Healthtech · read-only · local-first

AWS configuration evidence for healthtech teams.

Kulshan is a read-only CLI you run with your own AWS credentials. It surfaces configuration signals that healthtech teams typically need when preparing for a security review.

It does not certify, validate, or attest to anything. It points at things you can verify yourself.

What it helps surface.

Each line below maps to a category of AWS configuration the security pack inspects. Kulshan reads the configuration; you read the report; your reviewer decides what matters.

At rest

Encryption settings on S3 buckets, RDS instances, EBS volumes, DynamoDB tables, Lambda environment variables, and EFS file systems. Flags resources where encryption is off or weakly configured.

In transit

ELB/ALB/NLB plaintext listeners, CloudFront distributions allowing HTTP, API Gateway stages without HTTPS-only, RDS instances accepting non-SSL connections.

MFA

IAM users without MFA, root account MFA status, IAM policies that do not require MFA for sensitive actions.

Audit log

CloudTrail enabled across all regions, trail log encryption, log-file integrity validation, S3 bucket access logging gaps.

IAM hygiene

Inactive users, unused access keys, broad privilege grants, role trust relationships open to other accounts or to the public.

Public exposure

S3 buckets allowing public read/write, RDS instances reachable from the public internet, security groups open to 0.0.0.0/0 on sensitive ports.

The published IAM policy includes read-only coverage for cost and several configuration areas. Treat non-cost diagnostics as evidence-gathering signals, not a complete security review. The full policy is at /policy.

What this is not.

Kulshan is not a compliance certification, legal opinion, or substitute for a security/compliance officer. It checks AWS configuration signals from a read-only account scan.

Specifically, Kulshan does not:

  • Validate your HIPAA program, certify your environment, or produce an attestation.
  • Constitute legal advice or a legal opinion on any framework.
  • Replace your security officer, compliance officer, or external auditor.
  • Assess controls outside AWS (workforce training, BAAs, written policies, physical safeguards).
  • Handle PHI. Do not send PHI. Kulshan does not need PHI to inspect AWS configuration.

How teams use it.

Four steps. The CLI can run locally and produce configuration evidence without a mandatory upload.

1. Attach policy

The full IAM policy with SHA256 and per-pack files is at /policy. All 160 actions are read-style; zero actions create, modify, or delete AWS resources.

2. Run locally

Kulshan talks to AWS APIs from your machine and produces local configuration evidence. There is no mandatory upload.

3. Hand to reviewer

A security or compliance officer reads the configuration findings and decides what matters in the context of your program.

4. Remediate

Each finding includes the AWS resource and a remediation hint. You decide what to fix and when.

If you want a founder-led pass.

If your team is preparing for a security review and would benefit from a founder-led pass over the AWS configuration evidence, send a two-sentence description of the workload shape and the timeline you are working against. This is evidence gathering, not a compliance audit or security certification.

[email protected] with subject "Healthtech review"