CREST-Certified AWS Cloud Security Review for UK Businesses

A single-account review (≤10 services, ≤50 resources) typically takes 4-5 working days. Mid-market AWS Organizations (3-10 accounts, EKS or Lambda) takes 7-10 days. Enterprise landing zones (10+ accounts, multi-region, data perimeter) take 10-15 days. Test duration is determined during scoping based on account count and service breadth.

AWS penetration testing engagements at single-account scale range from £4,500 to £8,000. Mid-market (most commonly commissioned) £8,000 to £14,000. Enterprise £14,000 to £22,000. All quotes are fixed-price after scoping with no day-rate surprises. The day rate for CREST-certified testers is £1,100–£1,400 per day.

Yes. Every AWS engagement includes a control-by-control CIS AWS Foundations Benchmark v3.0 assessment. Findings are tagged to specific CIS control IDs (e.g., 1.2: root account hardware MFA) so your audit team can submit evidence directly. We also reference the AWS Well-Architected Framework security pillar where applicable.

Core AWS services: AWS IAM, AWS S3, AWS EC2, AWS VPC, AWS Lambda, AWS EKS, AWS KMS, Secrets Manager, API Gateway, CloudTrail, RDS, CloudFront. Extended scope on request: ECS, Fargate, Step Functions, EventBridge, SNS, SQS, AppSync, WAF, GuardDuty, Security Hub, AWS Config, Organizations / Control Tower / Landing Zone.

Read-only by default. We use the AWS-managed SecurityAudit IAM role for the discovery and CIS audit phases. Manual exploitation phases (IAM privilege escalation, IMDS attacks, EKS escape attempts) only run with explicit written authorisation per resource type, in agreed maintenance windows, with full audit-log capture.

Yes. EKS reviews include control-plane configuration, RBAC scrutiny, IAM Roles for Service Accounts (IRSA), pod security standards (PSS), node IAM trust, container image registry security, network policies, and pod-to-node escape paths via IMDSv1 abuse, hostPath mounts, or privileged containers.

Yes. AWS permits customer-led penetration testing of most services, including EC2, RDS, Lambda and API Gateway, without prior approval under its customer support policy. A few activities, such as DNS or DDoS-style simulation, still need authorisation. We scope every engagement to stay within AWS testing rules and your change controls.

AWS secures the infrastructure, but under the shared responsibility model you secure your IAM, S3, networking and data configuration, and that is where most breaches start. An AWS cloud security review checks the customer side against the CIS AWS Foundations Benchmark and proves which weaknesses are actually exploitable.

Multi-account testing is fully supported. We map the entire Organizations structure, evaluate Service Control Policies (SCPs), audit cross-account trust relationships, review AWS Control Tower / Landing Zone deployments, and test data perimeter enforcement (RCPs in preview, plus existing identity / service / resource perimeters).

Yes. Pre-deployment IaC review is offered as a separate engagement or bundled with cloud testing. We review Terraform / OpenTofu, CloudFormation, AWS CDK, and Pulumi for misconfigurations, secret leakage, and policy violations before the resources hit your AWS account.

Yes. Every finding ships with prioritised remediation guidance and where applicable, example Terraform / CloudFormation patches. For high-severity findings we include direct engineer access via our portal so your platform team can ask follow-up questions during remediation.

Yes. IMDSv2 enforcement is one of the most common AWS findings; IMDSv1 allows server-side request forgery (SSRF) to retrieve EC2 instance metadata including IAM credentials. We test every EC2 instance, Lambda, and ECS task to verify IMDSv2 is enforced and IMDSv1 is disabled.

All AWS testers are vetted UK or international engineers. Relevant certifications across the team include CREST CRT and CCT INF, AWS Certified Security: Specialty, OSCP, OSCE, and platform-specific specialisms (e.g., Kubernetes CKS, eMAPT). SC-cleared testers are available for public-sector and regulated-financial engagements.

Yes. Standard NDA before any technical detail is shared, and we operate under a project-specific master agreement that includes data handling, deliverable IP, and breach notification clauses. Custom MSAs and AUP terms are accepted for enterprise and public-sector clients.

Yes. AWS security review, AWS cloud security review and AWS configuration review all describe the same engagement: a CREST-certified assessment of your AWS account against the CIS Foundations Benchmark, combined with manual exploitation across IAM, S3, networking and compute. The name varies by buyer; the methodology does not.

Both are secure when configured correctly; most incidents come from customer-side misconfiguration, not the platform. If you run workloads on both, we test each against its own CIS Foundations Benchmark. See our Azure cloud security review for the equivalent assessment.