AWS Security Audit India — Bachao.AI Methodology

What AWS gets right (and where Indian SaaS companies trip)

AWS provides excellent security primitives. Most security incidents involving AWS-hosted Indian companies are not AWS failures — they're misconfiguration. The same 12 configuration issues account for over 80% of findings in our audit history:

1. Overly permissive IAM policies (: wildcards)
2. Public S3 buckets containing internal data
3. Security groups open to 0.0.0.0/0 on non-public ports
4. Lack of MFA on IAM users with high-privilege access
5. CloudTrail not enabled across all regions
6. EBS volumes unencrypted at rest
7. RDS instances publicly accessible
8. Long-lived access keys (older than 180 days)
9. Default VPC still in use for production
10. KMS keys without rotation
11. Inadequate logging on Lambda functions handling PII
12. Bucket policies allowing cross-account access without explicit need

What's in scope

A standard AWS audit covers:

IAM and identity — Users, roles, policies, MFA enforcement, access key age, role chaining, AssumeRole conditions, IAM Access Analyzer findings, identity federation.

Network — VPC architecture, subnet segmentation, security groups, NACLs, Internet Gateway exposure, VPC peering, Transit Gateway, VPN/Direct Connect, Route 53 misconfigurations.

Data — S3 bucket policies, encryption at rest, EBS/RDS encryption, DynamoDB encryption, Secrets Manager usage, KMS key policies, data residency.

Logging and monitoring — CloudTrail organization-wide coverage, log retention, Config rules, GuardDuty enabled, Security Hub standards, VPC Flow Logs.

Compute and serverless — EC2 instance metadata version, Lambda function permissions, ECS/EKS security, IMDSv2 enforcement, OS patch levels, AMI source verification.

Application services — API Gateway throttling, WAF rules, Cognito MFA, SNS encryption, SQS encryption.

Incident response readiness — IAM emergency break-glass procedures, snapshot/backup testing, log preservation, multi-region readiness.

Each finding is mapped to AWS Well-Architected Security Pillar control + CIS AWS Foundations Benchmark control number.

The 5-day delivery

Day 1: Onboarding and read-only access

1. ReadOnlyAccess + Audit-specific role granted to Bachao.AI
2. AWS Config rules enabled if not present
3. Initial automated scan kickoff

1. 280+ automated configuration checks
2. IAM policy analysis (over-permissive policies flagged)
3. Identity federation review
4. Access key age and rotation review

1. VPC architecture review
2. Security group + NACL analysis
3. S3 bucket-level policy review
4. KMS + Secrets Manager usage analysis

1. CloudTrail completeness check
2. GuardDuty + Security Hub status
3. Custom Config rules review
4. Compliance mapping (CIS, AWS Well-Architected, customer-specific framework like DPDP/SEBI if applicable)

1. Findings prioritised by severity (Critical / High / Medium / Low)
2. Remediation steps with example IAM policy / CFN template / Terraform
3. Customer briefing call (90 minutes)
4. Final report delivered

Pricing

After the audit

For most clients, the audit is paired with one of:

1. One-time remediation sprint (4 weeks, Bachao engineers execute fixes)
2. DevSecOps retainer (ongoing config monitoring + new-service review)
3. Cloud Security Posture Management (monthly continuous monitoring)

Related: Case Study: Bengaluru SaaS Closed 47 AWS Misconfigs in 2 Weeks · Cloud Security for Indian Fintech