AWS consultant: audit, structure and secure your AWS accounts

Signs that an AWS environment needs reworking

Many AWS environments start with a single account, opened for a first project. Then comes a second account, access granted in a hurry, resources created by hand in the console. A few years later, the same questions keep coming up:

• nobody can say for certain who can administer what;
• production and test share the same account or the same network;
• activity logs are not centralised, or not kept long enough;
• part of the infrastructure exists only in the console and cannot be rebuilt;
• the bill keeps growing without being attributable to a team or a product.

These are not mistakes; they are the normal effects of growth without a shared foundation. Feekr, based in Villeneuve-d’Ascq near Lille, France, steps in to restore order without stopping production. Our founder designs and runs AWS infrastructure entirely as Infrastructure as Code, including for HDS hosting (Hébergement de Données de Santé, the French certification for hosting health data).

AWS audit: a prioritised assessment

The AWS audit is often our starting point. It covers:

• Organisation and accounts: AWS Organizations structure, organisational units, service control policies (SCPs), separation of environments.
• Identity and access: use of IAM Identity Center, IAM users and long-lived access keys, the root account, multi-factor authentication, excessive permissions.
• Logging and detection: organisation-wide AWS CloudTrail, AWS Config, GuardDuty, Security Hub, log retention and protection.
• Network and exposure: public resources, overly permissive security groups, accessible S3 buckets, encryption in transit and at rest.
• Resilience: backups, distribution across multiple Availability Zones, restore procedures that have actually been tested.
• Costs: tagging, unused resources, rightsizing, coverage by pricing commitments.
• Industrialisation: how much of the infrastructure is managed as code, pipelines, Terraform state management.

The output is not a hundred-page report: it is a list of findings ranked by risk level and effort, each with its recommended fix.

Well-Architected Review

For a critical application, we carry out a review against the AWS Well-Architected Framework and its six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. We use the AWS Well-Architected Tool so that the findings and improvement plan stay available in your account and can be tracked over time.

The review is useful before a major go-live, after an incident, or when an application has changed significantly since it was designed.

Landing zone and multi-account organisation

AWS best practice is to isolate workloads in separate accounts, grouped into an organisation. A typical landing zone includes:

• a management account reserved for the organisation and billing;
• dedicated accounts for centralised logging and security tooling;
• a shared network account where the architecture justifies it;
• accounts per environment (production, staging, development) and per product or team;
• SCPs that block what must never happen, such as disabling logging or using unauthorised regions;
• unified access through IAM Identity Center, connected to your existing directory.

Control Tower, Terraform, or both?

Approach	Strengths	Points to watch
AWS Control Tower	Guided set-up, predefined controls, built-in account factory	Customisation within limits, conventions imposed by the service
Terraform only (on AWS Organizations)	Full control, everything versioned and reviewed	More upfront work, maintained by you
Control Tower driven by Terraform	AWS controls plus customisation as code	Two mechanisms to understand and document

We recommend an approach based on the size of your organisation, your in-house skills and your existing tooling. In every case, the landing zone is described as code and documented. See also our Terraform and Infrastructure as Code consulting.

Security and costs: two topics to address in the foundation

Security is not bolted on afterwards: organisation-level guardrails, temporary access rather than permanent keys, centralised and protected logs, encryption by default. We describe this approach on our cloud security and governance page.

On costs, the landing zone lays the groundwork for cost management: mandatory tags, budgets and alerts per account, anomaly detection, and access to billing data for the relevant teams. Ongoing optimisation then falls under our FinOps consulting.

Deliverables

• AWS audit report: prioritised findings and remediation plan.
• Well-Architected Review report, tracked in the Well-Architected Tool.
• Target architecture diagrams (organisation, network, access flows).
• Landing zone as Infrastructure as Code, with a deployment pipeline.
• Architecture decision record.
• Operating procedures: creating an account, managing access, responding to a security alert.
• Knowledge-transfer sessions with your teams.

How we work with your teams

We apply our Scope, Build, Industrialise, Improve method. The audit sets the priorities; remediation and the landing zone are built with your engineers, who review every code change; operations are documented and handed over. We stay neutral: if a need is better served on Azure, we say so, as explained on our AWS and Azure cloud consulting page.

Who it is for, and when to call us

• You are starting on AWS and want a clean base from the very first account.
• Your AWS accounts have multiplied without shared rules.
• A customer, an auditor or a regulation requires you to demonstrate control over security.
• You are preparing a migration to AWS and the target foundation does not exist yet.
• Your team needs an experienced review of an architecture before it goes live.

Book a 15-minute call to walk us through your context.

[ YOUR QUESTIONS ]

Frequently asked questions

What is an AWS audit?

An AWS audit is a structured review of your AWS accounts: organisation, identities and permissions, network configuration, logging, backups, public exposure and costs. It produces a list of findings prioritised by risk and effort, with a remediation plan your teams can carry out.

What is an AWS Well-Architected Review?

It is a review of a workload against the AWS Well-Architected Framework, which is organised into six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. AWS provides a free tool, the Well-Architected Tool, to carry out the review and track improvement items.

What is an AWS landing zone?

An AWS landing zone is the starting multi-account environment, preconfigured with the security, identity, network and logging rules that will apply to every account. It can be built with AWS Control Tower, with Terraform, or with a combination of both.

AWS Organizations or AWS Control Tower?

It is not an either-or choice. AWS Organizations is the core service that groups accounts and applies policies; Control Tower builds on it to automate the set-up of a landing zone and predefined controls. The choice depends on how much customisation you need and on your Infrastructure as Code tooling.

What does an AWS DevOps consultant do?

An AWS DevOps consultant designs and automates the path from code to production on AWS: Infrastructure as Code, deployment pipelines, observability and secrets management. The goal is deployments that are reproducible, reviewed and traceable.