AWS Security Checks

579+ AWS Security Checks

Complete list of AWS security checks across 82+ services based on CIS AWS Foundations Benchmark v1.5.0, NIST 800-53, PCI-DSS, HIPAA, SOC 2, and 38+ compliance frameworks.

Start AWS Scan AWS CSPM Overview

579+

Security Checks

34+

AWS Services

38+

Compliance Frameworks

v1.5.0

CIS Benchmark

Security Checks by AWS Service

Comprehensive security checks organized by AWS service. Click any check for detailed remediation guidance.

Identity and Access Management (IAM)

30 checks

Avoid the use of root account

Ensure MFA is enabled for the root account

CIS 1.2critical

Ensure hardware MFA is enabled for the root account

Ensure no root account access keys exist

CIS 1.4critical

Ensure IAM password policy requires at least one uppercase letter

Ensure IAM password policy requires at least one lowercase letter

Ensure IAM password policy requires at least one symbol

Ensure IAM password policy requires at least one number

Ensure IAM password policy requires minimum length of 14 or greater

Ensure IAM password policy prevents password reuse

Ensure IAM password policy expires passwords within 90 days or less

Ensure MFA is enabled for all IAM users with console access

Ensure access keys are rotated every 90 days or less

Ensure access keys unused for 45 days or more are disabled

Ensure IAM users receive permissions only through groups

Ensure no IAM policies allow full administrative privileges

Ensure a support role has been created for AWS Support access

Ensure IAM instance roles are used for AWS resource access from instances

Ensure IAM Access Analyzer is enabled for all regions

Ensure credentials unused for 45 days or more are disabled

Ensure cross-account role trust policies are restricted

Ensure IAM role does not allow assume from any AWS account

Ensure IAM policies do not use NotAction with Allow effect

Ensure IAM policies do not use NotResource with Allow effect

Ensure expired SSL/TLS certificates are removed from IAM

Ensure IAM users have at most one active access key

Ensure empty IAM groups are removed

Ensure all IAM users belong to at least one group

Ensure SAML provider trust policy has conditions

Ensure server certificates are not expiring within 30 days

Simple Storage Service (S3)

20 checks

Ensure S3 bucket has block public access enabled

CIS 2.1.1critical

Ensure S3 bucket policy does not allow public read access

CIS 2.1.2critical

Ensure S3 bucket policy does not allow public write access

CIS 2.1.3critical

Ensure MFA Delete is enabled on S3 buckets

CIS 2.1.4medium

Ensure S3 bucket has server-side encryption enabled

Ensure S3 bucket versioning is enabled

CIS 2.1.6medium

Ensure S3 bucket has server access logging enabled

CIS 2.1.7medium

Ensure S3 bucket ACL does not grant public read access

Ensure S3 bucket ACL does not grant public write access

Ensure S3 bucket enforces SSL/TLS for all requests

Ensure S3 bucket uses KMS for encryption

Ensure S3 bucket has lifecycle configuration

Ensure S3 bucket has cross-region replication enabled

Ensure S3 bucket has object lock enabled for compliance

Ensure S3 access points do not allow public access

Ensure S3 bucket CORS policy is restrictive

Ensure S3 bucket event notifications are configured

Ensure S3 bucket replication uses encryption

Ensure S3 bucket inventory is enabled

Ensure S3 bucket does not have overly permissive bucket policy

Elastic Compute Cloud (EC2)

