Alvaro Del Valle
7e50d8083b
Expand the levers table from 5 to 8 workstreams, grounding each driver in verified counts from the Prowler run: - Add backup & resilience (0 of 9 EBS volumes have snapshots or a backup plan) - Add secrets & key management (19 secrets without rotation or resource policy, 2 KMS keys without auto-rotation, unencrypted log groups) - Add compliance acceleration (363 failures; SOC 2 at 81% against existing Secureframe program) - Note Config alongside GuardDuty and Security Hub in the delegated-admin gap - Add the two criticals and hardware-MFA gaps to identity hardening - Add internet-facing instances with instance profiles and IMDSv2 to exposure - Order by priority and add a framing note
308 lines
23 KiB
HTML
308 lines
23 KiB
HTML
<title>Scrivas — AWS Discovery Findings</title>
|
||
<style>
|
||
:root {
|
||
--bg:#eef0f3; --panel:#ffffff; --panel-2:#f7f8fa; --ink:#171d27;
|
||
--ink-soft:#4a5563; --ink-faint:#79828f; --line:#dde1e7; --line-soft:#e8ebef;
|
||
--accent:#0d6e78; --accent-ink:#0a565e;
|
||
--good:#2f8657; --warn:#b5832a; --crit:#bd463b;
|
||
--crit-bg:#fbeceb; --good-bg:#eaf4ee; --warn-bg:#f8f1e2;
|
||
--mono: ui-monospace,"SF Mono","SFMono-Regular",Menlo,Consolas,monospace;
|
||
--sans: ui-sans-serif,system-ui,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
|
||
--shadow:0 1px 2px rgba(20,26,38,.04),0 6px 20px -12px rgba(20,26,38,.18);
|
||
}
|
||
@media (prefers-color-scheme:dark){:root{
|
||
--bg:#0d1117;--panel:#161c26;--panel-2:#1b222e;--ink:#e8ecf1;--ink-soft:#aab3c0;
|
||
--ink-faint:#7c8695;--line:#28303c;--line-soft:#212934;--accent:#3bb4bf;--accent-ink:#8fdfe6;
|
||
--good:#54b681;--warn:#d6a94a;--crit:#e26b60;--crit-bg:#2a1917;--good-bg:#132419;--warn-bg:#251d10;
|
||
--shadow:0 1px 2px rgba(0,0,0,.3),0 8px 24px -14px rgba(0,0,0,.6);}}
|
||
:root[data-theme="dark"]{
|
||
--bg:#0d1117;--panel:#161c26;--panel-2:#1b222e;--ink:#e8ecf1;--ink-soft:#aab3c0;
|
||
--ink-faint:#7c8695;--line:#28303c;--line-soft:#212934;--accent:#3bb4bf;--accent-ink:#8fdfe6;
|
||
--good:#54b681;--warn:#d6a94a;--crit:#e26b60;--crit-bg:#2a1917;--good-bg:#132419;--warn-bg:#251d10;
|
||
--shadow:0 1px 2px rgba(0,0,0,.3),0 8px 24px -14px rgba(0,0,0,.6);}
|
||
:root[data-theme="light"]{
|
||
--bg:#eef0f3;--panel:#ffffff;--panel-2:#f7f8fa;--ink:#171d27;--ink-soft:#4a5563;
|
||
--ink-faint:#79828f;--line:#dde1e7;--line-soft:#e8ebef;--accent:#0d6e78;--accent-ink:#0a565e;
|
||
--good:#2f8657;--warn:#b5832a;--crit:#bd463b;--crit-bg:#fbeceb;--good-bg:#eaf4ee;--warn-bg:#f8f1e2;
|
||
--shadow:0 1px 2px rgba(20,26,38,.04),0 6px 20px -12px rgba(20,26,38,.18);}
|
||
|
||
*{box-sizing:border-box;}
|
||
body{margin:0;background:var(--bg);color:var(--ink);font-family:var(--sans);line-height:1.5;-webkit-font-smoothing:antialiased;}
|
||
.wrap{max-width:1120px;margin:0 auto;padding:32px 24px 64px;}
|
||
header{display:flex;flex-wrap:wrap;align-items:flex-end;justify-content:space-between;gap:16px;padding-bottom:20px;border-bottom:2px solid var(--ink);}
|
||
.eyebrow{font-size:11px;letter-spacing:.16em;text-transform:uppercase;color:var(--accent);font-weight:700;}
|
||
h1{font-size:clamp(24px,4vw,34px);margin:6px 0 4px;letter-spacing:-.02em;text-wrap:balance;font-weight:750;}
|
||
.sub{color:var(--ink-soft);font-size:14px;}
|
||
.idcard{font-family:var(--mono);font-size:12px;color:var(--ink-soft);text-align:right;line-height:1.7;}
