Public Cloud Infrastructure

Principal workflows

• Onboard: Moraph sets up the AWS organization and landing zone for your institution, or takes over an existing one, and brings each account under the agreed baseline.
• Guard: Guardrails are written as code. Preventive policies stop risky actions such as making a storage bucket public; detective rules flag drift; pipeline checks stop non-compliant infrastructure before it is deployed.
• Watch: Moraph's security operations team watches findings from AWS logging and detection services across all accounts and handles them under agreed runbooks.
• Review: Each month Moraph reviews the environment with you: drift, findings, changes, exceptions, access and spend, with evidence ready for audit.

Who uses it

• Banks, credit unions, lenders and investment firms running or moving workloads to AWS
• CISOs and security teams who answer for cloud controls
• Infrastructure and platform teams who want an operated landing zone rather than building one
• Application teams who need cloud accounts quickly without bypassing controls
• Internal audit, third-party risk and examiners reviewing cloud governance

Reporting

• Baseline compliance and drift by account
• Open findings and how they were handled
• Changes with their approvals and outcomes
• Exceptions and their review dates
• Spend by account and workload
• Control evidence packs for audit and exams

Features

• Multi-account landing zone: Separate AWS accounts for production, non-production, logging, security and shared services, organized so policies apply by environment and business line.
• Preventive guardrails: Service control policies stop actions your baseline forbids in every account, such as disabling CloudTrail, leaving approved regions or turning off S3 Block Public Access.
• Public storage prevention: S3 Block Public Access is enforced at the account level, and bucket policies granting access outside your organization are rejected in the pipeline and flagged if they appear.
• Pipeline policy checks: Infrastructure code is checked against your rules before deployment, so a change that would expose data or skip encryption fails with a clear reason.
• Configuration drift detection: AWS Config rules record the configuration of every resource and flag changes that move away from the baseline.
• Encryption by default: Storage, databases and backups must use encryption with keys managed in AWS KMS under key policies your organization approves.
• Central logging: CloudTrail and service logs from every account flow to a separate logging account that workload teams cannot alter.
• Threat detection triage: GuardDuty and Security Hub findings are triaged by Moraph analysts and handled under runbooks agreed with you.
• Exception register: Every approved deviation from a guardrail is recorded with its reason, approver, compensating control and review date.
• Account vending: New accounts are created from a request with the baseline already applied, so teams get an account without a manual security review of each setting.
• Cost and usage reporting: Spend by account, workload and tag, with untagged resources and unusual changes in spend called out in the monthly review.
• Control evidence: Configuration history, guardrail versions, findings and the change record exported for a chosen period, for internal audit and examiners.

Integrations

• Your identity provider: Federation from your identity provider into AWS IAM Identity Center, so your password and multi-factor policies apply to every console and command-line session.
• Infrastructure-as-code pipeline: Your source control and pipeline, or one Moraph provides, with policy checks run on each change before deployment.
• Your SIEM: CloudTrail, AWS Config and finding data forwarded to the security information and event management tool your security team already uses.
• IT service management: Change requests, incidents and service requests raised in or synchronized with your ticketing system.
• AWS Support: Moraph opens and works support cases with AWS on your behalf under the support plan in your agreement.
• Moraph managed services: Findings and context shared with Moraph's Vulnerability Management, Privileged Access Management or Data Loss Prevention services where you use them.
• Cost reporting: AWS cost and usage data summarized by account, workload and tag for your finance team.

Deployment

• In your AWS organization: The environment is in AWS accounts owned by your institution, with Moraph operating them under the service agreement.
• Under a Moraph reseller agreement: AWS usage is bought through Moraph and billed with the service, subject to AWS's terms.
• Existing landing zone: Where you already have an AWS organization, Moraph takes over its operation and brings it under policy as code rather than rebuilding it.
• With other Moraph services: Run alongside Moraph managed services for vulnerability management, privileged access or data loss prevention.

Security and privacy

• Single sign-on: Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication; your staff through yours.
• Role-based access: Permission sets follow roles, so writing a change, approving it and applying it are separate.
• Time-bound administrative access: Moraph staff can reach your data or keys only with explicit, time-bound authorization from you for a stated task.
• Complete audit trail: Every console, command-line and pipeline action is logged with the person and time in a logging account that cannot be edited by workload or Moraph engineers.
• Tested changes: Guardrail and landing-zone code passes Moraph's security testing gates before release, and a software bill of materials is kept for Moraph's tooling.
• Region control: Workloads run only in the AWS regions you approve; Moraph operates environments from the United States, the United Kingdom or Australia to match.

Limitations

• Moraph is not AWS. AWS's own service commitments, support terms, roadmap and outages apply to the cloud itself, and Moraph cannot change them.
• AWS usage and support bought through Moraph remain subject to AWS's customer terms and pricing.
• Guardrails reduce the chance of misconfiguration; they do not remove it. Some risky configurations can only be detected after the fact rather than prevented.
• Moraph operates the landing zone and guardrails. Building, patching and supporting your applications is not included unless contracted separately.
• Decisions about data classification, risk acceptance, exceptions and incident notification remain with your organization.
• The service covers AWS. Other clouds and on-premises infrastructure are outside its scope.
• Moraph maps controls to frameworks your institution reports against and supports your own assessments; it does not certify your environment.
• Workloads that cannot be deployed as code need a documented exception and are checked by detective rules only.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/public-cloud-infrastructure. Purchasing routes and company information: www.moraph.com/how-to-buy.