30 checks

Ensure EBS volumes are encrypted

Ensure default EBS encryption is enabled

CIS 2.2.2medium

Ensure EBS snapshots are encrypted

Ensure EBS snapshots are not publicly accessible

Ensure EC2 instances do not have public IP addresses

Ensure EC2 instances use IMDSv2

Ensure detailed monitoring is enabled for EC2 instances

Ensure EC2 instances do not use default security groups

Ensure security groups do not allow ingress from 0.0.0.0/0 to port 22

Ensure security groups do not allow ingress from 0.0.0.0/0 to port 3389

Ensure security groups do not allow unrestricted ingress to high-risk ports

Ensure unused security groups are removed

Ensure EC2 instances are managed by AWS Systems Manager

Ensure EC2 instances have termination protection enabled

Ensure AMIs are not publicly shared

Ensure EC2 instances are launched from approved AMIs

Ensure EC2 instances do not use tenancy in dedicated hosts without requirement

Ensure EC2 Auto Scaling groups use launch templates

Ensure EC2 instance IAM roles are used instead of access keys

Ensure EC2 instances have EBS optimization enabled

Ensure security groups restrict outbound traffic

Ensure EC2 instances use encrypted EBS root volumes

Ensure EC2 Nitro instances use encrypted memory

Ensure EC2 instances have required tags

Ensure EC2 stopped instances are reviewed and terminated

Ensure EC2 placement groups are used for high availability

Ensure EC2 serial console access is disabled

Ensure EC2 instances use secure key pairs

Ensure EC2 instances do not have multiple ENIs unless required

Ensure EC2 instances use current generation instance types

Virtual Private Cloud (VPC)

20 checks

Ensure VPC flow logs are enabled

Ensure VPC flow logs retention is at least 90 days

Ensure default VPC is not used

Ensure VPC subnets do not auto-assign public IPs

Ensure VPC has separate public and private subnets

Ensure NACLs restrict inbound traffic

Ensure NACLs do not allow unrestricted SSH access

Ensure NACLs do not allow unrestricted RDP access

Ensure VPC peering connections are documented and reviewed

Ensure VPC endpoint policies are restrictive

Ensure VPC endpoints are used for AWS services

Ensure NAT gateways are highly available

Ensure Internet Gateways are attached only to required VPCs

Ensure Transit Gateway is used for multi-VPC connectivity

Ensure Transit Gateway route tables restrict traffic

Ensure VPN connections use strong encryption

Ensure VPN tunnels are in UP state

Ensure Direct Connect is encrypted

Ensure Elastic IP addresses are associated with resources

Ensure route tables do not have overly permissive routes

AWS CloudTrail

25 checks

Ensure CloudTrail is enabled in all regions

Ensure CloudTrail log file validation is enabled

Ensure CloudTrail logs are encrypted with KMS

Ensure CloudTrail S3 bucket is not publicly accessible

CIS 3.3critical

Ensure CloudTrail logs are delivered to CloudWatch Logs

Ensure S3 bucket access logging is enabled for CloudTrail bucket

Ensure CloudTrail is integrated with CloudWatch Logs

Ensure management events are logged

Ensure data events are logged for S3 buckets

Ensure data events are logged for Lambda functions

Ensure CloudTrail trails are not stopped

Ensure CloudTrail log retention is configured

Ensure CloudTrail trails exist in all accounts

Ensure organization trail is enabled

Ensure CloudTrail insights is enabled

Ensure metric filters exist for unauthorized API calls

Ensure metric filters exist for console login without MFA

Ensure metric filters exist for root account usage

Ensure metric filters exist for IAM policy changes

Ensure metric filters exist for CloudTrail configuration changes

Ensure metric filters exist for security group changes

Ensure metric filters exist for NACL changes

Ensure metric filters exist for VPC changes

Ensure metric filters exist for S3 bucket policy changes

Ensure metric filters exist for KMS key changes

Relational Database Service (RDS)

