Well-Architected & DevSecOps Review
Container & EKS Security Review
Cluster security is mostly configuration, and mostly default.
- Turnaround
- 5–7 business days
- Who it is for
- Teams running EKS or AKS with production workloads.
01 — The problem
Kubernetes defaults favour working over safe. Without deliberate effort, pods run as root, talk to anything in the cluster, and carry IAM permissions far wider than the workload needs.
02 — What is included
Exactly what you get, and nothing vague.
- RBAC review: service accounts, roles and what each can actually reach
- IRSA or Workload Identity scoping per workload
- Network policy coverage — default-deny posture and east-west traffic
- Pod security standards, privileged container and root user inventory
- Image provenance, registry scanning and admission control
03 — What this usually finds
The recurring ones, named up front.
- No network policies at all, so every pod can reach every other
- One over-permissioned IAM role shared by the whole cluster
- Containers running as root with no pod security standard applied
- Images pulled by mutable tag rather than digest
Listed because they recur, not because they are guaranteed. The audit reports what is actually there.
Next step
Twenty minutes to find out whether this is worth doing.
Every engagement runs under a signed mutual NDA with a read-only IAM role. If the audit would not pay for itself, I will say so on the call.