|
||
.idcard b{color:var(--ink);}
|
||
|
||
.kpis{display:grid;grid-template-columns:repeat(4,1fr);gap:14px;margin:22px 0 12px;}
|
||
@media (max-width:760px){.kpis{grid-template-columns:repeat(2,1fr);}}
|
||
.kpi{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:16px;box-shadow:var(--shadow);position:relative;overflow:hidden;}
|
||
.kpi::before{content:"";position:absolute;left:0;top:0;bottom:0;width:3px;background:var(--accent);}
|
||
.kpi.crit::before{background:var(--crit);}.kpi.warn::before{background:var(--warn);}.kpi.good::before{background:var(--good);}
|
||
.kpi .n{font-size:28px;font-weight:750;letter-spacing:-.02em;font-variant-numeric:tabular-nums;}
|
||
.kpi.crit .n{color:var(--crit);}.kpi.warn .n{color:var(--warn);}
|
||
.kpi .lbl{font-size:12px;color:var(--ink-faint);margin-top:2px;}
|
||
.kpi .meta{font-size:11px;color:var(--ink-soft);margin-top:8px;}
|
||
|
||
section{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:22px 24px;margin-bottom:18px;box-shadow:var(--shadow);}
|
||
.grid2{display:grid;grid-template-columns:1.15fr .85fr;gap:18px;}
|
||
@media (max-width:820px){.grid2{grid-template-columns:1fr;}}
|
||
.sec-head{display:flex;align-items:baseline;gap:10px;margin-bottom:16px;}
|
||
.sec-head .tag{font-family:var(--mono);font-size:12px;color:var(--accent);font-weight:700;}
|
||
.sec-head h2{font-size:17px;margin:0;letter-spacing:-.01em;}
|
||
.sec-head .note{margin-left:auto;font-size:12px;color:var(--ink-faint);}
|
||
|
||
/* cost bar chart */
|
||
.chart{display:flex;align-items:flex-end;gap:10px;height:170px;padding:8px 4px 0;border-bottom:1px solid var(--line);}
|
||
.bar{flex:1;display:flex;flex-direction:column;justify-content:flex-end;align-items:center;gap:6px;height:100%;}
|
||
.bar .col{width:100%;max-width:46px;background:color-mix(in srgb,var(--accent) 30%,transparent);border-radius:5px 5px 0 0;transition:height .2s;}
|
||
.bar.last .col{background:var(--accent);}
|
||
.bar .v{font-family:var(--mono);font-size:10.5px;color:var(--ink-soft);font-variant-numeric:tabular-nums;}
|
||
.bar .m{font-size:10.5px;color:var(--ink-faint);}
|
||
.barscale{display:flex;justify-content:space-between;font-size:11px;color:var(--ink-faint);margin-top:6px;}
|
||
|
||
/* horizontal service breakdown */
|
||
.hb{display:flex;flex-direction:column;gap:9px;}
|
||
.hb .row{display:grid;grid-template-columns:130px 1fr auto;align-items:center;gap:10px;font-size:12.5px;}
|
||
.hb .svc{color:var(--ink-soft);white-space:nowrap;overflow:hidden;text-overflow:ellipsis;}
|
||
.hb .track{height:9px;background:var(--panel-2);border-radius:5px;overflow:hidden;}
|
||
.hb .fill{height:100%;background:var(--accent);border-radius:5px;}
|
||
.hb .amt{font-family:var(--mono);font-variant-numeric:tabular-nums;color:var(--ink);font-size:12px;}
|
||
|
||
.stat-row{display:flex;flex-wrap:wrap;gap:22px;}
|
||
.stat{display:flex;flex-direction:column;}
|
||
.stat .n{font-size:22px;font-weight:700;font-variant-numeric:tabular-nums;letter-spacing:-.01em;}
|
||
.stat .l{font-size:11.5px;color:var(--ink-faint);}
|
||
|
||
.pill{display:inline-flex;align-items:center;gap:6px;font-size:11px;font-weight:700;padding:3px 9px;border-radius:999px;}
|
||
.pill.crit{background:var(--crit-bg);color:var(--crit);}.pill.good{background:var(--good-bg);color:var(--good);}.pill.warn{background:var(--warn-bg);color:var(--warn);}
|
||
