AWS IAM least-privilege review for product workloads
Review AWS human and workload identities, temporary credentials, effective permissions, trust policies, and permission changes around real application tasks.
Read the guideCloud & platform · 8 guides
Review the infrastructure behind your product
Cloud, container, operating-system, and delivery-pipeline reviews that connect production configuration to application security.
CI/CD deployment identity: short-lived access and narrow trust
Review build and deployment identities across OIDC trust, repository controls, environments, permissions, untrusted jobs, and release verification.
Read the guideCloud security audit checklist for application teams
Review cloud identities, public exposure, storage, secrets, logging, runtime updates, and recovery through the needs of the application you operate.
Read the guideDocker container security review: image, runtime, and host
Review container security across image provenance, runtime identity, privileges, mounts, network access, secrets, and host maintenance for application workloads.
Read the guideKubernetes RBAC review: workload and operator permissions
Review Kubernetes roles, bindings, service accounts, sensitive workload permissions, token exposure, and namespace assumptions with least-privilege checks.
Read the guideLinux server patching checklist: verify what is running
Plan Linux security updates with workload inventory, vendor guidance, active-kernel checks, service replacement, rollback review, and documented verification.
Read the guideS3 public access review: policies, links, and tenant ownership
Review Amazon S3 public access settings, bucket and resource policies, application-issued links, and tenant ownership, with safe read-access verification.
Read the guideSecrets management and rotation plan for application teams
Inventory application credentials, scope access, plan safe rotation, verify revocation, and prevent secrets from reaching logs, source control, or public builds.
Read the guide