Continuous Security Monitoring Baseline on AWS by Dedicatted

SaaS and software companies in Canada and the United States with one to a few dozen accounts under one AWS Organization, marketing and advertising agencies and martech groups with several AWS accounts, and software holding companies or private equity backed portfolios that inherit accounts through acquisition. The buyer is the CTO, Head of Engineering or platform lead asked by a customer questionnaire, an auditor or an incident to show that every account is monitored.

Amazon GuardDuty is on in one account and nothing is consolidated anywhere. AWS Config records in some accounts and not others. Long-lived IAM access keys exist that nobody owns. Much of the Amazon S3 estate has never been classified. The team knows which AWS services answer this, but enabling them everywhere, tuning them and keeping them tuned keeps losing to the product roadmap.

• Phase 1, Discover and design (week 1): account inventory under AWS Organizations, the state of each detective service per account and Region, IAM access-key and S3 bucket inventories with the Macie scan scope, and a written baseline design signed off by your technical owner.

• Phase 2, Deploy and tune (weeks 2 to 4): GuardDuty, Inspector, Security Hub, Config and Macie delegated-administered from your security account in every account and active Region; Security Hub CSPM standards selected, noisy controls suppressed with a written reason; an AWS CloudTrail organization trail; Amazon EventBridge routing findings by severity to your ticketing or chat tool; Amazon Detective where needed.

• Phase 3, Access-key lifecycle (add-on): every long-lived IAM access key gets an owner and a decision (rotate, move to a role or AWS Secrets Manager, or retire); Security Hub and IAM Access Analyzer unused-access findings closed or risk-accepted in writing; GuardDuty credential-misuse findings routed to a named responder.

• Phase 4, Sensitive data discovery (add-on): a one-time Amazon Macie discovery scan across the S3 estate, a classification inventory, remediation of public, unencrypted and sensitive-data buckets, then scheduled Macie jobs for new data.

• Phase 5, Handover (weeks 5 to 6): runbooks per finding family, documented severity thresholds, a findings report counting opened, closed and suppressed findings by account, and a walkthrough.

Amazon GuardDuty, Amazon Inspector, AWS Security Hub with Security Hub CSPM standards, AWS Config, Amazon Macie, Amazon Detective, AWS Organizations delegated administration, AWS CloudTrail, AWS IAM Access Analyzer, AWS Secrets Manager, Amazon EventBridge, AWS Systems Manager.

• Every account reports into one Security Hub view administered from your security account.

• Every long-lived IAM access key has an owner and a rotation date or a retirement record.

• Public, unencrypted and sensitive-data S3 buckets remediated or risk-accepted in writing.

• Findings reach their owners, with thresholds tuned so the baseline is actionable, not noisy.

• The engagement is measured in findings closed, not evidence produced.

Dedicatted is an AWS Managed Service Provider, holds AWS Service Delivery designations and runs a SOC 2 readiness practice. We are delivering this baseline now across the portfolio of a Canadian software holding company, for its SaaS businesses and marketing agencies, each in its own AWS account, after delivering credential and secrets remediation with machine-learning threat detection for that group and for a Canadian collectibles marketplace.

Dedicatted is an AWS Premier Tier Services Partner in Toronto and Montreal, Canada, the first Canadian partner with both AWS AI Competencies and the only Canadian AWS Partner with the AWS Digital Sovereignty Services Competency. We deliver across Canada, the United States and Europe in English and French, with Canadian data residency in AWS Canada (Central) and Canada West (Calgary).

Questions to contact@dedicatted.com  are answered within two business days. During delivery you have a named engagement lead and a shared channel; after handover, support continues under the monthly dimensions or Dedicatted's 24/7 Platform Support Service.

This service enables the detective services above (Detective only where selected), a CloudTrail organization trail and EventBridge rules in your accounts. AWS bills that usage to you and it is not included in this listing; we estimate it per account before enablement and size the Macie scan first. IAM roles created: each service's service-linked role, a cross-account deployment role for Dedicatted with a permission boundary (removed at handover unless you take a monthly dimension), and Systems Manager agent instance profiles where Inspector needs them. You keep ownership of every resource and credential.