India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
Cloud Security Assessment for Live AWS, Azure & GCP Estates
A cloud security assessment is a time-boxed review of cloud accounts, subscriptions and projects already in production, measuring how exposed they are today: identity sprawl, public resources, logging gaps and weak network paths. NTSPL runs read-only scans plus manual attack-path review over three to five weeks and hands Indian CIOs and CISOs a risk-ranked, owner-assigned 90-day remediation plan.
Delivered on
In scope
What a Posture Review of Your Running Cloud Actually Finds
Most Indian cloud estates were not designed; they accumulated. A vendor built the loan app in one AWS account, the analytics team opened a GCP project with a personal Gmail admin, and a subscription created for a 2022 pilot still holds a storage account with anonymous read. Nobody has a single picture of what is internet-facing, who holds Owner or AdministratorAccess, or which accounts are missing audit trails. The first time leadership hears the scale of it is usually in an RBI, SEBI or customer audit observation, when the window to fix it is weeks, not quarters.
NTSPL starts with a read-only role federated into every account, subscription and project, then runs native posture tools and open-source scanners side by side so no single engine's blind spots decide the result. Engineers then manually walk the top attack paths from the internet to sensitive data. Every finding is scored on exploitability, data sensitivity and blast radius, deduplicated across tools, and assigned to a named owner with a 30, 60 or 90-day due date.
Signals Your Live Estate Needs an Independent Security Review
Signals you need Cloud Security Assessment
- An RBI, SEBI, IRDAI or ISO 27001 audit is due within 8-12 weeks and nobody can list every cloud account or subscription you own
- Account or subscription count has grown past 15-20 through vendors and acquisitions, with no organisation-wide CloudTrail, Activity Log export or Cloud Audit Logs sink
- More than 50 human IAM users or Owner role assignments exist, or access keys older than 90 days are still in use
- An enterprise customer's security questionnaire asks for posture evidence and the team needs three weeks to answer it
When to choose something else
- You have not moved to cloud yet and need to know what controls the target design must meet: take the pre-migration Security & Compliance Assessment in our Cloud Assessment family instead.
- You already run CSPM daily with triaged findings and owners; what you need is continuous operation and auto-remediation, covered by Cloud Security Posture Management.
- You need a regulator-by-regulator evidence pack rather than an exposure picture: start with Compliance Control Mapping.
Accounts, Identities and Exposures We Examine
Estate inventory
Enumerate every AWS account, Azure subscription and GCP project reachable from the organisation, management group or org node, including orphaned ones billed to cards. We reconcile against invoices to find what the org tree misses.
Identity and privilege
Review human users, service principals, service accounts, long-lived keys, cross-account trust and standing admin roles. Unused permissions are measured from 90 days of access activity, not from policy text alone.
Internet exposure
List every public IP, load balancer, API endpoint, storage bucket and database with a public endpoint, and confirm reachability from outside rather than trusting configuration flags.
Logging and detection coverage
Check whether audit logs, flow logs and threat detection services are enabled in every account and region, where logs land, and whether they meet CERT-In's 180-day retention.
Attack-path walkthrough
Manually chain the top findings into realistic paths, such as exposed VM to instance role to production bucket, to show which fixes break the most paths.
Read-Only Scan to Ranked Fix Plan: The Review Pipeline
Read-Only Multi-Cloud Posture Review Pipeline
A federated read-only role feeds native and open-source scanners whose findings are normalised, deduplicated and enriched with data sensitivity. Engineers then validate exposure and attack paths before findings are ranked into a remediation register.
Select any component
Read-Only Multi-Cloud Posture Review Pipeline: click any of its 8 components to see its role and the design choice NTSPL makes for it, or trace the 7-step primary path.
Native Posture Tooling Used on AWS, Azure and Google Cloud
We use the Security Hub CSPM CIS AWS Foundations and Foundational Security Best Practices standards, and Access Analyzer's unused-access findings to size privilege cleanup per account.
Resource Graph queries surface public network access and anonymous blob settings across all subscriptions at once; Defender CSPM attack path analysis is enabled on a trial where licensing allows.
Asset Inventory searches find primitive Owner and Editor bindings across the org; IAM Recommender shows unused roles to trim per service account.
Scoping Calls That Change What the Review Reveals
Whole estate or crown jewels first
If you have under 25 accounts or subscriptions, scan them all; the marginal cost is low. Above 25, scan everything automatically but give manual attack-path time only to accounts holding regulated or customer data, typically 20-30% of the estate. Spreading manual review evenly across 80 accounts produces a long report and few confirmed paths.
Native tools or third-party scanner
Use native engines as the baseline because the client keeps them after the review at known cost. Add Prowler or ScoutSuite for breadth. Recommend a commercial CNAPP only if you run three clouds with more than 2,000 workloads, or need agentless vulnerability and secrets scanning in one console; otherwise the licence rarely pays back in year one.
