Cloud Security Health Check
Prioritized Findings Report
Northwind Financial, Inc.
Illustrative company — sample data only
Executive summary
Posture is recoverable, but two critical exposures put customer data and the management plane one credential away from compromise. Both are closable in days.
Top risks to close first
- A public storage bucket exposes exported customer records to any authenticated principal.
- The AWS management-account root has no MFA — a single credential is full-account takeover.
- Audit logging is disabled in 2 of 14 accounts, leaving blind spots with no reconstructable trail.
Scope & method
Read-only assessment across identity, data, network, logging, and configuration. No agents installed; nothing written to production.
Domain scorecard
Findings register
| ID | Severity | Domain | Finding | Cloud |
|---|---|---|---|---|
| F-01 | Critical | Data security | Public object storage exposes exported customer records | AWS |
| F-02 | Critical | Identity & access | Management-account root has no MFA | AWS |
| F-03 | High | Network exposure | Management port open to the internet | AWS |
| F-04 | High | Identity & access | Over-privileged CI role with a stale static key | AWS |
| F-05 | High | Logging & monitoring | Audit logging disabled in two accounts | AWS |
| F-06 | Medium | Configuration & posture | New resources inherit an insecure baseline | Azure |
| F-07 | Medium | Data security | Unencrypted database snapshots shared cross-account | AWS |
| F-08 | Medium | Network exposure | Over-permissive firewall rules | Google Cloud |
| F-09 | Low | Logging & monitoring | Audit log retention below policy | AWS |
Selected findings in detail
Public object storage exposes exported customer records
Risk: A storage bucket of exported records is readable by any authenticated principal. Once copied, the disclosure cannot be undone — this is a breach and a notification event.
Fix: Restrict the bucket to least-privilege principals and enforce account-wide public-access blocking. Confirm no data was accessed via access logs.
Management-account root has no MFA
Risk: The organization root can do anything, and it is protected by a password alone. A single phished or leaked credential is full-account takeover.
Fix: Enable a hardware MFA device on root, vault the credentials, and alert on any root usage.
Management port open to the internet
Risk: RDP (3389) is open to 0.0.0.0/0 on a production host — directly brute-forceable administrative access from anywhere.
Fix: Restrict access to a bastion or just-in-time access and close the public rule.
Over-privileged CI role with a stale static key
Risk: A deploy role holds AdministratorAccess and a two-year-old access key — the single credential most likely to end up in a public repo or build log.
Fix: Scope the role to the exact deploy actions in use, move to short-lived OIDC tokens, and remove the static key.
Audit logging disabled in two accounts
Risk: CloudTrail is off in 2 of 14 accounts — blind spots where an incident would leave no reconstructable trail.
Fix: Enable an organization-wide trail to a central, access-controlled, tamper-resistant sink.
Remediation roadmap
Now — first 2 weeks
- Enable root MFA and vault the credentials (F-02)
- Close the public storage bucket and confirm no access (F-01)
- Close the internet-facing management port (F-03)
Next — 2 to 6 weeks
- Scope the CI role and rotate to short-lived tokens (F-04)
- Enable organization-wide audit logging (F-05)
- Set secure-by-default configuration policies (F-06)
Ongoing
- Encrypt and scope database snapshots; set retention (F-07)
- Tighten firewall rules and segment workloads (F-08)
- Extend log retention and monitor for drift (F-09)
