Skip to content
Khavion home

A sample review

This is the full report for a made-up diagram: a public web app on AWS with a Postgres database and a small retrieval-augmented chat feature. Nothing here is customer data.

Review a diagram

2026-11-02 · Engineering review

Architecture
review

2 critical

80 / 100

Posture score

Starts at 100. What your diagram or code shows counts in full. A reminder that a service is in the stack, or a note that nothing fills a role, counts for less. Findings with one root cause count once, each pillar can only cost so much, and the total is scaled to the size of the stack.

Scope
AWS (8), Third-party (1)

Every item below is checked against the provider’s own words, quoted exactly so you can go and read the source yourself. It is an honest checklist built from what you told us and what we detected, not an audit of your running environment.

What you told us

A public web app on ECS behind CloudFront and API Gateway, with an RDS database and an S3 bucket for uploads. A retrieval chat feature calls Amazon Bedrock over a vector store.

Where you land

  • Security56

    2 critical · 6 high · 7 medium · 1 low

  • Reliability87

    2 high · 2 medium · 1 low

  • Cost optimization90

    2 medium · 3 low

  • Performance efficiency94

    1 medium · 2 low

  • Operational excellence92

    2 medium · 1 low

  • Sustainability99

    1 low

2 critical · 8 high · 14 medium · 9 low · 1 info

What to do first

Findings sorted by impact against effort, so you can start where the payoff is highest.

Do first

High impact, low effort

  • Enforce encryption at rest
  • Analyze public and cross-account access
  • Identify and back up all data
  • Enforce encryption in transit
  • Create network layers
  • Store and use secrets securely
  • Turn on S3 Block Public Access
  • Enforce access control on data at rest
  • Put a WAF in front of public entry points

Plan

High impact, larger effort

  • Deploy the workload to multiple locations

Quick wins

Lower impact, low effort

  • Select resource type, size, and number based on data
  • Match Bedrock throughput mode to real demand
  • Analyze workload metrics
  • Use automation when obtaining or scaling resources
  • Monitor all components to detect failures
  • Implement secure key management
  • Configure service and application logging
  • Control traffic flow within your network layers
  • Reach AWS services privately with VPC endpoints
  • Stop clients bypassing CloudFront to hit the ALB
  • Add Bedrock Guardrails to user-facing AI
  • No secrets manager appears in this architecture
  • Add organization information to cost and usage
  • Select software with cost-effective licensing
  • Supply resources dynamically
  • Implement data access patterns that use caching
  • Be aware of service quotas and constraints
  • Filter outbound traffic to limit data exfiltration
  • Choose Region based on business and sustainability goals
  • Bedrock does not train on your data: confirmed

Backlog

Lower impact, larger effort

  • No infrastructure-as-code appears in the deployment picture
  • Use a purpose-built data store
  • Centralize egress across accounts
  • Consider serverless to remove server management

Findings

33 to verify

Enforce encryption at rest

Critical

AWS · Security · SEC08-BP02

Data written to storage and databases is readable by anyone who reaches the underlying media or a mis-scoped snapshot unless it is encrypted at rest.

  • In your stack: Amazon S3, Amazon RDS
“Encrypt private data at rest to maintain confidentiality and provide an additional layer of protection against unintended data disclosure or exfiltration.”
AWS documentation, retrieved 2026-07-19

Precedent: Uber, 2016. Tens of millions of users' and drivers' records were downloaded from S3. US FTC

Precedent: Chegg, 2022. The FTC alleged one shared AWS key with full administrative rights covered all the S3 data. US FTC complaint

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Analyze public and cross-account access

Critical

AWS · Security · SEC03-BP07

Publicly reachable buckets and over-shared resources are among the most common causes of large data exposures.

  • In your stack: Amazon S3, Amazon RDS
  • Mentioned in what you told us
“Reduce public access and cross-account access to only the specific resources that require this access.”
AWS documentation, retrieved 2026-07-19

Precedent: Capital One, 2019. ~106 million credit-card applicants' records were stolen from S3. KrebsOnSecurity

Precedent: Verizon / Nice Systems, 2017. Millions of customer records were exposed on a public S3 bucket. UpGuard

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Deploy the workload to multiple locations

High · AWS · Reliability · REL10-BP01

A single-AZ deployment fails entirely when that Availability Zone has a problem: a common, avoidable outage cause.

