EC2 compute is 67% of spend — the primary optimization lever (rightsizing, Savings Plans, Graviton/spot). Security tooling (WAF, Security Hub, Config, GuardDuty) adds ~$110/mo.
| Severity | Finding | Evidence | Why it matters |
|---|---|---|---|
| High | Open GuardDuty high/critical findings | sev 8–9 in us-east-1 & us-east-2 |
Active threat signals unremediated; no delegated security owner to triage |
| High | 13 security groups open to the internet | 0.0.0.0/0 ingress, us-east-2 |
Direct attack surface on the workload account — needs port-level review |
| High | Stale admin access keys | admin keys 322 & 319 days; +3 others >90d |
Long-lived static credentials for privileged users — top breach vector |
| Medium | Console users without MFA | 2 of 10 IAM users | Account-takeover risk; fails CIS AWS baseline |
| Medium | Member account unmonitored | Lazka: no GuardDuty / Security Hub | Detection blind spot; org security services not delivered to members |
| Good | Org CloudTrail configured well | multi-region + org trail + log-file validation | Solid audit foundation to build on |
| Good | No public S3 buckets or public RDS | 0 of 9 buckets public; 0 public DBs | Data-exposure basics are in order |
SOC 2 at 81% aligns with their Secureframe program — a focused push closes the gap. PCI is lowest (not in scope unless they process cards).
*:* adminFull evidence: findings/prowler/*.html · *.ocsf.json · compliance/
| Workstream | Driver from discovery | Outcome |
|---|---|---|
| Landing zone & account separation | Workloads in mgmt acct; flat org, no OUs; empty Lazka; SCP region-deny absent | Dedicated workload account; OUs + SCP guardrails (region deny, root protection) |
| Delegated security account | Zero delegated admins — GuardDuty, Security Hub and Config all flagged high; 4 open GD high/critical findings; Lazka dark | Central security account admins all three org-wide; findings get a named owner and triage SLA |
| Backup & resilience | 0 of 9 EBS volumes have snapshots or a backup plan (18 high/medium failures) | AWS Backup plans, tested restores, RPO/RTO defined — today a volume loss is unrecoverable |
| Identity hardening | Admin keys 322 & 319 days; 5 keys >90d; 6 users on static creds; 9 users + root without hardware MFA; AdministratorAccess attached (*:*) | IAM Identity Center + short-lived roles; retire static keys, scope admin, hardware MFA on root |
| Exposure reduction | 13 internet-open SGs; 3 permissive NACLs; 7 public-IP instances; 6 internet-facing instances carrying instance profiles; IMDSv2 not enforced account-wide | Least-privilege ingress, IMDSv2 enforced, ALB/WAF fronting — closes the credential-theft path |
| Secrets & key management | 19 secrets with no rotation and no restrictive resource policy; 2 KMS keys without auto-rotation; 19 log groups unencrypted; secrets detected in 7 log groups | Rotation on every secret, KMS/CMK coverage for logs and SNS, resource policies scoped to consumers |
| Cost optimization | $858/mo, +284% Jan→Jul; EC2 = 67% of spend; 2 unattached EBS + 7 EIPs; orphaned EKS roles from a torn-down cluster | Rightsizing + Savings Plans + Graviton/spot + cleanup → recurring savings and a growth-safe baseline |
| Compliance acceleration | Prowler: 363 failures (2 critical, 111 high); SOC 2 81%, ISO 27001 77%, CIS 3.0 74%; Secureframe + Intruder already engaged | Close the SOC 2 gap on evidence they already collect; Security Hub as the standing control monitor |
The first three are the fastest to land and the hardest to defend leaving open — no delegated security owner, no backups, and workloads in the management account are each a single-event risk. Cost optimization is the lever that funds the rest.