I’m being tasked with performing the organizations first cloud security assessment and oddly enough, I have barely grasped the AWS world. I’m still learning and since it’s such a huge beast, I’m going to be learning for a while. The thing is, with this assignment, I’m not really sure what I should be looking at and what should be the “correct” way of doing things.

So far I’ve looked at some white papers and the guidance provided on the US-Cert page but I think it’s either overkill or just not enough. I was hoping to see if anyone here can help guide or point me in the right direction.

Appreciate all the help. Thank you

Edit: I should’ve noted that I’m a cyber security professional lacking cloud experience. I’ve performed several security assessments on “traditional” infrastructure, but the cloud and AWS world is new to me and I’m still learning. Thanks again to everyone who has helped.