Zero-Trust Cloud Hardening

An AWS environment had overly permissive IAM roles, open security groups, and no continuous compliance monitoring, creating a large attack surface.

Implemented least-privilege IAM, network segmentation, CIS benchmark enforcement, and continuous configuration scanning with automated remediation.

IAM analysis (IAM Access Analyzer) → Security group auditing → CIS compliance (AWS Config + Conftest) → GuardDuty detection → Lambda auto-remediation.

Shrunk the IAM attack surface and established continuous compliance with automated remediation for common misconfigurations.

• Least-privilege IAM rewrite using IAM Access Analyzer
• CIS benchmark enforcement via Terraform across all accounts
• Lambda auto-remediation for common misconfigurations
• Centralized CloudTrail + VPC flow logs for forensics