25 checks

Ensure RDS instances are not publicly accessible

CIS 2.3.1critical

Ensure RDS instances have encryption at rest enabled

Ensure RDS instances use KMS customer managed keys

Ensure RDS instances have automated backups enabled

Ensure RDS backup retention is at least 7 days

Ensure RDS instances have Multi-AZ enabled

Ensure RDS instances have deletion protection enabled

Ensure RDS instances have minor version auto-upgrade enabled

Ensure RDS instances use current engine versions

Ensure RDS instances do not use default ports

Ensure RDS instances have enhanced monitoring enabled

Ensure RDS instances have Performance Insights enabled

Ensure RDS instances have logging enabled

Ensure RDS snapshots are not publicly accessible

Ensure RDS snapshots are encrypted

Ensure RDS instances use SSL/TLS for connections

Ensure RDS security groups are restrictive

Ensure RDS instances are deployed in private subnets

Ensure RDS Aurora clusters have backtrack enabled

Ensure RDS Aurora clusters have IAM authentication enabled

Ensure RDS instances have copy tags to snapshots enabled

Ensure RDS database master credentials are stored in Secrets Manager

Ensure RDS Event Subscriptions are configured

Ensure RDS instances use the latest certificate authority

Ensure RDS Proxy is used for connection pooling

AWS Lambda

20 checks

Ensure Lambda functions are not publicly accessible

Ensure Lambda functions use latest runtime versions

Ensure Lambda functions have tracing enabled

Ensure Lambda functions have dead letter queues configured

Ensure Lambda functions use least privilege IAM roles

Ensure Lambda functions do not have secrets in environment variables

Ensure Lambda functions encrypt environment variables with KMS

Ensure Lambda functions run in VPC when accessing private resources

Ensure Lambda functions in VPC use security groups

Ensure Lambda function URLs use authentication

Ensure Lambda functions have concurrency limits

Ensure Lambda functions have appropriate timeout settings

Ensure Lambda functions do not share execution roles

Ensure Lambda layers are from trusted sources

Ensure Lambda functions have code signing enabled

Ensure Lambda functions log to CloudWatch

Ensure Lambda CloudWatch log groups have retention configured

Ensure Lambda functions do not use wildcards in resource policies

Ensure Lambda functions are tagged appropriately

Ensure Lambda event source mappings use filtering

Key Management Service (KMS)

15 checks

Ensure KMS key rotation is enabled

Ensure KMS keys are not scheduled for deletion

Ensure KMS key policies are not overly permissive

Ensure KMS keys are used for EBS encryption

Ensure KMS keys are used for RDS encryption

Ensure KMS keys are used for S3 bucket encryption

Ensure KMS key usage is monitored

Ensure KMS keys have descriptive aliases

Ensure KMS keys are tagged appropriately

Ensure KMS grants are reviewed regularly

Ensure asymmetric KMS keys are used for digital signatures

Ensure KMS keys support required key spec for data type

Ensure KMS multi-region keys are properly configured

Ensure KMS keys are not exposed in CloudTrail logs

Ensure external key stores are monitored for availability

Elastic Load Balancing (ELB)

20 checks

Ensure ELB access logging is enabled

Ensure ALB has WAF enabled

Ensure ELB uses secure TLS protocols

Ensure ALB redirects HTTP to HTTPS

Ensure ELB has deletion protection enabled

Ensure ALB drops invalid headers

Ensure ELB cross-zone load balancing is enabled

Ensure ELB uses approved SSL certificates

Ensure NLB TLS listeners use certificates

Ensure ELB security groups restrict access

Ensure Classic Load Balancers are not used

Ensure ELB target groups have health checks configured

Ensure ALB desync mitigation mode is enabled

Ensure internal load balancers are used for internal services

Ensure ELB uses strong cipher suites

Ensure ALB sticky sessions use secure cookies

Ensure ELB connection draining is enabled

Ensure ALB listener rules are properly ordered

Ensure GWLB endpoints are properly configured

Ensure ELB has appropriate idle timeout

Elastic Container Service (ECS)

20 checks

Ensure ECS task definitions do not run as root

Ensure ECS task definitions use read-only root filesystem

Ensure ECS task definitions do not grant privileged access

Ensure ECS task definitions do not share host namespaces

Ensure ECS task definitions have logging configured

Ensure ECS tasks use task execution roles

Ensure ECS task roles follow least privilege

Ensure ECS services use awsvpc network mode

Ensure ECS tasks have resource limits defined

Ensure ECS Fargate platform version is current

Ensure ECS cluster has Container Insights enabled

Ensure ECS services have deployment circuit breaker enabled

Ensure ECS tasks do not have secrets in environment variables

Ensure ECS container images are from trusted registries

Ensure ECS service tasks run in private subnets

Ensure ECS task definitions drop unnecessary capabilities

Ensure ECS Execute Command logging is enabled

Ensure ECS services have auto-scaling configured

Ensure ECS task definitions specify health checks

Ensure EC2 launch type uses managed instance scaling

Elastic Kubernetes Service (EKS)

