AWS IAM & Access Cleanup
Who can do what in your account, who has not used it in a year, and what to take away first.
From $299 2–4 days
AWS Logging & Audit Foundation
A record of who did what, kept long enough to be useful and somewhere it cannot be edited.
Price and scope
From $299
Typically $299–$699, fixed in writing before anything starts.
What moves it up
- A separate log archive account, which is the right answer and more work than one bucket
- Long retention driven by a policy somebody outside engineering owns
- Application logs as well as infrastructure logs, which need structure before they need storage
Some of this you can check yourself, right now, for free: AWS IAM / S3 Policy Checker →
What actually goes wrong
CloudTrail is on, because it is on by default, and that is where most accounts stop. What is actually there is a ninety-day event history in the console — no S3 copy, no integrity validation, and no coverage of data events, so the record of who read or deleted an object in a bucket does not exist at all. The consequence only shows up at the worst moment: something goes wrong, you go looking for when it started, and the answer is older than the window you kept.
How I find it
aws cloudtrail describe-trails --query 'trailList[].[Name,IsMultiRegionTrail,LogFileValidationEnabled]'aws cloudtrail get-event-selectors — whether S3 and Lambda data events are recorded at allaws logs describe-log-groups --query 'logGroups[?retentionInDays==null].[logGroupName]' — the ones kept foreveraws s3api get-object-lock-configuration on the log bucket, if there is one
What you get
- A multi-region CloudTrail with log file validation, delivering to S3 rather than only the console
- Data events enabled on the buckets that hold anything worth auditing
- Retention set deliberately per log group, instead of forever on some and ninety days on the rest
- The log destination locked down so the credentials being audited cannot rewrite the audit
- A worked example: one question answered from the logs end to end, so you know the record is usable
Questions
CloudTrail is already enabled. Is that not enough?
The default gives you ninety days of management events in the console and nothing else — no durable copy, no integrity validation, and no data events. It answers "what changed last month" and cannot answer "who downloaded that file in March".
Will this make my bill jump?
The trail itself is inexpensive; data events on a busy bucket are not, and log ingestion is where this genuinely gets costly. Coverage is chosen deliberately for that reason — everything on everywhere is a bill nobody signed off.
Why put logs in a different AWS account?
Because an attacker with administrative access in your account can delete the evidence of what they did. A separate account with write-only delivery means the credentials being audited cannot rewrite the audit. It is the single highest-value thing in this engagement.
How long do I actually need to keep logs?
Long enough to cover the slowest way you would find out something happened, which for a quiet compromise is months rather than weeks. If a framework or a contract sets a number, that wins — otherwise it comes from that question rather than from a default.
If this is not quite it
SOC 2-Oriented AWS Technical Controls
The AWS half of a SOC 2 readiness effort, built so the evidence generates itself.
From $1,399 10–20 days
Want this done?
Tell me what you are running and I will come back with a fixed price and a date. If it turns out you do not need this, I will say that instead.
Prefer to talk? Book a free call ↗ · Or hire me on Upwork ↗ · Typical reply within one business day.
Before you enquire
When I answer
Sunday to Thursday, 09:00–18:00 EET. Outside that I will still look, but I will not promise a time.
No 24/7 desk, and I will not pretend otherwise
One person, one time zone. If round-the-clock cover is what you need, you need a team, and I will say so rather than sell you a plan that cannot deliver it.
Your AWS bill stays yours
You pay Amazon directly and you keep control of the account. Nothing here resells your infrastructure or sits between you and your own billing.
A price that starts with "from" is a starting price
Every service page lists exactly what pushes a quote above it, before you ask. You get a fixed number in writing before any work begins.