Read-Only Forensic Auditing of GovCon Cloud Environments: Architecture and Execution

Access Architecture: Read-Only + Billing, No Admin

The audit begins with a strict access provisioning step. The access model is read-only with billing visibility — no administrative permissions, no IAM write access, no ability to terminate or modify resources during the discovery phase.

AWS GovCloud: The client creates an IAM user with the following AWS-managed policies attached: ReadOnlyAccess and Billing. No custom policies are required. The IAM user is scoped to the us-gov-west-1 and us-gov-east-1 regions. Cross-account role assumption via sts:AssumeRole is not used during Phase 1 — a dedicated IAM identity with static credentials is provisioned and revoked at audit close.

Azure Government: The client assigns the Reader role and the Billing Reader role at the subscription scope. No resource group-level assignments are needed. The audit identity is a service principal registered in the Azure Government tenant, not a user account. The client retains full control of the service principal lifecycle.

GCP Assured Workloads: The client grants the roles/viewer and roles/billing.viewer IAM roles at the project level. For organizations running Assured Workloads with Access Transparency enabled, audit log visibility is provided to the client throughout the engagement. No service account keys are exported — the audit uses short-lived credentials scoped to the project.

This access model is deliberate. Read-only constraints eliminate the possibility of accidental production changes during discovery and allow the client's security team to verify the access grant without requiring a change advisory board approval for the audit phase itself.

Discovery: What Gets Inventoried

The discovery phase targets three waste categories across all three platforms, using native billing APIs and resource management endpoints.

Orphaned Infrastructure

Unattached storage volumes are identified by querying volume state. On AWS GovCloud, the EC2 DescribeVolumes API call with a filter on status=available returns EBS volumes with no current attachment. On Azure Government, the Compute API surfaces managed disks where diskState is Unattached. On GCP, Persistent Disks with no users field populated in the Compute Engine API response are flagged. Volumes in these states generate storage charges at the provisioned capacity rate regardless of whether any data is actively read or written.

Orphaned static IP addresses follow the same pattern. AWS Elastic IPs not associated with a running instance or network interface bill at $0.005/hour — approximately $43.80/year per address. At scale, unused Elastic IPs across multiple environments accumulate material monthly charges. Azure Public IP addresses not attached to a running resource and GCP External Static IP addresses with no forwarding rule association are identified through the same API-level status query.

Idle load balancers are identified by querying CloudWatch metrics (AWS), Azure Monitor (Azure), or Cloud Monitoring (GCP) for request counts and active connection counts over a trailing 14-day window. An Application Load Balancer or Application Gateway showing zero RequestCount or zero active backend connections over 14 consecutive days has no active traffic path and no production justification for continued billing. For a full breakdown of the financial case for corrective cloud engagement (opens in a new tab) — including the fee structure and annualized savings model — see Avalon's CFO-focused analysis of this same waste category.

Compute Right-Sizing

CPU utilization data is pulled from CloudWatch, Azure Monitor, and Cloud Monitoring for all running instances. The flag threshold is peak CPU utilization below 5% for 7 or more consecutive days. This is a conservative threshold — it eliminates false positives from intermittent batch workloads while capturing genuinely over-provisioned capacity.

The right-sizing recommendation is always one tier down, not a full decommission. An EC2 t3.2xlarge (8 vCPU, 32 GB RAM) running at sub-5% peak maps to a t3.xlarge (4 vCPU, 16 GB RAM) in the same instance family, preserving the memory-to-CPU ratio and instance profile. An Azure Standard_D8s_v3 (8 vCPU, 32 GB RAM) maps to a Standard_D4s_v3 (4 vCPU, 16 GB RAM). Same generation, same storage type, half the compute allocation.

Right-sizing is not executed without the client's written approval of the Optimization Roadmap. The roadmap identifies each instance by resource ID, current tier, recommended tier, monthly delta, and annualized delta. No resize operation runs without that approval in writing.

Storage Mis-Tiering

Storage tiering analysis queries bucket-level metadata and object access patterns. On AWS GovCloud, S3 Intelligent-Tiering access metrics or Storage Lens data surfaces buckets where objects have not been accessed in 90 or more days but remain in the Standard storage class. On Azure Government, Blob Storage access tier is read from the storage account properties API — Standard or Hot buckets holding objects with zero read operations over 90 days are flagged for Cool or Archive migration. On GCP Assured Workloads, Storage bucket lifecycle policies are reviewed against actual object access logs from Cloud Audit Logs.

