SAMPLE-AWS-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · AWS Account Security and Cost Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
3 fictional AWS accounts in one organisation: root user, IAM, SCPs, logging, network exposure and cost, from administrator-supplied exports.
Executive summary
The accounts work but basics are missing: one account has no MFA on the root user, some IAM users have long-lived keys and console access, no service control policies exist, and logging and detection are not enabled everywhere.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | IAM credential report | 3 accounts | Provided |
| E-02 | Organizations structure and SCP list | 1 organisation | Provided |
| E-03 | CloudTrail and GuardDuty status | 3 accounts, all regions | Provided |
| E-04 | Security group listing | 3 accounts | Provided |
| E-05 | Cost export, 3 months | 3 accounts | Provided |
| E-06 | Root user checklist from the administrator | 3 accounts | Self-reported |
What was not checked
- Workload code and data
- S3 bucket contents
- Third-party SaaS integrations
- Costs outside the 3 accounts
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | Root user MFA not enabled in 1 of 3 accounts | E-06 | Enable MFA on the root user and confirm no root access keys exist. |
| F-02 | High | 7 IAM users have console access and long-lived keys; 3 keys unused for over 90 days | E-01 | Move people to federation or MFA, and remove unused keys. |
| F-03 | Medium | No service control policies in the organisation | E-02 | Introduce a small set of guardrails, tested in a non-production organisational unit first. |
| F-04 | Medium | CloudTrail covers one region; GuardDuty is off in 3 regions | E-03 | Enable organisation-wide logging and detection in the regions in use. |
| F-05 | Medium | 4 security groups allow SSH from anywhere; S3 Block Public Access is off on 2 buckets | E-04 | Restrict sources and enable Block Public Access unless a bucket must be public. |
| F-06 | Low | 6 unattached volumes and 2 idle load balancers | E-05 | Confirm owners, snapshot if needed and remove under change control. |
Fix first
- Enable MFA on the root user in the third account Effort: Low.
- Remove unused access keys and plan federation Effort: Medium.
- Restrict SSH exposure and enable S3 Block Public Access Effort: Low.
- Enable organisation-wide CloudTrail and GuardDuty Effort: Medium.
- Design a first set of SCP guardrails Effort: High.
30/60/90-day plan
- First 30 days: Root MFA; remove unused keys; close the SSH exposure.
- By 60 days: Enable CloudTrail and GuardDuty everywhere; clean up idle resources under change control.
- By 90 days: Introduce SCP guardrails; plan federation for people; schedule a quarterly review.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.