Thirty minutes. I look at your setup and tell you what breaks first. You leave with an answer whether or not we ever work together.
You describe what you run and how changes reach production. Ten minutes.
I ask three specific questions. They are the ones that separate a team that is fine from a team that is one deploy away from a bad week.
I tell you what I think breaks first, and whether an audit is worth your money. Sometimes it is not.
Run this against one bucket in your production account. It takes a minute and the answer is usually surprising.
aws s3api get-public-access-block --bucket your-bucket
Four settings, not one. Three of four true is a bucket that is public through the fourth.