Security testing
AWS cloud penetration testing
Many cloud incidents start with a permission that's too broad, a resource that's public by mistake or a secret left where it shouldn't be. I review your AWS environment and test the paths an attacker could follow from an initial foothold.
Quoted individually, based on the scope.
What's included
- IAM: users, roles and policies with more permissions than they need.
- Publicly exposed services, buckets and endpoints.
- Secrets in code, variables, images or configuration.
- Network segmentation and access between services.
- Logging and monitoring: whether an attack would be noticed.
What you get
- A written report with each finding, its CVSS v4.0 severity and how to fix it.
- A prioritized list of changes, from the most urgent.
- A call to walk your team through the results.
- A re-test of the fixed findings at no extra cost, within 90 days of the report.
Who it's for
- Companies running their product on AWS.
- Teams that grew fast and never reviewed their permissions.
- Teams managing infrastructure with Terraform or another IaC tool.
Not included
- Testing accounts or resources without written authorization from their owner.
- Actions that violate your cloud provider's terms of service.
- Ongoing infrastructure management.
Process
How I work
-
Scope and authorization
We define what to test, how and when. Nothing starts without your written authorization.
-
Testing
Manual testing and review, supported by tools. If I find something critical, I tell you right away.
-
Report
You get every finding rated with CVSS v4.0, with the steps to reproduce it and the recommended fix.
-
Follow-up
I walk your team through the results and re-test the fixes at no extra cost, if you request it within 90 days of the report.
Frequently asked questions
What access do you need?
Usually a read-only role for the configuration review, plus whatever starting point we agree for the test. Everything is defined in the scope before starting.
Do you work with other cloud providers?
My experience is with AWS. For other providers, write to me and I'll tell you honestly whether I'm the right person.
Other services
- Web and API penetration testing Manual testing of web applications and APIs, the way an attacker would approach them.
- Vulnerability assessment A broad review of your exposure, with risks ranked so you know what to fix first.
- Mobile penetration testing Security testing of Android and iOS apps and the APIs behind them.
- Secure code review A review of your code to find vulnerabilities before they reach production.
Have a system to test or review? Send me the scope
Tell me what you need tested (applications, APIs or environments), by when, and any constraints, and I'll reply with the next steps. I work in English and Spanish.
hello@santiagopassafiume.comLooking for development? Websites, applications and backend projects go through RyuLabs.