20 checks

Ensure EKS cluster endpoint is not publicly accessible

Ensure EKS cluster has secrets encryption enabled

Ensure EKS cluster logging is enabled

Ensure EKS node groups use managed node groups

Ensure EKS clusters use the latest Kubernetes version

Ensure EKS node groups use current AMI versions

Ensure EKS cluster uses IRSA for pod permissions

Ensure EKS cluster has network policy enforcement

Ensure EKS cluster uses Pod Security Standards

Ensure EKS node groups have SSH access disabled

Ensure EKS clusters use private ECR for container images

Ensure EKS cluster RBAC is properly configured

Ensure EKS cluster aws-auth ConfigMap is properly managed

Ensure EKS add-ons are up to date

Ensure EKS Fargate profiles are used for sensitive workloads

Ensure EKS cluster security groups are restrictive

Ensure EKS cluster has audit logging enabled

Ensure EKS nodes are launched in private subnets

Ensure EKS cluster uses GuardDuty for threat detection

Ensure EKS cluster uses VPC endpoints for AWS services

Amazon CloudWatch

15 checks

Ensure CloudWatch log groups have retention configured

Ensure CloudWatch log groups are encrypted with KMS

Ensure CloudWatch Alarms exist for root account usage

Ensure CloudWatch Alarms exist for unauthorized API calls

Ensure CloudWatch Alarms have SNS notifications configured

Ensure CloudWatch cross-account sharing is properly configured

Ensure CloudWatch log metric filters exist for security events

Ensure CloudWatch Logs Insights queries are saved for common investigations

Ensure CloudWatch Container Insights is enabled for EKS/ECS

Ensure CloudWatch alarms cover EC2 instance health

Ensure CloudWatch Synthetics canaries monitor critical endpoints

Ensure CloudWatch Events/EventBridge rules monitor security events

Ensure CloudWatch Anomaly Detection is configured for critical metrics

Ensure CloudWatch log groups do not allow public access

Ensure CloudWatch Contributor Insights rules are configured

AWS Secrets Manager

15 checks

Ensure Secrets Manager secrets have automatic rotation enabled

Ensure Secrets Manager secrets are encrypted with KMS CMK

Ensure Secrets Manager secrets have resource policies

Ensure Secrets Manager secrets are not publicly accessible

Ensure Secrets Manager rotation is tested

Ensure Secrets Manager secrets have appropriate rotation schedules

Ensure Secrets Manager secrets are tagged appropriately

Ensure Secrets Manager secrets are used instead of hardcoded credentials

Ensure Secrets Manager cross-region replication is configured for DR

Ensure Secrets Manager secret versions are managed

Ensure Secrets Manager access is logged

Ensure Secrets Manager secrets are not unused

Ensure Secrets Manager Lambda rotation functions are secure

Ensure Secrets Manager secrets have descriptions

Ensure Secrets Manager integrations use caching

Amazon API Gateway

20 checks

Ensure API Gateway has authentication enabled

Ensure API Gateway has logging enabled

Ensure API Gateway uses TLS 1.2 or higher

Ensure API Gateway has WAF enabled

Ensure API Gateway has throttling enabled

Ensure API Gateway uses private endpoints for internal APIs

Ensure API Gateway resource policies are restrictive

Ensure API Gateway validates request parameters

Ensure API Gateway has X-Ray tracing enabled

Ensure API Gateway caching is configured securely

Ensure API Gateway uses custom domains with certificates

Ensure API Gateway integrations use HTTPS

Ensure API Gateway has mutual TLS enabled for sensitive APIs

Ensure API Gateway stages have appropriate deployment settings

Ensure API Gateway Lambda integrations use proxy or proper mapping

Ensure HTTP APIs use JWT authorizers

Ensure WebSocket APIs have route authorization

Ensure API Gateway usage plans limit API access

Ensure API Gateway CORS is properly configured

Ensure API Gateway has content type validation

Amazon GuardDuty

15 checks

Ensure GuardDuty is enabled in all regions

Ensure GuardDuty has S3 Protection enabled