.dot{width:7px;height:7px;border-radius:50%;background:currentColor;}
|
||
|
||
.tbl-wrap{overflow-x:auto;}
|
||
table{width:100%;border-collapse:collapse;font-size:13px;min-width:540px;}
|
||
th{text-align:left;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:var(--ink-faint);font-weight:700;padding:0 12px 10px;border-bottom:1px solid var(--line);}
|
||
td{padding:12px;border-bottom:1px solid var(--line-soft);vertical-align:top;color:var(--ink-soft);}
|
||
td b{color:var(--ink);font-weight:600;}
|
||
td code{font-family:var(--mono);font-size:12px;}
|
||
tr:last-child td{border-bottom:none;}
|
||
.sev{white-space:nowrap;}
|
||
|
||
.acctgrid{display:grid;grid-template-columns:1fr 1fr;gap:14px;}
|
||
@media (max-width:720px){.acctgrid{grid-template-columns:1fr;}}
|
||
.acct{border:1px solid var(--line);border-radius:11px;padding:16px;background:var(--panel-2);}
|
||
.acct h3{margin:0 0 4px;font-size:14px;}
|
||
.acct .aid{font-family:var(--mono);font-size:11.5px;color:var(--ink-faint);}
|
||
.acct ul{margin:10px 0 0;padding-left:16px;font-size:12.5px;color:var(--ink-soft);line-height:1.7;}
|
||
|
||
footer{margin-top:24px;font-size:12px;color:var(--ink-faint);display:flex;flex-wrap:wrap;gap:6px 16px;}
|
||
footer code{font-family:var(--mono);color:var(--ink-soft);}
|
||
</style>
|
||
|
||
<div class="wrap">
|
||
<header>
|
||
<div>
|
||
<div class="eyebrow">Dasnuve · Cloud Discovery · Fast Track</div>
|
||
<h1>Scrivas — AWS Discovery Findings</h1>
|
||
<div class="sub">Resource footprint · security posture · cost — phases 2–5, read-only</div>
|
||
</div>
|
||
<div class="idcard">org <b>o-qfj0pvhhv7</b><br>2 accounts · us-east-2 primary<br>2026-08-19</div>
|
||
</header>
|
||
|
||
<div class="kpis">
|
||
<div class="kpi warn"><div class="n">$858<span style="font-size:14px">/mo</span></div><div class="lbl">Current run-rate (Jul)</div><div class="meta">up ~4× from $223 in January</div></div>
|
||
<div class="kpi crit"><div class="n">4</div><div class="lbl">GuardDuty high/critical findings</div><div class="meta">severity 8–9, both regions, open</div></div>
|
||
<div class="kpi crit"><div class="n">13</div><div class="lbl">Security groups open to 0.0.0.0/0</div><div class="meta">management account, us-east-2</div></div>
|
||
<div class="kpi warn"><div class="n">5</div><div class="lbl">Access keys > 90 days old</div><div class="meta">incl. admin keys at 322 & 319 days</div></div>
|
||
</div>
|
||
|
||
<!-- COST -->
|
||
<section>
|
||
<div class="sec-head"><span class="tag">05</span><h2>Cost baseline</h2><span class="note">Cost Explorer · unblended · payer account</span></div>
|
||
<div class="grid2">
|
||
<div>
|
||
<div class="chart" id="chart">
|
||
<div class="bar"><div class="col" style="height:26%"></div><div class="v">$223</div><div class="m">Jan</div></div>
|
||
<div class="bar"><div class="col" style="height:15%"></div><div class="v">$131</div><div class="m">Feb</div></div>
|
||
<div class="bar"><div class="col" style="height:61%"></div><div class="v">$522</div><div class="m">Mar</div></div>
|
||
<div class="bar"><div class="col" style="height:85%"></div><div class="v">$732</div><div class="m">Apr</div></div>
|
||
<div class="bar"><div class="col" style="height:87%"></div><div class="v">$746</div><div class="m">May</div></div>
|
||
<div class="bar"><div class="col" style="height:96%"></div><div class="v">$821</div><div class="m">Jun</div></div>
