We migrated to AWS — is there a tool to audit our cloud security ourselves without paying an auditor?

Your first focus should be storage and IAM. Enable the account-level block public access toggle from the console with a single click. Next, track down users with wildcard full admin permissions in your IAM policies and trim them down based on the principle of least privilege. And don't forget to enable your audit logging service across all regions.

We got a similar quote when migrating our e-commerce stack in New York, they wanted $5,500. Two of our devs ran open-source audit scripts. It flagged 18 critical misconfigurations in total, 11 of which were just forgotten old security groups. We resolved everything in 3 days with zero spend.

Automated open-source tools are great, but don't rely on them blindly. These scanners only look at cloud infrastructure settings. They can't tell you if your code has authorization flaws or is vulnerable to SQL injection. In other words, your infra might look completely green while your app is full of holes.

The most urgent thing you can do tonight: stop doing daily work with the root user. Create a new dev account, bind a physical security key to the root account, and lock its password in a vault. Most cloud breaches blow up from leaked admin keys.

Are the clients you're signing contracts with requiring a standard compliance report or a sign-off from a formal third-party auditor? If the contract explicitly mandates an official audit certificate, running your own scan won't be enough at the enterprise table on its own.

we panicked when we first migrated too. set up two different open source scanners hooked them to the console and generated an html report. what shocked us most was an exposed test server had thousands of brute force attempts in 2 days shut down those ports immediately.

don't spend that $6,000 while you're on a tight budget, definitely not but the console's free advisor tab and popular audit scripts on GitHub will more than do the job. dedicate a weekend to the output, sit down with the team, and knock the items out one by one.

Security isn't a one-time audit, it's an ongoing process. Even if you pay $6,000 today and get a clean report, you'll be vulnerable again next week if a dev pushes a bad security rule. That's why you should wire the open-source auditing tool into your CI/CD pipeline as an automated test step.

If you're going this route, sort this out first. Trying to do this alone is the most expensive way.

Most incidents start with a leaked password, not a vulnerability.

I'll argue the opposite, don't get mad. Trying to do this alone is the most expensive way.

That's all, sorry if I went on too long.

I agree.

I'll try it. When you try to change everything at once, nothing settles.

That's all, sorry if I went on too long.

This thread is archived.

theres also a measureement aspect to this. like having backups accessible on the same network and with the same identity makes them part of the target.

if you post the result here it will help others too.

The discussion got scattered let me summarize. Trying to do this alone is the most expensive way.

If you post the result here it will help others too.

I agree, and I'd like to emphasize that. If you don't write this down from the start, it leads to arguments later.

Correct me if I'm wrong.

To get into the details: Taking notes for two weeks yields better results than a six-month estimate.

i'll argeu the opposite don't get mad. honestly taking measures without an inventory leaves doors you haven't seen open.