Ensure GuardDuty has EKS Protection enabled

Ensure GuardDuty has Malware Protection enabled

Ensure GuardDuty has RDS Protection enabled

Ensure GuardDuty has Lambda Protection enabled

Ensure GuardDuty findings are exported

Ensure GuardDuty findings trigger automated responses

Ensure GuardDuty uses trusted IP lists

Ensure GuardDuty threat lists are configured

Ensure GuardDuty is integrated with Security Hub

Ensure GuardDuty uses delegated administrator for organizations

Ensure GuardDuty suppression rules are documented

Ensure GuardDuty high severity findings are addressed within SLA

Ensure GuardDuty findings are archived appropriately

AWS WAF

20 checks

Ensure WAF web ACLs are associated with resources

Ensure WAF has AWS managed rules enabled

Ensure WAF has SQL injection protection enabled

Ensure WAF has XSS protection enabled

Ensure WAF has rate limiting rules

Ensure WAF logging is enabled

Ensure WAF has bot control enabled

Ensure WAF has IP reputation rules enabled

Ensure WAF rules use proper action types

Ensure WAF has geo-blocking configured where required

Ensure WAF has anonymous IP protection

Ensure WAF web ACLs have default deny action

Ensure WAF rules are ordered correctly

Ensure WAF has file upload protection

Ensure WAF CAPTCHA is configured for high-risk actions

Ensure classic WAF is migrated to WAFv2

Ensure WAF metrics and alarms are configured

Ensure WAF is integrated with Security Hub

Ensure Firewall Manager is used for multi-account WAF

Ensure WAF rules are regularly reviewed and updated

AWS Config

15 checks

Ensure AWS Config is enabled in all regions

Ensure AWS Config is recording all resource types

Ensure AWS Config uses S3 bucket with versioning

Ensure AWS Config S3 bucket is encrypted

Ensure AWS Config rules are configured for critical controls

Ensure AWS Config uses conformance packs

Ensure AWS Config aggregator is configured for multi-account

Ensure AWS Config rules have remediation configured

Ensure AWS Config sends notifications for compliance changes

Ensure AWS Config recorder is running

Ensure AWS Config delivery channel is configured

Ensure AWS Config includes global resources

Ensure AWS Config S3 bucket access logging is enabled

Ensure AWS Config retention is configured

Ensure AWS Config rules evaluate in near real-time

Simple Notification Service (SNS)

10 checks

Ensure SNS topics are encrypted with KMS

Ensure SNS topics do not allow public access

Ensure SNS subscriptions require confirmation

Ensure SNS topics use delivery status logging

Ensure SNS HTTPS subscriptions use TLS

Ensure SNS topics have appropriate access policies

Ensure SNS dead-letter queues are configured

Ensure SNS topics are tagged appropriately

Ensure cross-account SNS access is documented

Ensure SNS message filtering is used appropriately

Simple Queue Service (SQS)

10 checks

Ensure SQS queues are encrypted with KMS

Ensure SQS queues do not allow public access

Ensure SQS queues have dead-letter queues configured

Ensure SQS queues enforce HTTPS

Ensure SQS queue policies follow least privilege

Ensure SQS queue visibility timeout is appropriate

Ensure SQS queues are tagged appropriately

Ensure SQS FIFO queues are used when ordering matters

Ensure SQS message retention is configured appropriately

Ensure SQS long polling is enabled

Amazon DynamoDB

12 checks

Ensure DynamoDB tables are encrypted with KMS CMK

Ensure DynamoDB tables have point-in-time recovery enabled

Ensure DynamoDB tables have deletion protection enabled

Ensure DynamoDB auto-scaling is configured

Ensure DynamoDB streams are encrypted

Ensure DynamoDB global tables use proper replication

Ensure DynamoDB VPC endpoints are used

Ensure DynamoDB tables are tagged appropriately

Ensure DynamoDB Contributor Insights is enabled

Ensure DynamoDB tables use appropriate capacity mode

Ensure DynamoDB IAM policies follow least privilege

Ensure DynamoDB tables have CloudWatch alarms

Elastic Container Registry (ECR)