  • In your stack: Amazon RDS, Amazon ECS / Fargate
“Distribute workload data and resources across multiple Availability Zones or, where necessary, across AWS Regions.”
AWS documentation, retrieved 2026-07-19

Precedent: Amazon Web Services, 2025. A DNS defect made the DynamoDB endpoint in US-EAST-1 unreachable, and services that depend on it failed. AWS post-event summary

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Identify and back up all data

High · AWS · Reliability · REL09-BP01

Data you have not deliberately backed up (or proven you can reproduce) is data you can permanently lose to deletion, corruption, or ransomware.

  • In your stack: Amazon RDS, Amazon S3
“Understand and use the backup capabilities of the data services and resources used by the workload.”
AWS documentation, retrieved 2026-07-19

Precedent: Code Spaces, 2014. A code-hosting business was destroyed in ~12 hours. Threatpost

Precedent: GitLab, 2017. A wrong-terminal deletion met five backup systems that all failed. GitLab postmortem

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Enforce encryption in transit

High · AWS · Security · SEC09-BP02

Traffic that crosses the network in plaintext can be read or altered in transit, exposing credentials and sensitive payloads.

  • In your stack: Amazon CloudFront, Amazon API Gateway, Amazon RDS, Amazon ECS / Fargate
“Only use protocols with encryption when transmitting sensitive data outside of your virtual private cloud (VPC).”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Create network layers

High · AWS · Security · SEC05-BP01

Flat networks let an intruder who reaches one component move laterally to your databases and internal services.

  • In your stack: Amazon VPC, Amazon RDS
  • Mentioned in what you told us
“Segment your network topology into different layers based on logical groupings of your workload components according to their data sensitivity and access requirements.”
AWS documentation, retrieved 2026-07-19

Precedent: Microsoft, 2019. An internal customer-support analytics database was exposed after a network security group change. Microsoft Security Response Center

Precedent: MongoDB (mass campaign), 2017. Tens of thousands of exposed databases were wiped and ransomed. The Hacker News

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Store and use secrets securely

High · AWS · Security · SEC02-BP03

Secrets pasted into environment variables, code, or config files leak through logs, images, and source history.

  • In your stack: Amazon RDS, AWS Lambda, Amazon ECS / Fargate
“A workload requires an automated capability to prove its identity to databases, resources, and third-party services.”
AWS documentation, retrieved 2026-07-19

Precedent: Uber, 2016. Tens of millions of users' and drivers' records were downloaded from S3. US FTC

Precedent: Microsoft AI research, 2023. Internal files were reachable through an overly permissive storage access token. Microsoft Security Response Center

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Turn on S3 Block Public Access

High · AWS · Security

Publicly exposed S3 buckets are the single most common cause of catastrophic cloud data leaks.

  • In your stack: Amazon S3
  • Mentioned in what you told us
“By default, new buckets, access points, and objects don't allow public access.”
AWS documentation, retrieved 2026-07-19

Precedent: Verizon / Nice Systems, 2017. Millions of customer records were exposed on a public S3 bucket. UpGuard

Precedent: Deep Root Analytics, 2017. Modeled data on ~198 million US voters sat on a public S3 bucket. UpGuard

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Enforce access control on data at rest

High · AWS · Security · SEC08-BP04

Encryption alone doesn't stop an over-privileged principal from reading stored data; access control and versioning limit the blast radius.

  • In your stack: Amazon S3, Amazon RDS
“To help protect your data at rest, enforce access control using mechanisms such as isolation and versioning.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Put a WAF in front of public entry points

High · AWS · Security

Directly exposed web entry points get no application-layer inspection against common exploits like injection and bad bots.

  • In your stack: Amazon CloudFront, Amazon API Gateway
  • Mentioned in what you told us
“A protection pack (web ACL) gives you fine-grained control over all of the HTTP(S) web requests that your protected resource responds to.”
AWS documentation, retrieved 2026-07-19

Precedent: Equifax, 2017. ~145 million US consumers' data was exposed via an internet-facing web app. US GAO report GAO-18-559

Precedent: Travelex, 2020. Ransomware took a foreign-exchange business offline worldwide. The Register

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Select resource type, size, and number based on data

Medium · AWS · Cost optimization · COST06-BP02

Instances sized by guess or lift-and-shift habit are usually over-provisioned, quietly inflating the monthly bill.