|
||
<div class="bar last"><div class="col" style="height:100%"></div><div class="v">$858</div><div class="m">Jul</div></div>
|
||
</div>
|
||
<div class="barscale"><span>Monthly spend, 2026</span><span>+284% Jan→Jul · 7-mo total ≈ $4,033</span></div>
|
||
</div>
|
||
<div>
|
||
<div style="font-size:12px;color:var(--ink-faint);margin-bottom:10px;">Top services · 6-month spend</div>
|
||
<div class="hb">
|
||
<div class="row"><span class="svc">EC2 – Compute</span><span class="track"><span class="fill" style="width:100%"></span></span><span class="amt">$2,722</span></div>
|
||
<div class="row"><span class="svc">EC2 – Other</span><span class="track"><span class="fill" style="width:14%"></span></span><span class="amt">$375</span></div>
|
||
<div class="row"><span class="svc">AWS WAF</span><span class="track"><span class="fill" style="width:13%"></span></span><span class="amt">$364</span></div>
|
||
<div class="row"><span class="svc">Security Hub</span><span class="track"><span class="fill" style="width:6%"></span></span><span class="amt">$153</span></div>
|
||
<div class="row"><span class="svc">VPC</span><span class="track"><span class="fill" style="width:4%"></span></span><span class="amt">$117</span></div>
|
||
<div class="row"><span class="svc">Config</span><span class="track"><span class="fill" style="width:3%"></span></span><span class="amt">$84</span></div>
|
||
<div class="row"><span class="svc">GuardDuty</span><span class="track"><span class="fill" style="width:2%"></span></span><span class="amt">$56</span></div>
|
||
<div class="row"><span class="svc">EKS</span><span class="track"><span class="fill" style="width:2%"></span></span><span class="amt">$47</span></div>
|
||
</div>
|
||
<p class="sub" style="margin:12px 0 0;font-size:12.5px;">EC2 compute is <b>67%</b> of spend — the primary optimization lever (rightsizing, Savings Plans, Graviton/spot). Security tooling (WAF, Security Hub, Config, GuardDuty) adds ~<b>$110/mo</b>.</p>
|
||
</div>
|
||
</div>
|
||
</section>
|
||
|
||
<!-- FOOTPRINT -->
|
||
<section>
|
||
<div class="sec-head"><span class="tag">03</span><h2>Resource footprint</h2><span class="note">active regions only · us-east-2 primary</span></div>
|
||
<div class="stat-row" style="margin-bottom:16px">
|
||
<div class="stat"><span class="n">7</span><span class="l">EC2 instances</span></div>
|
||
<div class="stat"><span class="n">9</span><span class="l">EBS volumes <span style="color:var(--warn)">(2 unattached)</span></span></div>
|
||
<div class="stat"><span class="n">7</span><span class="l">Elastic IPs</span></div>
|
||
<div class="stat"><span class="n">9</span><span class="l">S3 buckets</span></div>
|
||
<div class="stat"><span class="n">2</span><span class="l">Regions in use</span></div>
|
||
<div class="stat"><span class="n">15</span><span class="l">Idle regions</span></div>
|
||
</div>
|
||
<div class="acctgrid">
|
||
<div class="acct">
|
||
<h3>Scrivas Admin <span class="pill warn"><span class="dot"></span>management + workloads</span></h3>
|
||
<div class="aid">716468089330 · us-east-2</div>
|
||
<ul>
|
||
<li>7 EC2 · 9 EBS (2 unattached) · 7 EIPs · 9 S3 buckets</li>
|
||
<li>EKS IAM roles present (staging/gpu/infra/apps) — <b>no live clusters returned</b>; likely torn down, roles orphaned</li>
|
||
<li>RDS monitoring role present; VPC flow logs enabled</li>
|
||
