Crest Data partnered with the customer to implement a defense-in-depth, code-defined Security Operations model on AWS. The solution combines AWS-native security services like IAM, KMS, AWS WAF, Security Hub, Guard Duty AWS Config, CloudTrail, ACL & Security Groups and Secrets Manager with zero-trust operator access and version-controlled guardrails. The result is consistent security posture, least-privilege access, centralized monitoring, and faster incident response across every customer environment.

About the Customer  

The customer is a leading AI-powered cybersecurity platform provider that helps organizations centralize security operations, manage data routing across multiple environments, and accelerate security analytics. The platform is designed to simplify security infrastructure, support multi-cloud and multi-tenant deployments, and enable seamless integration with enterprise identity and security ecosystems.

Customer Challenge  

The customer’s multi-account, multi-tenant model delivers strong isolation, but operating security at fleet scale introduced distinct challenges:

• Posture consistency : Enforcing uniform security controls across many independent AWS accounts is difficult to do manually and prone to drift.
• Sensitive data protection : Customer security telemetry demands strong encryption, strict access control, and verifiable handling.
• Broad attack surface : Public ingress, customer-facing APIs, and operator access paths all require hardening and continuous monitoring.
• Centralized visibility : Threat detection, audit logging, and compliance evidence needed to span every isolated account from a single vantage point.
• Access governance : Privileged access for the Crest Cloud Operations team and the customer’s engineering team required clear separation of duties and elimination of standing credentials.

Left unaddressed, these risked unauthorized access, inconsistent posture, slow incident response, and compliance gaps.

Proposed Solution & Architecture

Environment Setup

The SaaS control plane and each tenant run in separate AWS accounts, each in a dedicated Amazon VPC with public and private subnets across three Availability Zones for isolation and resilience.

All infrastructure and security controls are provisioned through Terraform/Terragrunt IaC and reconciled via GitOps, so guardrails are codified, version-controlled, and consistent across the fleet.

Security Operations Framework

Security Operations ensures the customer environment remains secure, monitored, compliant, and resilient.

Identity & Access Management

AWS IAM with least-privilege and RBAC, and IRSA for pod-level, scoped permissions with no broad or shared roles.

Customer authentication via Amazon Cognito is federated to customer identity providers (Okta, Microsoft Entra ID, Google) over SAML/OAuth2, with MFA.

Zero-trust operator access (AWS SSO with short-lived credentials and brokered SSH/kubectl access), no standing privileged access to clusters.

Network Security Operations

Isolated VPCs with restrictive security groups, NAT/Internet Gateways, and private subnets for workloads; VPC endpoints keep traffic on the AWS backbone.

AWS WAF integrated with Application/Network Load Balancers, plus IP allow-listing on inbound security groups, protects public surfaces.

Mutual TLS (mTLS) secures service-to-service and cross-account traffic via NGINX ingress; EKS API endpoints are private.

VPC Flow Logs delivered to S3 for network traceability.

Security Monitoring & Threat Detection 

AWS CloudTrail provides comprehensive, org-wide audit logging; AWS Config continuously evaluates resource configuration compliance.

Amazon GuardDuty performs continuous threat detection; AWS Security Hub centralizes posture and findings across all accounts.

Amazon ECR image scanning catches vulnerable container images before deployment.

A federated Prometheus + ELK + Grafana stack adds runtime anomaly detection, a code-defined alert catalog, certificate-expiry tracking, and on-call routing.

Data Protection & Compliance Operations

AWS KMS encrypts sensitive data at rest (S3, EBS, EFS, RDS) and TLS-only policies enforce encryption in transit.

Credentials, certificates, and secrets are stored in AWS Secrets Manager (with 1Password) and rotated; never committed to code.

Encrypted, automated backups and fully reproducible-from-code environments support recovery and continuity.

Centralized audit logging and continuous compliance monitoring (CloudTrail, Security Hub, Config) provide the evidence needed for security reviews and compliance objectives.

Outcomes & Success Metrics

Security & Compliance

• 100% of inbound traffic protected through AWS WAF + ALB/NLB + federated IdP authentication with MFA.
• 100% encryption coverage for sensitive data at rest and in transit via KMS and TLS-only policies.
• Centralized, continuous posture across every AWS account via GuardDuty, Security Hub, and AWS Config.
• Complete audit-trail coverage of resource and user activity through CloudTrail.

Operational

• 70–80% faster incident detection and response through centralized, code-defined monitoring and alerting.
• Zero standing privileged credentials, least-privilege IAM/IRSA, and zero-trust operator access reduced unauthorized-access risk.
• Consistent, codified guardrails applied uniformly across the fleet, eliminating configuration drift.

Conclusion

• Enhanced Security Posture: Strengthened security operations using AWS IAM, KMS, WAF, GuardDuty, Security Hub, and CloudTrail, delivering robust access control, threat protection, continuous monitoring, and centralized visibility across every account.
• Secure, Resilient Platform: Routing all inbound traffic through AWS WAF and load balancers with mTLS and private endpoints protected workloads while preserving high availability and isolation.
• Compliance & Governance Excellence: CloudTrail, Security Hub, AWS Config, and least-privilege access established comprehensive audit logging, continuous compliance monitoring, and clear separation of duties, supporting customer’s security and compliance objectives as it scales.

About Crest Data

Crest Data is a data and AI-driven technology solutions provider for enterprises and technology innovators in Cybersecurity and Observability. We help enterprises build secure, scalable, and resilient platforms through AWS-native architectures, automation, and DevSecOps best practices.