  • In your stack: Amazon RDS
“Select resource size or type based on data about the workload and resource characteristics.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Match Bedrock throughput mode to real demand

Medium · AWS · Cost optimization

Provisioned Throughput bills hourly at a fixed rate whether used or not; committing before demand is proven is pure waste, while heavy steady traffic on on-demand can overpay the other way.

  • In your stack: Amazon Bedrock
“You can purchase Provisioned Throughput to provision a higher level of throughput for a model at a fixed cost.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Analyze workload metrics

Medium · AWS · Operational excellence · OPS08-BP01

Collecting telemetry without regularly analyzing it means problems and regressions surface as customer complaints, not dashboards.

  • In your stack: AWS Lambda, Amazon ECS / Fargate, Amazon RDS
“After implementing application telemetry, regularly analyze the collected metrics.”
AWS documentation, retrieved 2026-07-19

Precedent: Capital One, 2019. ~106 million credit-card applicants' records were stolen from S3. KrebsOnSecurity

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

No infrastructure-as-code appears in the deployment picture

Medium · AWS · Operational excellence

An environment clicked together in the console exists only in one person's head. Rebuilding after an incident, spinning up a test copy, or onboarding help all depend on the setup being written down as code.

  • Nothing in what you shared fills this role
“Infrastructure as code (IaC) provides consistent and automated infrastructure management capabilities which are important to DevOps adoption.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Use a purpose-built data store

Medium · AWS · Performance efficiency · PERF03-BP01

Forcing every access pattern through one general-purpose database (often a relational one) leaves performance and cost on the table.

  • In your stack: Amazon RDS, Amazon S3
  • Mentioned in what you told us
“Understand data characteristics (like shareable, size, cache size, access patterns, latency, throughput, and persistence of data) to select the right purpose-built data stores”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Use automation when obtaining or scaling resources

Medium · AWS · Reliability · REL07-BP01

Manually provisioned, fixed-size capacity either falls over under load or sits idle and expensive off-peak.

  • In your stack: Amazon ECS / Fargate, AWS Lambda
“A cornerstone of reliability in the cloud is the programmatic definition, provisioning, and management of your infrastructure and resources.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Monitor all components to detect failures

Medium · AWS · Reliability · REL11-BP01

You cannot recover from failures you cannot see; undetected degradations become customer-visible outages.

  • In your stack: Amazon ECS / Fargate, Amazon RDS
“Continually monitor the health of your workload so that you and your automated systems are aware of failures or degradations as soon as they occur.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Implement secure key management

Medium · AWS · Security · SEC08-BP01

Encryption only helps if the keys are stored, rotated, access-controlled, and audited; weak key handling undoes the protection.

  • In your stack: Amazon S3, Amazon RDS
“Secure key management includes the storage, rotation, access control, and monitoring of key material required to secure data at rest for your workload.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Configure service and application logging

Medium · AWS · Security · SEC04-BP01

Without retained logs you cannot investigate an incident, satisfy an audit, or detect misuse after the fact.

  • In your stack: AWS Lambda, Amazon API Gateway, Amazon S3
“Retain security event logs from services and applications.”
AWS documentation, retrieved 2026-07-19

Precedent: Marriott (Starwood), 2018. The FTC alleged missing network segmentation and weak monitoring across multiple breaches. US FTC complaint

Precedent: Medibank, 2022. The privacy regulator alleges remote access needed no multi-factor authentication and alerts went untriaged. OAIC concise statement, Federal Court of Australia

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Control traffic flow within your network layers

Medium · AWS · Security · SEC05-BP02

Overly permissive security groups (0.0.0.0/0, all ports) let traffic reach services that should never be exposed.