12 checks

Ensure ECR repositories have image scanning enabled

Ensure ECR repositories have image immutability enabled

Ensure ECR repositories are encrypted with KMS CMK

Ensure ECR repositories have lifecycle policies

Ensure ECR repository policies are restrictive

Ensure ECR repositories do not allow public access

Ensure ECR enhanced scanning is enabled for critical repositories

Ensure ECR repositories are tagged appropriately

Ensure ECR pull-through cache is configured for external images

Ensure ECR replication is configured for disaster recovery

Ensure ECR scan findings are reviewed

Ensure ECR images are signed for integrity

AWS Certificate Manager (ACM)

10 checks

Ensure ACM certificates are not expiring soon

Ensure ACM certificates use RSA-2048 or higher

Ensure ACM certificates have Certificate Transparency logging enabled

Ensure ACM certificates are in use

Ensure ACM certificate validation is completed

Ensure ACM certificates cover all required domains

Ensure ACM certificates are tagged appropriately

Ensure imported certificates are renewed before expiration

Ensure ACM private CA certificates have appropriate validity

Ensure ACM private CA has appropriate permissions

Amazon Route 53

15 checks

Ensure Route 53 hosted zones have query logging enabled

Ensure DNSSEC is enabled for Route 53 domains

Ensure Route 53 domains have auto-renewal enabled

Ensure Route 53 domains have transfer lock enabled

Ensure Route 53 domains have privacy protection enabled

Ensure Route 53 health checks have SNS notifications configured

Ensure Route 53 Resolver query logs are enabled

Ensure Route 53 hosted zones are not publicly queryable

Ensure Route 53 failover records are configured for critical endpoints

Ensure Route 53 traffic policies use health checks

Ensure Route 53 alias records are used instead of CNAME where possible

Ensure Route 53 geolocation routing has default location configured

Ensure Route 53 health checks use HTTPS instead of HTTP

Ensure Route 53 Resolver rules are monitored for modifications

Ensure Route 53 delegation sets are not shared unnecessarily

Amazon CloudFront

20 checks

Ensure CloudFront distributions use secure SSL/TLS protocols

Ensure CloudFront distributions enforce HTTPS-only viewer connections

Ensure CloudFront distributions use origin access identity (OAI) for S3 origins

Ensure CloudFront distributions have access logging enabled

Ensure CloudFront distributions have WAF integrated

Ensure CloudFront distributions use field-level encryption for sensitive data

Ensure CloudFront distributions enforce origin SSL/TLS for custom origins

Ensure CloudFront distributions use custom SSL/TLS certificates

Ensure CloudFront distributions have geo-restriction configured if required

Ensure CloudFront distributions have default root object configured

Ensure CloudFront distributions use signed URLs or signed cookies for private content

Ensure CloudFront distributions have origin failover configured for critical applications

Ensure CloudFront distributions compress content for optimization

Ensure CloudFront distributions have appropriate TTL values configured

Ensure CloudFront distributions use HTTP/2 or HTTP/3

Ensure CloudFront distributions forward only required headers to origin

Ensure CloudFront distributions have real-time logs enabled for security monitoring

