Infrastructure security audit

[Fixture] A review of an existing cloud estate for vulnerabilities, with a prioritised plan to fix them.

Context

[Fixture] A SaaS product with a long-lived AWS account.

The account had grown over several years with no consistent security baseline, and nobody had a full picture of its exposure.

Sole auditor, presenting findings to the engineering lead.

Inventoried resources and compared them against a security baseline.

Ranked findings by exposure and effort to fix.

Turned the highest-priority fixes into Terraform changes so they stay fixed.

The most serious issues were fixed within a fortnight, and the baseline now runs as part of every infrastructure change.