  • In your stack: Amazon VPC
  • Mentioned in what you told us
“Within the layers of your network, use further segmentation to restrict traffic only to the flows necessary for each workload.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Reach AWS services privately with VPC endpoints

Medium · AWS · Security

Traffic to public AWS service endpoints leaves your VPC and re-enters over the internet, which is harder to audit and defend.

  • In your stack: Amazon VPC, AWS Lambda, Amazon ECS / Fargate, Amazon S3, Amazon RDS
  • Mentioned in what you told us
“Traffic between a VPC endpoint and an endpoint service or resource stays within the AWS network, without traversing the public internet.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Stop clients bypassing CloudFront to hit the ALB

Medium · AWS · Security

If clients can reach the load balancer directly, they bypass CloudFront and any WAF attached to it entirely.

  • In your stack: Amazon CloudFront
  • Mentioned in what you told us
“configure your internet-facing Application Load Balancer's security groups to allow inbound traffic only from the AWS-managed prefix list for CloudFront”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Add Bedrock Guardrails to user-facing AI

Medium · AWS · Security

A user-facing generative app with no content filtering can emit harmful output, leak PII, or be steered by prompt injection.

  • In your stack: Amazon Bedrock
  • Mentioned in what you told us
“Amazon Bedrock Guardrails provides configurable safeguards to help you build safe generative AI applications.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

No secrets manager appears in this architecture

Medium · AWS · Security

Database passwords and API keys have to live somewhere. With no secrets manager in the picture, they usually end up in code, config files, or environment variables, where one leaked repo exposes them all.

  • Nothing in what you shared fills this role
“Using a purpose-built service to store, manage, and rotate these credentials helps reduce the likelihood that those credentials become compromised.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Add organization information to cost and usage

Low · AWS · Cost optimization · COST03-BP02

Untagged resources make it impossible to attribute spend to a team, product, or environment, so nobody owns the bill.

  • In your stack: Amazon S3, Amazon RDS, AWS Lambda, Amazon ECS / Fargate
“Define a tagging schema based on your organization, workload attributes, and cost allocation categories so that you can filter and search for resources”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Select software with cost-effective licensing

Low · AWS · Cost optimization · COST05-BP04

Licenses tied to CPUs or cores can dominate a workload's cost and penalize you for scaling.

  • In your stack: Amazon RDS
“Open-source software eliminates software licensing costs, which can contribute significant costs to workloads.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Supply resources dynamically

Low · AWS · Cost optimization · COST09-BP03

Provisioning for peak load and leaving it running means paying for idle capacity most of the day.

  • In your stack: Amazon ECS / Fargate
“This can be demand-based, such as through automatic scaling, or time-based, where demand is predictable and resources are provided based on time.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Centralize egress across accounts

Low · AWS · Operational excellence

Scattered internet-egress paths across many accounts are hard to inspect and govern consistently.

  • In your stack: Amazon VPC
“Network Firewall supports stateful rules that you can use to limit internet access to specific domains.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Implement data access patterns that use caching

Low · AWS · Performance efficiency · PERF03-BP05

Repeatedly reading the same hot data from the origin adds latency and load that a cache would absorb.

  • In your stack: Amazon RDS, Amazon S3, Amazon CloudFront, Amazon API Gateway
“Implement access patterns that can benefit from caching data for fast retrieval of frequently accessed data.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Consider serverless to remove server management

Low · AWS · Performance efficiency

Running and patching your own servers is operational overhead that a serverless option often removes while scaling better.

  • In your stack: Amazon ECS / Fargate
“Serverless architectures remove the need for you to run and maintain physical servers for traditional compute activities.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Be aware of service quotas and constraints

Low · AWS · Reliability · REL01-BP01

Hitting an unmonitored service quota during a traffic spike or failover causes a hard outage exactly when you can least afford it.

  • In your stack: AWS Lambda, Amazon RDS
“Be aware of your default quotas and manage your quota increase requests for your workload architecture.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Filter outbound traffic to limit data exfiltration

Low · AWS · Security

Unrestricted egress lets a compromised host quietly exfiltrate data or reach command-and-control infrastructure.

  • In your stack: Amazon VPC, Amazon ECS / Fargate
“You can create allow lists and deny lists with domain names that the stateful rules engine looks for in network traffic.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Choose Region based on business and sustainability goals

Low · AWS · Sustainability · SUS01-BP01

Region choice affects not only latency and cost but also the carbon intensity of the power behind your workload.