<li><b>Anti-pattern:</b> production workloads run in the org management account</li>
|
||
</ul>
|
||
</div>
|
||
<div class="acct">
|
||
<h3>Lazka <span class="pill crit"><span class="dot"></span>bare & unmonitored</span></h3>
|
||
<div class="aid">547868853286 · us-east-1</div>
|
||
<ul>
|
||
<li>0 EC2 · 0 S3 · 0 IAM users — effectively empty</li>
|
||
<li>Only default service-linked roles + OrganizationAccountAccessRole</li>
|
||
<li>Security Hub <b>not enabled</b>; no GuardDuty detector</li>
|
||
<li>Covered by the org CloudTrail, but otherwise dark</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
</section>
|
||
|
||
<!-- SECURITY + IAM -->
|
||
<section>
|
||
<div class="sec-head"><span class="tag">04</span><h2>Security posture & IAM</h2><span class="note">prioritized risk register</span></div>
|
||
<div class="tbl-wrap">
|
||
<table>
|
||
<thead><tr><th>Severity</th><th>Finding</th><th>Evidence</th><th>Why it matters</th></tr></thead>
|
||
<tbody>
|
||
<tr>
|
||
<td class="sev"><span class="pill crit"><span class="dot"></span>High</span></td>
|
||
<td><b>Open GuardDuty high/critical findings</b></td>
|
||
<td><code>sev 8–9</code> in us-east-1 & us-east-2</td>
|
||
<td>Active threat signals unremediated; no delegated security owner to triage</td>
|
||
</tr>
|
||
<tr>
|
||
<td class="sev"><span class="pill crit"><span class="dot"></span>High</span></td>
|
||
<td><b>13 security groups open to the internet</b></td>
|
||
<td><code>0.0.0.0/0</code> ingress, us-east-2</td>
|
||
<td>Direct attack surface on the workload account — needs port-level review</td>
|
||
</tr>
|
||
<tr>
|
||
<td class="sev"><span class="pill crit"><span class="dot"></span>High</span></td>
|
||
<td><b>Stale admin access keys</b></td>
|
||
<td><code>admin</code> keys 322 & 319 days; +3 others >90d</td>
|
||
<td>Long-lived static credentials for privileged users — top breach vector</td>
|
||
</tr>
|
||
<tr>
|
||
<td class="sev"><span class="pill warn"><span class="dot"></span>Medium</span></td>
|
||
<td><b>Console users without MFA</b></td>
|
||
<td>2 of 10 IAM users</td>
|
||
<td>Account-takeover risk; fails CIS AWS baseline</td>
|
||
</tr>
|
||
<tr>
|
||
<td class="sev"><span class="pill warn"><span class="dot"></span>Medium</span></td>
|
||
<td><b>Member account unmonitored</b></td>
|
||
<td>Lazka: no GuardDuty / Security Hub</td>
|
||
<td>Detection blind spot; org security services not delivered to members</td>
|
||
</tr>
|
||
<tr>
|
||
<td class="sev"><span class="pill good"><span class="dot"></span>Good</span></td>
|
||
<td><b>Org CloudTrail configured well</b></td>
|
||
<td>multi-region + org trail + log-file validation</td>
|
||
<td>Solid audit foundation to build on</td>
|
||
</tr>
|
||
<tr>
|
||
<td class="sev"><span class="pill good"><span class="dot"></span>Good</span></td>
|
||
<td><b>No public S3 buckets or public RDS</b></td>
|
||
<td>0 of 9 buckets public; 0 public DBs</td>
|
||
<td>Data-exposure basics are in order</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
</section>
|
||
|
||
<!-- PROWLER / COMPLIANCE -->
|
||
<section>
|
||
<div class="sec-head"><span class="tag">CIS</span><h2>Compliance benchmark</h2><span class="note">Prowler 5.39 · 632 checks · 1,230 findings · mgmt account</span></div>
|
||
<div class="grid2">
|
||
<div>
|
||
<div class="stat-row" style="margin-bottom:14px">
|
||
<div class="stat"><span class="n" style="color:var(--good)">70%</span><span class="l">Checks passing (861)</span></div>