Severity model
Do not accept tool severity as-is. A critical on an empty sandbox ranks below a medium on the payments account. NTSPL scores each finding 1-5 on exploitability, data classification and blast radius, and promotes anything on a confirmed internet-to-data path. Expect 15-25% of tool criticals to drop and a handful of mediums to rise.
Point-in-time or recurring
A single review suits audit preparation or a new CISO's baseline. If you expect more than 10 new accounts a year or frequent vendor deployments, book a day-60 re-scan and then decide on continuous CSPM. Re-running the full review every quarter costs more than operating posture management properly, and still leaves 80-day blind spots between reviews.
Five-Week Review Plan from Access Grant to Readout
Access grant and estate reconciliation
Client deploys the read-only role; we reconcile the org tree against three months of invoices to find unmanaged accounts.
Automated scanning across all accounts
Native and open-source scanners run in every enabled region; external reachability probes run in an agreed window.
Identity and privilege deep dive
Standing admin roles, keys and cross-account trusts are reviewed against 90 days of activity.
Attack-path validation
Engineers chain findings into realistic paths and confirm them without exploitation.
Ranked register and readout
Findings are scored, assigned to owners and presented to the CISO and IT leadership.
What you receive
Measures That Show the Review Changed Your Exposure
| KPI | Typical target |
|---|---|
| Accounts with organisation-level audit logging | 100% by day 30 |
| Confirmed internet-to-sensitive-data paths | Zero open by day 60 |
| Critical findings closed within 30 days | 85-95% |
| Human identities with standing admin rights | Reduced 70-90% |
Where Security Reviews Go Wrong and How We Prevent It
| Risk | How NTSPL prevents it |
|---|---|
| Scans run only in the primary region and miss resources in us-east-1 or a forgotten Singapore project | Every enabled region is scanned, and billing data is used to find regions with spend but no scan coverage. |
| A 900-row report that nobody acts on | Findings are deduplicated and grouped into fix packages; the readout leads with five fixes that close most paths. |
| External probing trips the SOC or a WAF and causes an incident | Scan windows, source IPs and contacts are shared with the SOC and any managed security vendor in advance. |
Cloud security assessment or penetration test: which do we need first?
Start with the security assessment. A penetration test probes a defined scope, usually a few applications or IP ranges, and tells you whether a skilled attacker can break in there. It will not tell you that 11 accounts lack audit logs, that 140 users hold keys older than a year, or that a snapshot is shared publicly. A posture review covers the whole estate's configuration in weeks and fixes the cheap, high-impact gaps first. Commission the penetration test afterwards, scoped to the internet-facing applications the review flags as highest risk, so testers spend their days on real paths instead of rediscovering misconfigurations.
Key facts: Cloud Security Assessment
Cloud Security Assessment in Practice
2 Cloud Security Assessment scenarios, from Banking (small finance bank) and SaaS (HR, payroll and attendance), plus related platform case studies.
Small finance bank closes 59 of 63 critical AWS findings before its RBI IS audit
Payroll SaaS lifts Azure secure score from 34% to 72% before bank security reviews
Health-tech SaaS moves patient data behind KMS and Identity Center ahead of DPDP
Three directories become one: identity consolidation after two acquisitions
Cloud Security Assessment: Frequently Asked Questions
How much does a cloud security assessment cost and how long does it take?
For 10-40 accounts or subscriptions across one or two clouds, NTSPL typically completes the review in three to five weeks at INR 6-14 lakh, depending on the number of regulated workloads that need manual attack-path review. Native tool charges during the review, such as Security Hub or Defender trials, are usually a few thousand rupees a month and stay with your account.
Do you need administrator access to our cloud accounts?
No. We work only through read-only roles such as AWS SecurityAudit plus ViewOnlyAccess, Azure Reader and Security Reader, and Google Cloud Security Reviewer. You deploy the role yourself, keep the right to revoke it, and no long-lived keys are issued to NTSPL engineers.
Will the assessment help with our RBI or SEBI audit?
It helps by fixing exposures auditors find, but it is not an audit opinion. Findings reference the control areas in RBI's IT governance master direction or SEBI's CSCRF where relevant, so your compliance team can show remediation. A formal control-by-control evidence pack is produced under Compliance Control Mapping.
Does the review check CERT-In log retention requirements?
Yes. CERT-In's April 2022 directions require ICT system logs to be kept for a rolling 180 days within India. We check, per account and region, whether audit and flow logs are enabled, where they are stored and for how long, and flag any log bucket or workspace outside Indian regions.
How is this different from just turning on Security Hub or Defender for Cloud?
Native tools produce raw findings, often hundreds per account, with generic severity. The review adds an estate inventory the tools cannot see, external reachability checks, identity analysis based on real activity, manual attack-path chaining and a ranked plan with owners. Teams that simply switch tools on often stall at a 30-40% secure score.
Can you assess accounts managed by our application vendors?
Yes, provided the accounts sit under your organisation or you can obtain a read-only role from the vendor. Vendor-held accounts are a frequent source of critical findings, so we include them by default and share the vendor-specific findings with them in a separate pack.