OTG IT Audit Center
Enterprise Cloud Security, Identity Auditing & Fed Gateway Governance • Account: 893256823766 (ap-southeast-1)
Pre-Launch Security Gate: Federation Gateway (Fed Gateway) 2FA
GATE STATUS: CONDITIONAL BLOCKProduction launch requires 100% of administrative identities to authenticate via Fed Gateway (SAML/OIDC) with mandatory 2FA. Currently, kiatotg (AdministratorAccess) bypasses the Fed Gateway with unmanaged direct IAM credentials and no MFA.
Cloud Risk Trend
Security & Compliance Activity
Recent Cloud Security Events
Storage & Data Leakage Checks
Credentials & API Key Security
Authoritative Master Records (Identities & Access)
Identity specifications: WHO - WHAT EMAIL | ACCESS to what rights | Last audit date
| Cloud | WHO (Identity) | WHAT EMAIL | ACCESS Rights & Policies | MFA Status | Audit Status | Last Audit Date | Action |
|---|---|---|---|---|---|---|---|
| Loading master records... | |||||||
EC2 Infrastructure Grid (Singapore ap-southeast-1)
18 total servers: 16 Running production/staging instances, 1 Terminated
| State | Workload / Name | Instance ID | Type | Public IP | Private IP | Storage (EBS) | Load Balancer | Security Groups |
Last Audit
|
|---|---|---|---|---|---|---|---|---|---|
| Loading EC2 instances... | |||||||||
Storage & S3 Data Leakage Control
Centralized audit for S3 buckets, public access blocking, and encryption
| Bucket Name | Region | Public Access Block | Default Encryption | Associated IAM Principal | Last Audit Date |
|---|---|---|---|---|---|
| Loading S3 buckets... | |||||
Key Management Service (KMS) & Active Credentials
Inspection of KMS customer managed keys and annual rotation policies
| KMS Key ID | ARN | State | Rotation Policy | Last Audit Date |
|---|---|---|---|---|
| Loading KMS keys... | ||||
Immutable Audit Trail (Change Logs)
Chronological history of identity additions, permission escalations, and audit scans
| Timestamp (UTC) | Identity Name | Event Type | Diff / Change Summary | Audited By |
|---|---|---|---|---|
| Loading audit trail... | ||||
Federation Gateway (Fed Gateway) 2FA Security Gate
PRE-LAUNCH GATE: CONDITIONAL BLOCKIdentity Federation (SAML 2.0 / OIDC) with mandatory multi-factor authentication before production release
Top 2 Critical Issues Identified Prior to Production Launch
Direct IAM Admin Login Bypassing Fed Gateway 2FA
The user kiatotg holds unrestricted AdministratorAccess directly in AWS IAM without MFA. This allows an administrative session to be established directly into AWS without passing through the corporate Fed Gateway, completely circumventing corporate 2FA policies, central SSO session revocation, and audit logs.
kiatotg.Direct Public IPv4 Exposure on Production Fleet
16 active running EC2 instances (including production workloads Lasalle, ChargeDot, PMKIT, Suss-ial) have public IPv4 addresses assigned with direct internet exposure. Management access via open SSH/RDP ports on public IPs increases lateral movement risks if perimeter security groups are misconfigured.
Fed Gateway 2FA Identity Compliance Matrix
Live evaluation of local AWS identities against Fed Gateway SAML/OIDC 2FA requirements
| Identity (WHO) | Verified Email | Access Rights | Local MFA | Fed Gateway 2FA Status | Pre-Launch Gate |
|---|---|---|---|---|---|
| kiatotg | [email protected] | AdministratorAccess | NO (Direct Login) | BYPASSING GATEWAY | BLOCKED |
| geraldotg | [email protected] | EC2FullAccess, Lightsail | YES | Federated 2FA Ready | PASSED |
| huycorsivalab | [email protected] | AdministratorAccess | YES | Federated 2FA Ready | PASSED |
| phuongcorsivalab | [email protected] | AdministratorAccess | YES | Federated 2FA Ready | PASSED |
| trietcorsivalab | [email protected] | AdministratorAccess | YES | Federated 2FA Ready | PASSED |
| polwel-nexus-s3-upload | Service Account | Policy-S3-Upload-App | N/A (API Key) | Console Disabled | PASSED |
| security-auditor | Audit Daemon | SecurityAudit, ReadOnly | N/A (CLI Key) | Strict Read-Only | PASSED |
Enterprise Multi-Cloud Integration: Microsoft Azure Support
The central SQLite database security_audit.db natively incorporates the provider identifier ('AWS' or 'AZURE'). When connecting your Azure tenant, Microsoft Entra ID (Azure AD) and Azure RBAC role assignments will be managed concurrently within this exact dashboard.
How Azure Connects
The AzureAuditProvider scans Users, Service Principals, and Subscriptions with read-only Reader role.
Required Credentials
Create a standard Azure App Registration and provide Tenant ID, Client ID, Client Secret, and Subscription ID.
Google Vertex AI Cloud Governance Copilot
HYBRID RAG ACTIVEGrounding: AWS Account 893256823766 • Model: gemini-2.5-flash • Embeddings: text-embedding-004
Hello! I am your Vertex AI Cloud Governance Copilot.
Active: Phuong's Vertex AI (vertex-510710)I am grounded in your live AWS infrastructure, FinOps cost tables, and CloudTrail activity audit logs. You can ask me questions about:
- Resource costs and monthly spend fluctuations (e.g. Lasalle, Doverpark).
- Who performed operations on specific servers, what actions were taken, and source IPs.
- Unattached or un-optimized workloads, load balancer integrations, and EBS volumes.
otg-cloud-governance / Singapore asia-southeast1).