets open to the public
- Encryption on S3, EBS volumes and databases
- Databases reachable from the internet
- Key rotation, backups and versioning
Network exposure
- Security groups open to the internet on SSH, RDP and database ports
- Default VPCs and security groups still in use
- VPC flow logs
- Load balancers without HTTPS
Compute and containers
- Instance metadata protection (IMDSv2)
- Public snapshots and machine images
- Functions and container registries exposed publicly
- Container image scanning
Resilience
- Backup plans and retention
- Deletion protection on important resources
- Multi-AZ setup for databases
Cost check
Also included: what you're paying for but not using
Stopping an instance doesn't stop the bill. Using the same read-only access, we list resources that are off, unattached or idle but still charging you, with an estimated monthly cost for each.
- Stopped instances still paying for their storage
- Disk volumes attached to nothing
- Public IP addresses reserved but unused
- Load balancers with nothing behind them
- Stopped databases, which AWS restarts on its own after 7 days
- Snapshots older than six months
Standards
Mapped to the frameworks auditors use
The report shows how many checks pass for each framework. It's a readiness view, not a certification or a full audit.
- CIS Amazon Web Services Foundations Benchmark
- AWS Foundational Security Best Practices
- SOC 2
- HIPAA
- ISO 27001
- PCI DSS
- NIST 800-53
- AWS Well-Architected security pillar
Read-only
What read-only means here
You stay in control of access the whole time, and you can remove it whenever you like.
What we can see
- How your accounts, users and roles are configured
- Logging, encryption and backup settings
- Network rules and what's exposed to the internet
- Resource configuration in every region
What we never do
- Read the data stored in your S3 buckets or databases
- Download code, container images or snapshots
- Change, start, stop or delete anything
- Receive any password or access key of yours
How access works
We send your team a CloudFormation template and step-by-step instructions.
They deploy it in the AWS console. It creates one role using AWS's own SecurityAudit and ViewOnlyAccess policies, plus a short list of configuration reads, and nothing that reads your data.
The role only works for SJSTechnet with an external ID unique to your assessment, so it can't be reused by anyone else.
When the report is delivered, you delete the stack and the role is gone.
What you receive
A report you can act on
A graded report
An A to F grade for each area, written for the person who signs the cheques, with the technical detail attached for whoever runs IT.
Fix these first
The ten findings that matter most, each explained in plain language: what it is, why it matters, and how to fix it.
Compliance snapshot
How your settings line up against each framework we check, so you know where you stand before an audit or insurance renewal.
A 30-minute walkthrough
We go through the report with you on a call and answer questions. Any fixes are quoted at a fixed price, only if you want them.
Questions
Common questions
Is it really read-only?
Yes. The access we ask for can only read settings. It can't change anything, and it's limited to configuration, not your data. The section above lists exactly what we can and can't see.
Will it affect our workloads or costs?
No. We only read configuration through AWS's standard APIs. Nothing is installed, and API reads like these don't add noticeable cost.
Can you review several accounts?
Yes. Deploy the template in each account you want included, and the report covers them all.
Who needs to deploy the template?
Anyone who can create IAM roles in the account. It takes about three minutes.
We're preparing for SOC 2 or HIPAA. Will this help?
Yes. The compliance snapshot shows where your AWS setup already lines up and where it doesn't, so you can fix gaps before the auditor finds them.
What does it cost?
The assessment is free. If you'd like help fixing what we find, each fix is quoted at a fixed price before any work starts, and you're never obliged to go ahead.
How long until we get the report?
Within two business days of your administrator finishing setup. We then book a 30-minute call to walk you through it.
Book your free AWS assessment
Tell us a little about your setup and we'll send everything your administrator needs.