Ensure CloudFront distributions use Lambda@Edge for additional security controls

Ensure CloudFront distributions have custom error pages configured

Ensure CloudFront distribution origins use origin shields for better caching

Amazon Redshift

20 checks

Ensure Redshift clusters are not publicly accessible

CIS 5.1critical

Ensure Redshift clusters have encryption at rest enabled

Ensure Redshift clusters have encryption in transit enabled

Ensure Redshift clusters have audit logging enabled

Ensure Redshift clusters have automated snapshots configured

Ensure Redshift cluster snapshots are encrypted

Ensure Redshift clusters are not using default master username

Ensure Redshift clusters have version upgrade enabled

Ensure Redshift cluster parameter groups enable user activity logging

Ensure Redshift clusters are deployed in VPC

Ensure Redshift clusters have enhanced VPC routing enabled

Ensure Redshift clusters use strong master passwords

Ensure Redshift cluster security groups restrict access to known IPs

Ensure Redshift cluster manual snapshots are not publicly accessible

Ensure Redshift clusters have maintenance windows configured appropriately

Ensure Redshift clusters have cross-region snapshots for disaster recovery

Ensure Redshift clusters use reserved nodes for cost optimization

Ensure Redshift clusters have monitoring enabled with CloudWatch

Ensure Redshift clusters use AWS Secrets Manager for credential rotation

Ensure Redshift Spectrum queries use encryption

Amazon ElastiCache

20 checks

Ensure ElastiCache Redis clusters have encryption at rest enabled

Ensure ElastiCache Redis clusters have encryption in transit enabled

Ensure ElastiCache Redis clusters have AUTH enabled

Ensure ElastiCache clusters are not publicly accessible

Ensure ElastiCache Redis has automatic backups enabled

Ensure ElastiCache Redis uses Multi-AZ with automatic failover

Ensure ElastiCache security groups restrict access appropriately

Ensure ElastiCache Memcached clusters are not using default port

Ensure ElastiCache Redis uses supported engine versions

Ensure ElastiCache clusters have maintenance windows configured

Ensure ElastiCache Redis clusters have CloudWatch monitoring enabled

Ensure ElastiCache Redis parameter groups disable dangerous commands

Ensure ElastiCache Redis snapshots are encrypted

Ensure ElastiCache Memcached uses appropriate node types for workload

Ensure ElastiCache Redis clusters use cluster mode for scalability

Ensure ElastiCache subnet groups span multiple availability zones

Ensure ElastiCache Redis uses reserved nodes for cost optimization

Ensure ElastiCache Redis AUTH passwords are rotated regularly

Ensure ElastiCache Redis has slow log enabled for performance monitoring

Ensure ElastiCache clusters have notification SNS topics configured

AWS Backup

15 checks

Ensure AWS Backup has backup plans configured for critical resources

Ensure backup vaults have encryption enabled

Ensure backup vaults have access policies configured

Ensure backup plans have sufficient retention periods

Ensure backup plans include cross-region copy for disaster recovery

Ensure backup plans have appropriate backup frequency

Ensure backup recovery points are protected from deletion

Ensure backup jobs have monitoring and alerting configured

Ensure backup plans use resource tagging for selective backup

Ensure backup vaults are in different accounts for added security

Ensure backup plans have lifecycle policies for cost optimization

Ensure backup restore testing is performed regularly

Ensure AWS Backup is integrated with AWS Organizations

Ensure backup plans exclude unnecessary resources to optimize costs

Ensure backup vault has AWS Backup Vault Lock enabled for compliance

AWS Organizations

15 checks

Ensure AWS Organizations has Service Control Policies (SCPs) enabled

Ensure Organizations has AWS CloudTrail enabled at organization level

CIS 7.1critical

Ensure Organizations has SCPs preventing CloudTrail disablement

Ensure Organizations has SCPs enforcing regional restrictions

Ensure Organizations has SCPs preventing account leaving

Ensure Organizations root account has MFA enabled

Ensure Organizations has tag policies enabled and enforced

Ensure Organizations has backup policies enabled for data protection

Ensure Organizations has SCPs denying public S3 bucket creation

Ensure Organizations has delegated administrator for security services

Ensure Organizations has organizational units (OUs) structured appropriately

Ensure Organizations has all features enabled

