opsserving

    // Security

    Security

    What it actually looks like when an outside engineer works inside your AWS account: how access is granted, what happens to your data, and what we will not claim about ourselves.

    // Access

    How we get into your account

    Read-only, least privilege

    Audits run on an IAM role you create yourself, scoped to read-only. No write permissions and no shared credentials.

    Every call is visible to you

    Work happens through your account, so every API call we make shows up in your CloudTrail logs. Nothing is hidden behind our tooling.

    You can revoke at any time

    Access is a role you control. Delete it and we are out, no support ticket and no waiting.

    // Data

    How we handle your data

    • Credentials stay in your account. We use Secrets Manager or Parameter Store, never a shared password file.
    • We do not copy production data out of your environment. Analysis runs against your account, not a local dump.
    • Reports and notes live in encrypted storage and get deleted on request.
    • Written work is covered by an NDA when you want one, signed before access is granted.
    • OpsServing operates from the EU, so GDPR applies to any personal data we handle. See the privacy policy for the detail.

    // Credentials

    Who is doing the work

    Kostiantyn Dementiev, a senior AWS engineer. The security credentials below are his, held personally and kept current. They are not a company audit and they are not a substitute for one.

    • AWS Security Specialty
    • AWS Solutions Architect Associate
    • AWS Developer Associate
    • AWS SysOps Administrator Associate
    • Certified Kubernetes Security Specialist (CKS)
    • Certified Kubernetes Administrator (CKA)
    • Certified Kubernetes Application Developer (CKAD)
    • HashiCorp Terraform Associate
    • Snowflake SnowPro Core

    // SOC 2 readiness

    Hardening for your audit

    A common reason teams call: an enterprise customer asked for SOC 2 and the AWS account is not ready. This is the work that closes those findings.

    IAM least privilege

    Wildcard policies replaced with scoped roles, unused users and keys removed, permission boundaries where they help.

    Secrets Manager with rotation

    Hardcoded credentials moved into Secrets Manager, automatic rotation configured, application code updated to read them.

    WAF in front of public endpoints

    Managed rule groups tuned to your traffic, plus logging so you can show what was blocked and when.

    MFA and alerting

    MFA enforced on privileged accounts, with alerts on root usage and on the console logins an auditor will ask about.

    // Plainly

    What we do not claim

    OpsServing is a one engineer practice. It has not been through a SOC 2 audit, it is not ISO 27001 certified, and it is not a HIPAA or PCI DSS assessed entity. Anyone telling you otherwise about a shop this size is selling you a logo.

    There is no security operations center here, no 24/7 monitoring desk, and no incident response team on standby. What you get is a certified engineer who hardens your account, sets up the alerting so your own team sees problems early, and answers within one business day.

    // Disclosure

    Reporting a security issue

    Found something wrong with this site or with work we delivered? Write to hello@opsserving.com with "Security issue" in the subject. It reaches the engineer directly and gets an answer within one business day.

    Questions about how your data is stored are answered in the privacy policy, or ask on the contact page.