opsserving
    Security & Compliance

    IAM and Secrets Management

    Permissions accumulate. Somebody needed access once, got a broad policy, and it was never narrowed. Meanwhile credentials sit in environment files and CI variables with no rotation and no expiry.

    Start with the audit

    No sales layer, no juniors. You meet the engineer before anything begins.

    // What is included

    What you get

    • Roles rebuilt to least privilege, argued against real usage rather than guesswork
    • Secrets moved into managed storage with automated rotation
    • CI and CD authenticated by short-lived federated credentials, not static keys
    • MFA coverage and standing privilege monitored with alerting on gaps

    // How it runs

    The sequence

    1. 01

      Inventory

      Who and what can do what today, including the forgotten ones.

    2. 02

      Narrow

      Reduce permissions in stages, watching for anything that breaks.

    3. 03

      Rotate

      Move secrets to managed rotation and remove the static ones.

    // Stack

    • AWS IAM
    • AWS Secrets Manager
    • AWS Parameter Store
    • AWS KMS
    • AWS Lambda

    // Related work

    Where this has been done before

    Client names under NDA. The numbers are not.

    SOC 2-ready security hardening (NDA)

    • IAM rewritten to least privilege with credential rotation
    • Secrets moved to Secrets Manager with Lambda rotation
    • WAF and rate limiting in front of public endpoints

    Controls in place and documented for the SOC 2 audit

    Jenkins to CircleCI: 12 pipelines migrated (NDA)

    • All 12 pipelines migrated from Jenkins to CircleCI
    • Reusable Terraform pipeline with auto-approve and manual gates
    • GitHub Actions OIDC federation into AWS

    12 pipelines moved off self-maintained Jenkins

    All case studies

    // Questions

    Before you ask

    // Also in Security & Compliance

    Related services

    DevSecOps

    Security checks inside the pipeline, where they are cheap to fix.

    Cloud Security Audit

    A read-only pass over the account, findings ranked by what gets exploited first.

    SOC 2 Readiness

    The infrastructure controls an auditor will ask for, actually implemented.

    Talk to the engineer who would do the work

    A 20 minute call. You describe your setup, you get an honest read on whether this helps, and the top risks worth looking at first.

    See pricing