Cloud Security: AWS Foundations

General

• EC2 instance must have detailed monitoring enabled Medium
• EC2 instance must enforce IMDSv2 (metadata tokens required) High
• EC2 instance should be EBS-optimized Low
• EC2 instance must have an IAM instance profile attached High
• Security group must not allow unrestricted ingress (0.0.0.0/0) Critical
• EBS volume must be encrypted High
• EBS volume should use a customer-managed KMS key Medium
• VPC must have flow logs enabled High
• VPC must have DNS support enabled Medium
• Subnet should not auto-assign public IPs High
• Network interface should not have a public IP unless required Medium
• NAT gateway must be in available state Medium
• Internet gateway must be attached to a VPC Medium
• Lambda function must not use a deprecated runtime High
• Lambda function should have a reasonable timeout configured Low
• Lambda function should be deployed in a VPC Medium
• Lambda function should have a dead-letter queue configured Medium
• Lambda function must have X-Ray tracing enabled Medium
• ECS cluster must have Container Insights enabled Medium
• ECS service must not assign public IPs to tasks High
• EKS cluster must disable public API endpoint access High
• EKS cluster must enable private API endpoint access High
• EKS cluster must have control plane logging enabled Medium
• EKS cluster must have envelope encryption for secrets High
• Auto Scaling group should use ELB health checks Medium
• Launch template must enforce IMDSv2 High
• Launch template should have detailed monitoring enabled Low
• Lightsail instance should be reviewed for migration to EC2 Low
• S3 bucket must have server-side encryption enabled High
• S3 bucket must have versioning enabled High
• S3 bucket must block public ACLs Critical
• S3 bucket must block public bucket policies Critical
• S3 bucket must restrict public bucket access Critical
• S3 bucket must have access logging enabled Medium
• S3 bucket should use SSE-KMS encryption algorithm Medium
• EFS file system must be encrypted at rest High
• Backup vault must use a KMS encryption key High
• ECR repository must have image scan on push enabled High
• ECR repository must have immutable image tags Medium
• ECR repository should use KMS encryption Medium
• Glacier vault must exist and be configured Low
• FSx file system must be encrypted High
• Storage Gateway must be operational Low
• RDS instance must have storage encryption enabled High
• RDS instance must not be publicly accessible Critical
• RDS instance must have Multi-AZ enabled High
• RDS instance must have IAM database authentication enabled Medium
• RDS instance must have deletion protection enabled High
• RDS instance must have auto minor version upgrade enabled Medium
• RDS cluster must have storage encryption enabled High
• RDS cluster must have deletion protection enabled High
• RDS cluster must have IAM database authentication enabled Medium
• RDS cluster must have sufficient backup retention period High
• DynamoDB table must have server-side encryption enabled High
• DynamoDB table must have point-in-time recovery enabled High
• ElastiCache cluster must have in-transit encryption enabled High
• ElastiCache cluster must have at-rest encryption enabled High
• ElastiCache replication group must have in-transit encryption enabled High
• ElastiCache replication group must have at-rest encryption enabled High
• ElastiCache replication group must have automatic failover enabled High
• Redshift cluster must be encrypted High
• Redshift cluster must not be publicly accessible Critical
• Redshift cluster must have audit logging enabled Medium
• Redshift cluster should use enhanced VPC routing Medium
• Neptune cluster must have storage encryption enabled High
• Neptune cluster must have IAM database authentication enabled Medium
• Neptune cluster must have deletion protection enabled High
• DocumentDB cluster must have storage encryption enabled High
• DocumentDB cluster must have deletion protection enabled High
• Elasticsearch domain must have encryption at rest enabled High
• Elasticsearch domain must have node-to-node encryption enabled High
• Elasticsearch domain must enforce HTTPS High
• MemoryDB cluster must have TLS enabled High
• Keyspaces table should use customer-managed KMS encryption Medium
• Timestream database must use a KMS key for encryption High
• Load balancer must have access logging enabled Medium
• Load balancer must have deletion protection enabled Medium
• Load balancer listener must use HTTPS protocol High
• Load balancer listener must use a secure SSL policy High
• CloudFront distribution must enforce HTTPS viewer protocol High
• CloudFront distribution must use TLS 1.2 minimum High
• CloudFront distribution must have access logging enabled Medium
• CloudFront distribution should have a WAF web ACL associated High
• Route53 hosted zone should have DNSSEC signing enabled Medium
• API Gateway REST API must have an endpoint configuration Medium
