Perimeter

Security posture
Organization o-8xk2mq1ptv Accounts 3 Regions us-east-1, eu-west-1 Refreshed 14:02:36 UTC, 28 seconds ago Refreshed 13:41:04 UTC, 21 minutes ago
Portfolio

Verdict

Against the 24-hour baseline

Two measures are over threshold

Two over threshold, one unknown

  • 21 critical findings, over the policy limit of 10 since 7 September and rising for five days.
  • 4 resources reachable from 0.0.0.0/0, against 1 a week ago.
  • Four more sit outside target: encryption, credential age, remediation time, and guardrail drift. Three of the four are in sandbox-data.

Baseline taken 10 Sep 14:00 UTC, over the same three accounts

Critical findings have risen for five days; high has followed

Open findings, 29 Aug to 11 Sep
Open critical and high findings, 29 August to 11 September Critical rises from 6 on 3 September to 21 on 11 September, crossing the policy limit of 10 on 7 September. High rises from 27 to 47 over the same period. 0 20 40 Policy limit, critical: 10 21 critical 47 high No data since 13:41 29 Aug 2 Sep 6 Sep 11 Sep Crossed the limit on 7 Sep
  • Critical21color-charts-red-500
  • High47color-charts-orange-500

A 2px line is a thin mark, so both series use the 500 step. This browser measures each ratio in the theme now showing, against the tile behind the line.

Newest critical finding

09:14 UTC

Critical

S3 bucket pay-recon-exports is readable by any AWS account

Account
411827364902
Alias
prod-payments
Region
us-east-1
Objects
1,204,883
Read in 24h
0
arn:aws:securityhub:us-east-1:411827364902:finding/6f3b0a1c-9d2e-4f77-b0a5-27c1e884ab19

Open findings by account

248 total
Open findings by account and severity prod-payments 126, of which 14 critical. prod-platform 78, of which 6 critical. sandbox-data 44, of which 1 critical and 31 low. prod-payments 126 prod-platform 78 sandbox-data 44 —
  • Critical21
  • High47
  • Medium108
  • Low72

All four fills are the 400 step, measured here at against this tile

Reachable from 0.0.0.0/0

Over threshold
4 was 1 seven days ago

3 security groups, 1 S3 bucket

Guardrails off baseline

Off target
2of 11 policies
Approved regions, prod-platform
deny-region-outside-approved
IMDSv2 enforced, sandbox-data
need-imdsv2

Encrypted at rest

Off target
96.2%40 of 1,043 stores unencrypted
prod-payments 99.1 percent, prod-platform 97.4 percent, sandbox-data 84.6 percent, against a target of 100 percent. prod-payments99.1% prod-platform97.4% sandbox-data84.6%

The dashed marks are the 100% target

Credentials over 90 days

Off target
Credentials older than 90 days: prod-payments 3, prod-platform 1, sandbox-data 12, against a target of zero. prod-payments3 prod-platform1 sandbox-data12

The dashed marks at the left are the target of zero

Detector coverage

9 of 98 of 9, one unknown
GuardDuty
3 of 3
Config recorders
3 of 3
Security Hub
3 of 3Not reporting

Every account reported inside the last minute

Last read 13:41 UTC

Ingestion $412.80 month to date, $908 projected

Hours to close a critical

Off target
Median and 90th percentile hours to close a critical finding: prod-payments 6 and 22, prod-platform 11 and 41, sandbox-data 38 and 96, against a 24-hour service level. prod-payments6 to 22 prod-platform11 to 41 sandbox-data38 to 96

Hollow mark is the median, filled mark the 90th percentile. The dashed marks are the 24-hour service level.

  • The bucket stays readable by any AWS account until someone changes it
  • Suppression applies to all 3 accounts in the organization, not to prod-payments alone
  • AWS keeps billing storage for the 1,204,883 objects

pay-recon-exports

Perimeter: design notes

Shape of the page
A console. Ten panels on a fixed grid, sized to fill one wide screen with nothing to scroll. An eleventh panel, cost anomalies, did not survive the cut.
What it leads with
Charts. Six of the ten panels carry a drawn mark, and every figure states what it is being compared against: the target, the last period, or the other accounts.
Spacing
Tight, on Cloudscape's compact setting. The gaps between panels shrink with the density and the gap between an icon and its label does not, so labels stay legible either way.
The one bold decision
The legend prints its own readability. Every colour in the key is measured by the browser as the page loads, and again whenever the theme changes, so a reader can see that the chart is legible rather than take it on trust.
Where the colour comes from
Every colour, corner and type size is Amazon's own published Cloudscape set, taken from the system rather than sampled by eye. The same set supplies the light theme and the dark one.

Readability, measured

Each pair measured against the surface a panel is drawn on, in both themes.
What sits on whatLightDarkFloor
A value, read off a panel 18.50:19.98:14.5:1
The critical line on a chart 5.01:16.21:13:1
The critical bar, a filled mark 4.01:14.99:13:1

Higher is easier to read. The floor is the accessibility standard: 4.5 for text and 3 for a drawn mark.

Measuring found something reading the palette could not. One red on a white ground lands a thousandth under the floor, where the orange, yellow and blue beside it clear it. So every filled bar on the page takes the next step down the scale, which has room to spare in both themes and across all four colours.

What we changed

Cloudscape publishes its colours, corners and type but leaves spacing and animation to be read off its documentation rather than downloaded. The page copies both out verbatim rather than inventing its own.

The console itself never scrolls. Reaching these notes scrolls the page, which this portfolio asks for and the product would not.