  • In your stack: Amazon S3, Amazon RDS, Amazon ECS / Fargate
“Choose a Region for your workload based on both your business requirements and sustainability goals to optimize its KPIs, including performance, cost, and carbon footprint.”
AWS documentation, retrieved 2026-07-19

The exact change for your environment, its sequencing, and validating it holds are part of a full review.

Already working in your favour

Not everything we found is a problem. These are documented protections your stack already has: cited, so you can stop wondering.

Bedrock does not train on your data: confirmed

Teams often assume every LLM trains on their prompts; for Bedrock that assumption is wrong, and knowing it changes what data you can responsibly send.

“Amazon Bedrock never shares your data with model providers or uses it to train foundation models.”
AWS documentation, retrieved 2026-07-19

A full review also examines

  • IAM and access-policy analysis: who can do what, and where it's broader than it should be
  • Egress paths and data-exfiltration risk
  • Backup and restore testing: not just that backups exist, but that they actually restore
  • Logging and monitoring coverage across the whole stack
  • The exact, sequenced remediation plan for your environment, and validation that each fix holds

What it would cost to fix

Each line is its hours at $175/hour, no base fee. Items already working in your favour are free. Estimate, not an offer; final pricing by signed statement of work.
FindingEffortEstimate
Enforce encryption at rest4 h$700
Analyze public and cross-account access2 h$350
Deploy the workload to multiple locations12 h$2,100
Identify and back up all data3 h$525
Enforce encryption in transit3 h$525
Create network layers8 h$1,400
Store and use secrets securely4 h$700
Turn on S3 Block Public Access0.25 h$44
Enforce access control on data at rest3 h$525
Put a WAF in front of public entry points3 h$525
Select resource type, size, and number based on data3 h$525
Match Bedrock throughput mode to real demand1 h$175
Analyze workload metrics4 h$700
No infrastructure-as-code appears in the deployment picture16 h$2,800
Use a purpose-built data store12 h$2,100
Use automation when obtaining or scaling resources8 h$1,400
Monitor all components to detect failures4 h$700
Implement secure key management4 h$700
Configure service and application logging4 h$700
Control traffic flow within your network layers4 h$700
Reach AWS services privately with VPC endpoints3 h$525
Stop clients bypassing CloudFront to hit the ALB0.5 h$88
Add Bedrock Guardrails to user-facing AI2 h$350
No secrets manager appears in this architecture4 h$700
Add organization information to cost and usage3 h$525
Select software with cost-effective licensing1 h$175
Supply resources dynamically3 h$525
Centralize egress across accounts16 h$2,800
Implement data access patterns that use caching4 h$700
Consider serverless to remove server management12 h$2,100
Be aware of service quotas and constraints1 h$175
Filter outbound traffic to limit data exfiltration8 h$1,400
Choose Region based on business and sustainability goals1 h$175
Bedrock does not train on your data: confirmed0 hFree
Estimated totalEstimate, not an offer; final pricing by signed statement of work.$28,131

Next steps

  • RAG or LLM system auditRecommended

    $1,950

    The stack reads as a language-model application with findings that matter. This audit covers retrieval quality, evaluation, cost, and security on the system you already run.

    Estimate, not an offer; final pricing by signed statement of work.

    See this offer

  • Advisory retainer

    $4,500 per month, 3-month minimum

    Findings spread across several pillars on a production workload usually need steady attention. Up to 20 hours a month, capped, for at least three months.

    Estimate, not an offer; final pricing by signed statement of work.

    See this offer

  • Advisory Call (90 minutes)

    $249

    A 90-minute working session on your architecture, with written recommendations within 48 hours. The lightest way to turn this list into a plan.

    Estimate, not an offer; final pricing by signed statement of work.

    See this offer
Book a 30-minute callSend a message instead
Quoted material is © the respective provider; used under fair use (or CC BY 4.0 for Google Cloud) for commentary on your specific diagram. Every link goes to the official source, and a scheduled job re-checks each quote against the live page.

The sample is a fixed fixture. A real review reads your own diagram, Terraform, or description.