Hardening a live AWS workload with a Well-Architected Review

A SaaS B2B business working with Cloud Combinator on AWS. The client is anonymised at their request.

The review surfaced findings across four focus areas, each of which became a workstream in the remediation plan.

All the priority actions agreed from the review were delivered, with the bulk of the remediation plan completed. The workload moved from an ad hoc security and operations posture to one built on AWS best practice.

• Security hardened — A managed VPN connection replaced IP whitelisting, MFA was enforced, and a password storage and credential key-rotation policy were introduced. AWS Security Hub, AWS Config, Amazon GuardDuty and AWS CloudTrail were all activated to give continuous security monitoring.
• Recovery proven — Snapshots were automated on a schedule, and an end-to-end restore from an image-level copy of the instance was completed, with rollback capability and timing demonstrated back to the client.
• Cost brought under control — Cost Explorer alerts and reports were created and a tagging strategy was implemented to attribute and monitor spend across the environment.
• Governance in place — A standard set of policy documents, covering incident management, security tickets, IAM, VPN and cost, was produced, alongside a partner-led scorecard delivered to the client.
• Handover — Ongoing responsibilities were confirmed between the client and Cloud Combinator, with day-to-day operational tasks such as VPN management and snapshot auditing set to be owned internally going forward.

A number of items were deliberately scoped out for a planned re-architecture of the platform. With a hardened, well-documented baseline now in place, the client is set up to take that redesign forward on solid foundations rather than firefighting risks along the way.