The migration target is always the lowest-cost tier that matches the access frequency. Standard to Glacier Deep Archive (AWS), Hot to Archive (Azure), Standard to Coldline or Archive (GCP). Early deletion penalties are calculated before recommending migration for any object class with minimum storage duration requirements.

Remediation Execution and the Cloud Execution Ledger

After client approval of the Optimization Roadmap, Avalon's access model changes. Write access is provisioned specifically for the approved action set — not broad administrative access. Each remediation action is logged in real time to the Cloud Execution Ledger: resource ID, action type, UTC timestamp, before-state, after-state, and projected monthly cost delta.

The Ledger is the authoritative record for performance fee calculation and for the client's internal change management documentation. It also functions as direct evidence of an inventory review executed against defined parameters — a foundational input to the continuous authorization posture for federal programs (opens in a new tab) that HHS PMOs and ISSOs are now required to maintain under current cATO frameworks. No resource is terminated or resized without a corresponding Ledger entry created before execution.

Automated Cost Guardrails

After remediation, billing alerts are configured in each platform's native cost management tool: AWS Budgets, Azure Cost Management, or GCP Billing Budgets. Alerts are set at 80% and 100% of the client's newly established monthly spend baseline. An unexpected spike in billing — from a new task order spinning up infrastructure without decommission planning — triggers an automated notification to the client's designated billing contact before it compounds.

This is not a monitoring service. It is a one-time configuration delivered as part of the Phase 1 engagement. The client owns and controls the alert configuration after Avalon's access is revoked.

Security Findings Captured Under Read-Only

The read-only access granted for Phase 1 surfaces security misconfigurations that are visible without write operations. These are logged in the Infrastructure Health and Security Snapshot, a separate appendix delivered alongside the Executive ROI Summary.

Common findings include: IAM users or roles with wildcard permissions ("Action": "" or "Resource": ""), S3 buckets or Azure Blob containers with public access enabled, EC2 security groups or Azure NSGs with 0.0.0.0/0 inbound rules on SSH (port 22) or RDP (port 3389), unencrypted EBS volumes or Azure managed disks without server-side encryption, and GCP service accounts with Owner-level role bindings at the project level.

These findings are documented but not remediated in Phase 1. They require admin access and a formal Change Advisory Board approval process. They are the input to the Phase 2 Cybersecurity Hardening Sprint, with direct CMMC and NIST 800-171 cost implications for GovCon contractors (opens in a new tab) that most cannot afford to ignore past their next contract renewal.

Evidence Artifacts Produced

Phase 1 produces four documents: the Current State Financial Baseline (trailing 90-day spend by resource type and region), the Optimization Roadmap (approved action set with per-item financial delta), the Cloud Execution Ledger (timestamped remediation log), and the Executive ROI Summary (before/after spend comparison with annualized savings calculation).

These artifacts are client-owned upon full payment per the engagement MSA. Avalon retains no access to the client environment after credential revocation at audit close.

If your team needs a structured inventory of what is running in your GovCon cloud environment — what it costs, what is doing nothing, and what is quietly creating compliance exposure — the Phase 1 audit produces that picture in 5 business days from access confirmation.

THE 2026 DELTA

Two 2026 regulatory developments are directly relevant to the technical findings a Phase 1 audit surfaces.

NIST 800-171 Rev 3 introduced Organization-Defined Parameters across the Configuration Management (CM) and Access Control (AC) control families. CM-8, the system component inventory control, now requires organizations to set explicit ODP values defining the frequency and scope of inventory reviews. An unreviewed cloud environment with orphaned resources and no documented decommission decisions fails CM-8 ODP compliance regardless of what else the SSP says. The Cloud Execution Ledger produced in Phase 1 is direct evidence of an inventory review executed against defined parameters.

CISA BOD 26-02, issued February 5, 2026, established mandatory Edge Device Liquidation timelines with an 18-month hard deadline for replacing End-of-Support components in federal environments. While BOD 26-02 targets physical edge devices, the underlying principle applies to cloud resources as well: unmanaged, undocumented infrastructure with no active owner creates attack surface. The Infrastructure Health and Security Snapshot produced in Phase 1 identifies exactly that class of exposure — resources that exist in the environment with no operational justification and no security controls actively monitoring them.

The audit methodology Avalon uses in Phase 1 is built for this environment. Read-only access, timestamped evidence, platform-native API queries against FedRAMP-authorized endpoints, and zero production disruption are not optional features. They are baseline requirements for operating inside a GovCon cloud boundary.