Choose one to start — you can buy more later.
Find and fix public buckets, weak ACLs, and missing encryption in a realistic account.
Implement envelope encryption and map controls to GDPR / DPDP outcomes.
