Automated AWS Security Auditing and Compliance with Serverless Architecture

Problem Statement:

To ensure continuous compliance and security within the AWS environment, there is a need for an automated mechanism to detect misconfigurations, unauthorized changes, and potential vulnerabilities across critical cloud services. Given the scale of services used—such as S3, IAM, EC2, RDS, Lambda, and others—manual audits are time-consuming and prone to oversight. Without proactive monitoring, issues like publicly accessible data, unencrypted resources, or unused access keys may go unnoticed, increasing the risk of breaches.

To address this, AWS Lambda can be scheduled via EventBridge to run daily scans across services using the Boto3 SDK. The findings can be stored in AWS S3, visualized through QuickSight, and enriched using Glue and Athena for querying. Alerts and summaries can be sent through SNS or SES to the DevSecOps team. This serverless, scheduled approach ensures regular, low-cost audits and enables early detection and response to security risks across the infrastructure.

Applied Solution:

1. Created SecurityAuditLambdaPolicy policy which grants permissions required for a Lambda function to perform automated security audits across AWS services. It includes scanning S3 buckets for encryption and public access configurations, checking IAM user keys, evaluating EC2 instances and RDS databases for security issues, inspecting Lambda function policies, saving audit results to a specific S3 bucket (saayam-security-audit-results), and publishing security alerts via SNS notifications.

2. Create a LambdaAuditRole and attach the SecurityAuditLambdaPolicy to it to give the Lambda function the precise, least-privilege permissions it needs in a secure, manageable way.

3. Created SecurityAuditAlerts SNS topic Topic in standard type to send notifications like emails related to security risks for testing purpose i've used my email later I'll change the email with organisation standard email.

4. Created DailySecurityAudit Lambda function to run the security checks automatically by selecting the existing role LambdaAuditRole.

5. Python Boto3 code was implemented(audit_scan.py) using lamdba function(DailySecurityAudit) to perform the following security checks:
   Identify unencrypted S3 buckets
   Detect unused IAM access keys
   Analyze EC2 instance configurations
   Verify RDS instance encryption
   Inspect Lambda functions for public access
   Save audit findings to an S3 bucket
   Send security alerts via SNS notifications

6. The above lambda function will create audit_findings object to store the data in saayam-virginia-private S3 bucket

7. . Created DailySecurityAuditTrigger EventBridge schedule that triggers audit_scan.py lambda function daily at 09:00AM PST Time Zone: America/New_York
   Cron Expression: 0 12 * * ? *

8. Created SecurityAuditScanResultsCrawler in AWS glue for generating scan results and attaching it to audit_findings. Created AWSGlueServiceRole-S3BucketScan IAM role to scan S3 bucket. Created security_audit_scans_db DB to store the tables Glue discovers.

9. Created athena-audit-query-results S3 object in saayam-virginia-private to store the results of the query processed in anthena

10. Query uusing Anthena by setting database to security_audit_scans_db

11. Qucksight integration is pending