'%20fill='%23000000'%20stroke='none'%3e%3cpath%20d='M%201784.53%205631.9%20C%201775.53%205618.9%201692.53%205479.9%201598.53%205322.9%20C%201395.53%204983.9%201355.53%204919.9%201342.53%204915.9%20C%201332.53%204912.9%201315.53%204938.9%201090.53%205311.9%20C%201023.53%205423.9%20960.53%205523.9%20951.53%205534.9%20C%20936.53%205549.9%20918.53%205552.9%20816.53%205552.9%20C%20751.53%205552.9%20696.53%205548.9%20692.53%205542.9%20C%20689.53%205537.9%20721.53%205475.9%20763.53%205405.9%20C%20806.53%205335.9%20855.53%205252.9%20872.53%205222.9%20C%20889.53%205192.9%20941.53%205106.9%20987.53%205032.9%20C%201032.53%204958.9%201161.53%204746.9%201272.53%204562.9%20C%201383.53%204378.9%201522.53%204147.9%201581.53%204050.9%20L%201689.53%203872.9%20L%201823.53%203872.9%20C%201897.53%203872.9%201957.53%203874.9%201957.53%203876.9%20C%201957.53%203879.9%201887.53%203997.9%201800.53%204139.9%20C%201513.53%204612.9%201487.53%204657.9%201487.53%204674.9%20C%201487.53%204697.9%201788.53%205192.9%201802.53%205192.9%20C%201807.53%205192.9%201830.53%205162.9%201852.53%205125.9%20C%201874.53%205088.9%201902.53%205042.9%201913.53%205023.9%20C%201925.53%205003.9%201993.53%204890.9%202065.53%204772.9%20C%202395.53%204228.9%202458.53%204121.9%202452.53%204112.9%20C%202448.53%204106.9%202382.53%204102.9%202287.53%204102.9%20C%202200.53%204102.9%202126.53%204098.9%202123.53%204094.9%20C%202120.53%204089.9%202147.53%204038.9%202183.53%203979.9%20L%202249.53%203872.9%20L%202563.53%203872.9%20C%202736.53%203872.9%202877.53%203875.9%202877.53%203878.9%20C%202877.53%203882.9%202812.53%203991.9%202734.53%204121.9%20C%202537.53%204445.9%202057.53%205239.9%201929.53%205452.9%20C%201801.53%205664.9%201804.53%205662.9%201784.53%205631.9%20Z'%20style='fill:%20rgb(215,%2032,%2038);'/%3e%3cpath%20d='M%202191.53%205539.9%20C%202187.53%205527.9%202443.53%205099.9%203052.53%204100.9%20L%203191.53%203872.9%20L%203324.53%203872.9%20C%203397.53%203872.9%203457.53%203874.9%203457.53%203876.9%20C%203457.53%203879.9%203366.53%204031.9%203255.53%204214.9%20C%203144.53%204397.9%202964.53%204696.9%202854.53%204877.9%20C%202744.53%205059.9%202607.53%205285.9%202550.53%205380.9%20L%202445.53%205552.9%20L%202321.53%205552.9%20C%202226.53%205552.9%202195.53%205549.9%202191.53%205539.9%20Z'%20style='fill:%20rgb(215,%2032,%2038);'/%3e%3cpath%20d='M%201029.53%204386.9%20C%201014.53%204360.9%20993.53%204325.9%20982.53%204308.9%20C%20970.53%204291.9%20938.53%204237.9%20909.53%204187.9%20C%20880.53%204138.9%20829.53%204053.9%20797.53%203999.9%20C%20764.53%203944.9%20737.53%203894.9%20737.53%203886.9%20C%20737.53%203874.9%20759.53%203872.9%20864.53%203874.9%20L%20991.53%203877.9%20L%201099.53%204049.9%20L%201207.53%204220.9%20L%201144.53%204326.9%20C%201110.53%204384.9%201076.53%204432.9%201069.53%204432.9%20C%201062.53%204432.9%201044.53%204411.9%201029.53%204386.9%20Z'%20style='fill:%20rgb(215,%2032,%2038);'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Legal Legends — AWS Security Hardening & DevOps Stabilisation
Project Overview
Legal Legends engaged Scalexa to urgently review and lock down AWS access, reduce risk, and bring clarity to an inherited AWS environment. The work quickly expanded into broader DevOps stabilisation, governance improvements, and ongoing advisory support. This was a live production SaaS platform with multiple historical developers and administrators who had access over time—creating unclear ownership of IAM users, access keys, repositories, and deployment workflows.