|
||
<div class="stat"><span class="n" style="color:var(--crit)">2</span><span class="l">Critical failures</span></div>
|
||
<div class="stat"><span class="n" style="color:var(--crit)">111</span><span class="l">High failures</span></div>
|
||
<div class="stat"><span class="n" style="color:var(--warn)">189</span><span class="l">Medium failures</span></div>
|
||
</div>
|
||
<div style="font-size:12px;color:var(--ink-faint);margin:4px 0 8px;">Pass rate by framework</div>
|
||
<div class="hb">
|
||
<div class="row"><span class="svc">SOC 2</span><span class="track"><span class="fill" style="width:81%;background:var(--good)"></span></span><span class="amt">81%</span></div>
|
||
<div class="row"><span class="svc">ISO 27001:2022</span><span class="track"><span class="fill" style="width:77%;background:var(--good)"></span></span><span class="amt">77%</span></div>
|
||
<div class="row"><span class="svc">CIS 3.0</span><span class="track"><span class="fill" style="width:74%;background:var(--warn)"></span></span><span class="amt">74%</span></div>
|
||
<div class="row"><span class="svc">NIST CSF 2.0</span><span class="track"><span class="fill" style="width:71%;background:var(--warn)"></span></span><span class="amt">71%</span></div>
|
||
<div class="row"><span class="svc">PCI DSS 4.0</span><span class="track"><span class="fill" style="width:57%;background:var(--crit)"></span></span><span class="amt">57%</span></div>
|
||
</div>
|
||
<p class="sub" style="margin:12px 0 0;font-size:12.5px;">SOC 2 at <b>81%</b> aligns with their Secureframe program — a focused push closes the gap. PCI is lowest (not in scope unless they process cards).</p>
|
||
</div>
|
||
<div>
|
||
<div style="font-size:12px;color:var(--ink-faint);margin-bottom:10px;">Critical & notable high failures</div>
|
||
<div class="trust">
|
||
<div class="trow" style="border-color:color-mix(in srgb,var(--crit) 40%,transparent)"><span class="pill crit"><span class="dot"></span>CRIT</span><span class="rn">Root account has no hardware MFA</span></div>
|
||
<div class="trow" style="border-color:color-mix(in srgb,var(--crit) 40%,transparent)"><span class="pill crit"><span class="dot"></span>CRIT</span><span class="rn">AWS-managed policy grants <code>*:*</code> admin</span></div>
|
||
<div class="trow"><span class="pill warn"><span class="dot"></span>HIGH</span><span class="rn">No delegated admin: Config / GuardDuty / Security Hub</span></div>
|
||
<div class="trow"><span class="pill warn"><span class="dot"></span>HIGH</span><span class="rn">IMDSv2 not enforced at account level</span></div>
|
||
<div class="trow"><span class="pill warn"><span class="dot"></span>HIGH</span><span class="rn">IAM users rely on long-lived credentials</span></div>
|
||
<div class="trow"><span class="pill warn"><span class="dot"></span>HIGH</span><span class="rn">Secrets Manager rotation disabled (19 secrets)</span></div>
|
||
<div class="trow"><span class="pill warn"><span class="dot"></span>HIGH</span><span class="rn">KMS key auto-rotation off · SCP region restriction absent</span></div>
|
||
</div>
|
||
<p class="sub" style="margin:12px 0 0;font-size:12px;">Full evidence: <code>findings/prowler/*.html</code> · <code>*.ocsf.json</code> · <code>compliance/</code></p>
|
||
</div>
|
||
</div>
|
||
</section>
|
||
|
||
<!-- ROADMAP -->
|
||
<section>
|
||
