Notes from real AWS security reviews
Practical write-ups from actual AWS security engagements — the misconfigurations we keep finding, fixes that held up, and the parts of the AWS Well-Architected Framework that matter more than the rest.
From the archive
What Should an AWS Security Review Actually Cost? Here's What the Market Looks Like
AWS security review pricing runs from free to $50,000+, and most of that gap has nothing to do with thoroughness. Here's how the market actually prices this work.
Your AI Agents Have More AWS Access Than Your Engineers Do
AI agents in AWS routinely get more IAM permissions than the humans who deploy them. Here's why it happens and how to fix it before your next audit.
This Year's Cloud Security Index Says AWS Carries the Most Risk. Here's What That Actually Means for You.
A widely-cited 2026 cross-cloud misconfiguration study found AWS leading in risk exposure across five of six categories measured. That headline says more about AWS's size than its safety — here's the filtered read.
5 IAM Misconfigurations We Find in Almost Every AWS Security Review
Root users with active access keys, wildcard policies nobody remembers writing, and roles nobody's assumed in two years — a look at the identity issues that show up on the client's very first Well-Architected pass, and what we tell them to fix first.
The IAM Policy That Looks Read-Only But Isn't
Privilege-escalation paths hiding inside policies that were never meant to grant admin — and the handful of IAM actions that turn “limited” access into full account takeover.
The Security Group Rule Almost Every AWS Account Still Has
Permissive ingress to sensitive ports is one of the most common findings in this year's cross-cloud security research. The five ports worth checking today, and why “it's internal” isn't the defense it used to be.
Why “ViewOnlyAccess” Isn't Enough (and What We Actually Attach)
The two AWS-managed policies we actually attach for a review, and the coverage gap most consultancies paper over with a vague “custom policy.”
The AWS Well-Architected Security Pillar, Explained for Non-Security People
Seven focus areas, seven design principles — what the AWS Well-Architected Framework's Security Pillar actually asks of your account, in plain language.
What AWS re:Inforce 2026 Actually Means If You're Not an Enterprise
Most re:Inforce coverage is written for security teams that already have one. Here's what from this year's announcements is actually worth a 10-50 person startup's attention — and what to safely ignore.
The 15-Minute S3 Audit (Because the Average Misconfiguration Sits for 180+ Days)
Industry data puts the average time to notice a misconfigured S3 bucket at well over six months. Here's the short, concrete checklist we actually run — no tooling required.