The Challenge
Legal Legends had grown organically over time, with various developers and administrators granted access to AWS, Bitbucket, and other infrastructure. As the company evolved, it became unclear which accounts were still needed, which credentials were in use by services, and who actually owned what. The team needed to regain control without breaking production.
- Numerous IAM users and access keys with unclear ownership or purpose
- Some accounts had not been used for years, others were still active
- Risk that credentials might still be in use by internal AWS services or legacy automation
- No clear policy for deactivating, rotating, or deleting credentials
- Uncertainty around Bitbucket ownership and deployment control
- Desire to simplify AWS usage, improve security posture, and reduce unnecessary cost
- Need for pragmatic advice, not theoretical best practices
What We Did
We took a calm, methodical approach to untangling the environment. Rather than making sweeping changes that could disrupt production, we audited, categorised, and then acted incrementally—giving the platform time to surface any dependencies before permanent removal.
- Performed a full IAM audit: console vs access-key users, last-used timestamps, and scope of permissions
- Categorised accounts into: active and required, inactive but potentially recoverable, obsolete and safe to retire
- Recommended and implemented a phased lockdown approach: disable unused access keys, remove console access where no longer required, observe for issues before permanent deletion
- Established a 30-day decommissioning policy for inactive users
- Took control of project management and remediation work via Asana
- Reviewed broader AWS setup and flagged opportunities for simplification, cost reduction, and improved governance
- Advised on source control and deployment ownership, including Bitbucket access and permissions
Operating Model
Rather than a fixed architecture, we established an operating model that would scale with the team and remain clear as personnel changed over time.
- Cloud platform: AWS with clearly documented infrastructure
- Identity & access: IAM with defined users, access keys, and console permissions
- Governance: Usage tracking, last-used reviews, staged deactivation
- DevOps: Centralised ownership of repositories and deployment flows
- Project coordination: Asana-based task tracking and prioritisation
Technical Approach
Our approach reflected years of experience working with inherited environments. We focused on practical risk reduction rather than over-engineered solutions.
- Practical IAM audits in live production environments
- Risk-reduction without service disruption
- Clear policies for access key rotation and removal
- Terraform adoption for codifying infrastructure state and preventing configuration drift
- Calm handling of inherited technical debt
- Security improvements without over-engineering
- Advisory input spanning AWS, DevOps, and deployment workflows
Security and Reliability
Security hardening in a live environment requires care. We applied a least-privilege mindset incrementally, ensuring each change was observed before the next was made.
- Least-privilege mindset applied incrementally
- Controlled deactivation to avoid breaking services
- Ongoing visibility into access usage
- Governance patterns that scale as teams change
Outcomes
- AWS access significantly tightened and clarified
- Reduced risk from stale credentials and unknown admin users
- Clearer ownership of infrastructure and repositories
- Improved confidence in the platform's security posture
- Foundation laid for cost optimisation and further simplification
Why It Matters
This engagement demonstrated the value of a calm, senior approach to cloud security. Rather than panic or over-react, we methodically reduced risk while keeping production stable. Legal Legends now has a clear picture of their AWS environment, a governance model that will scale, and a foundation for ongoing improvements.
Services Behind This Project
The same senior teams that delivered this work:
"The Scalexa team was fantastic, and communicated clearly throughout in what was a high-pressure environment with a strict deadline. They went above and beyond at all opportunities."