Access and Security Review
- People. Confirm every IAM user, console login and repository account still belongs to someone who works here and still needs that level of access. Leavers are the most common gap.
- Long lived access keys. Review the age of any long lived access keys, particularly those held by third parties, and confirm they are being rotated.
- Network. Review security group rules, especially anything that has been added by hand to reach a database instance or the Windows workstation.
- Certificates. Check expiry dates on the certificates in ACM, and confirm which are managed in code and which were created by hand.
The MongoDB server certificate is self-signed and clients connect with validation relaxed, so an expiry does not produce an error and will never surface on its own. Transport is encrypted but not authenticated. See Security, Risks and Technical Debt.
Documentation Refresh
- Re-read the infrastructure pages against reality and correct anything that has drifted.
- Confirm the architecture diagrams still match what is deployed, and re-export the draw.io sources if not.
- Check that the checks on these pages still reflect what you actually do, and adjust them if they have stopped being honest.
Vendor and Dependency Review
- Third party integrations. Review the Vivenu, HubSpot and timing provider integrations for deprecation notices, API version changes and announced breaking changes.
- AWS service notices. Check the Personal Health Dashboard and AWS announcements for deprecations affecting anything in the estate, including end of support dates for runtimes in use.
- Repository hosting. Track progress on moving off CodeCommit, which is closed to new customers and cannot be recreated if lost.
- Framework end of life. Check the support dates for the .NET and Angular versions in use, so upgrades are planned rather than forced.