<div class="sec-head"><span class="tag">→</span><h2>Proposal levers</h2><span class="note">where we create value · ordered by priority</span></div>
|
||
<div class="tbl-wrap">
|
||
<table>
|
||
<thead><tr><th>Workstream</th><th>Driver from discovery</th><th>Outcome</th></tr></thead>
|
||
<tbody>
|
||
<tr><td><b>Landing zone & account separation</b></td><td>Workloads in mgmt acct; flat org, no OUs; empty Lazka; SCP region-deny absent</td><td>Dedicated workload account; OUs + SCP guardrails (region deny, root protection)</td></tr>
|
||
<tr><td><b>Delegated security account</b></td><td>Zero delegated admins — GuardDuty, Security Hub <i>and</i> Config all flagged high; 4 open GD high/critical findings; Lazka dark</td><td>Central security account admins all three org-wide; findings get a named owner and triage SLA</td></tr>
|
||
<tr><td><b>Backup & resilience</b></td><td><b>0 of 9 EBS volumes</b> have snapshots or a backup plan (18 high/medium failures)</td><td>AWS Backup plans, tested restores, RPO/RTO defined — today a volume loss is unrecoverable</td></tr>
|
||
<tr><td><b>Identity hardening</b></td><td>Admin keys 322 & 319 days; 5 keys >90d; 6 users on static creds; 9 users + root without hardware MFA; <code>AdministratorAccess</code> attached (<code>*:*</code>)</td><td>IAM Identity Center + short-lived roles; retire static keys, scope admin, hardware MFA on root</td></tr>
|
||
<tr><td><b>Exposure reduction</b></td><td>13 internet-open SGs; 3 permissive NACLs; 7 public-IP instances; <b>6 internet-facing instances carrying instance profiles</b>; IMDSv2 not enforced account-wide</td><td>Least-privilege ingress, IMDSv2 enforced, ALB/WAF fronting — closes the credential-theft path</td></tr>
|
||
<tr><td><b>Secrets & key management</b></td><td>19 secrets with no rotation and no restrictive resource policy; 2 KMS keys without auto-rotation; 19 log groups unencrypted; secrets detected in 7 log groups</td><td>Rotation on every secret, KMS/CMK coverage for logs and SNS, resource policies scoped to consumers</td></tr>
|
||
<tr><td><b>Cost optimization</b></td><td>$858/mo, +284% Jan→Jul; EC2 = 67% of spend; 2 unattached EBS + 7 EIPs; orphaned EKS roles from a torn-down cluster</td><td>Rightsizing + Savings Plans + Graviton/spot + cleanup → recurring savings and a growth-safe baseline</td></tr>
|
||
<tr><td><b>Compliance acceleration</b></td><td>Prowler: 363 failures (2 critical, 111 high); SOC 2 81%, ISO 27001 77%, CIS 3.0 74%; Secureframe + Intruder already engaged</td><td>Close the SOC 2 gap on evidence they already collect; Security Hub as the standing control monitor</td></tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
<p class="sub" style="margin:12px 0 0;font-size:12.5px;">The first three are the fastest to land and the hardest to defend leaving open — no delegated security owner, no backups, and workloads in the management account are each a single-event risk. Cost optimization is the lever that funds the rest.</p>
|
||
</section>
|
||
|
||
<footer>
|
||
<span>Read-only · boto3 via <code>dasnuve-scrivas-louis-impersonation</code></span>
|
||
<span>Reproduce: <code>scripts/fast_discovery.py</code></span>
|
||
<span>Raw: <code>findings/fast_discovery.json</code></span>
|
||
<span>Benchmark: <code>prowler aws</code> 632 checks · <code>findings/prowler/</code></span>
|
||
<span>Phases 2–5 + CIS benchmark · phase 6 on ice</span>
|
||
</footer>
|
||
</div>
|