• API Gateway V2 API must be properly configured Low
• VPN gateway must be attached and operational Medium
• Global Accelerator must be enabled Medium
• Direct Connect connection should use MACsec encryption High
• Transit gateway must not auto-accept shared attachments High
• IAM user must have MFA enabled Critical
• IAM user should not have more than one active access key Medium
• IAM role must have a trust policy configured Medium
• IAM policy must be attached and in use Low
• IAM group should be used for permission management Low
• KMS key must have automatic key rotation enabled High
• KMS key must be in enabled state High
• Secrets Manager secret must have rotation enabled High
• Secrets Manager secret should use a customer-managed KMS key Medium
• ACM certificate must be in issued status High
• ACM certificate must be eligible for renewal Medium
• WAFv2 web ACL must be deployed High
• Shield protection must be active on critical resources High
• GuardDuty detector must be enabled Critical
• Security Hub must have auto-enable controls active High
• Inspector coverage must be active Medium
• Macie session must be enabled Medium
• SSM Parameter for sensitive data must use SecureString type High
• AWS Config configuration recorder must be recording Critical
• AWS Config must record all supported resource types High
• CloudTrail trail must be multi-region Critical
• CloudTrail trail must be actively logging Critical
• CloudTrail trail must have log file validation enabled High
• CloudTrail trail should be encrypted with a KMS key High
• CloudWatch log group must have a retention period configured Medium
• CloudWatch log group should be encrypted with a KMS key Medium
• CloudWatch alarm must have actions enabled Medium
• SNS topic must be encrypted with a KMS key High
• SQS queue must be encrypted with a KMS key High
• SQS queue should have a dead-letter queue configured Medium
• EventBridge rule must be in enabled state Medium
• Kinesis stream must use KMS encryption High
• Firehose delivery stream must have encryption enabled High
• Cognito user pool must enforce MFA Critical
• Cognito user pool must have deletion protection enabled High
• AppSync API must have X-Ray tracing enabled Medium
• AppSync API must have logging configured Medium
• Step Functions state machine must have logging enabled Medium
• Step Functions state machine must have tracing enabled Medium
• CodeBuild project must use a KMS encryption key High
• CodeBuild project should not run in privileged mode High
• CodePipeline must use an encrypted artifact store High
• Amplify app should have basic auth disabled for production Medium
• App Runner service must have encryption enabled High
• Elastic Beanstalk environment must be in healthy state Medium
• Batch compute environment must be in enabled state Medium
• MWAA environment must use private web server access High
• MWAA environment should use a customer-managed KMS key Medium
• Glue database must be cataloged and accessible Low
• Athena workgroup must enforce workgroup configuration Medium
• Athena workgroup must have query result encryption enabled High
• EMR cluster must have termination protection enabled High
• EMR cluster must have a security configuration High
• SageMaker notebook instance must not have direct internet access High
• SageMaker notebook instance must be encrypted with a KMS key High
• SageMaker notebook instance should disable root access Medium
• SageMaker endpoint must be encrypted with a KMS key High
• MSK cluster must enforce TLS encryption for client-broker communication High
• MSK cluster must have encryption at rest with a KMS key High
• Lake Formation resource must be registered Low
• QuickSight dashboard must be properly configured Low
• CloudFormation stack must have termination protection enabled High
• Service Catalog portfolio must be configured Low
• Organizations account must be in active status High
• RAM resource share must not allow external principals High
• SSO permission set must be configured Medium
• Transfer Family server should use VPC endpoint High
• Transfer Family server should use a managed identity provider Medium
• IoT thing must be registered and configured Low
• WorkSpaces workspace must have user volume encryption enabled High
• WorkSpaces workspace must have root volume encryption enabled High
• Prefer IAM roles over access keys for programmatic access Medium
• CloudWatch log group retention should be at least 90 days Medium
• RDS cluster backup retention should be at least 14 days Medium
• S3 bucket encryption should use SSE-KMS with a customer-managed key Medium
• Lambda function should have a short timeout for API-driven functions Low
• EC2 instance must not use a deprecated instance metadata version High
• EKS cluster should enable all audit log types Medium
• Redshift cluster must not use default database name Low
• CloudFront distribution should use origin access identity or control High