Ensure Organizations has SCPs preventing security service disablement

Ensure Organizations management account has minimal resources

Ensure Organizations has centralized logging bucket with proper access controls

AWS Security Hub

15 checks

Ensure AWS Security Hub is enabled in all regions

Ensure Security Hub has CIS AWS Foundations Benchmark enabled

Ensure Security Hub has AWS Foundational Security Best Practices enabled

Ensure Security Hub has PCI-DSS standard enabled if applicable

Ensure Security Hub findings are integrated with incident response workflow

Ensure Security Hub has custom insights configured for security trends

Ensure Security Hub findings are enriched with resource tags

Ensure Security Hub has automated remediation for common findings

Ensure Security Hub findings are not suppressed without justification

Ensure Security Hub is integrated with AWS Organizations

Ensure Security Hub cross-region aggregation is enabled

Ensure Security Hub has third-party integrations configured

Ensure Security Hub findings have defined SLAs for remediation

Ensure Security Hub has configured suppression rules appropriately

Ensure Security Hub data is retained for compliance requirements

AWS Systems Manager

15 checks

Ensure Systems Manager managed instances are compliant with patch baselines

Ensure Systems Manager Session Manager is used instead of SSH/RDP

Ensure Session Manager has logging enabled to S3 and CloudWatch

Ensure Systems Manager Parameter Store uses SecureString for sensitive data

Ensure Systems Manager documents do not contain hardcoded credentials

Ensure Systems Manager Run Command output is encrypted

Ensure Systems Manager State Manager associations are compliant

Ensure Systems Manager Inventory is enabled for asset management

Ensure Systems Manager Compliance is monitored and violations addressed

Ensure Systems Manager automation documents have appropriate IAM roles

Ensure Systems Manager Maintenance Windows are scheduled appropriately

Ensure Systems Manager OpsCenter is used for operational issue management

Ensure Systems Manager Change Calendar is used for change control

Ensure Systems Manager Parameter Store has high-throughput parameters for frequently accessed values

Ensure Systems Manager managed instances use IMDSv2

Amazon Athena

10 checks

Ensure Athena workgroup enforces query result encryption

Ensure Athena workgroup enforces minimum encryption configuration

Ensure Athena workgroup has CloudWatch metrics enabled

Ensure Athena query results have lifecycle policies for cost control

Ensure Athena databases use encrypted data sources

Ensure Athena access is controlled via IAM policies

Ensure Athena workgroups have data usage controls configured

Ensure Athena query execution is logged to CloudTrail

Ensure Athena named queries do not contain sensitive data

Ensure Athena uses latest engine version for security and features

AWS Glue

15 checks

Ensure Glue Data Catalog encryption at rest is enabled

Ensure Glue connection passwords are encrypted

Ensure Glue jobs have encryption for S3 data targets

Ensure Glue jobs have CloudWatch log encryption enabled

Ensure Glue jobs are configured with job bookmarks

Ensure Glue Data Catalog resource policies restrict access appropriately

Ensure Glue crawlers have appropriate IAM roles with least privilege

Ensure Glue development endpoints are deleted when not in use

Ensure Glue jobs have timeout configured to prevent runaway costs

Ensure Glue jobs use appropriate worker type for workload

Ensure Glue job retry configuration is set appropriately

Ensure Glue job scripts do not contain hardcoded credentials

Ensure Glue connections are configured with VPC for database security

Ensure Glue crawlers have schedules appropriate for data freshness needs

Ensure Glue Data Quality rules are configured for critical datasets

Amazon EMR

10 checks

Ensure EMR clusters have encryption at rest enabled

Ensure EMR clusters have encryption in transit enabled

Ensure EMR clusters are not publicly accessible

Ensure EMR security groups restrict access appropriately

Ensure EMR clusters have Kerberos authentication enabled

Ensure EMR clusters have logging enabled to S3

Ensure EMR clusters use IMDSv2 for instance metadata

Ensure EMR clusters have managed scaling configured appropriately

Ensure EMR clusters use latest AMI versions

Ensure EMR step execution is monitored and alerted

Amazon Kinesis

10 checks

Ensure Kinesis Data Streams have encryption at rest enabled

Ensure Kinesis Data Streams enforce encryption in transit

Ensure Kinesis Data Streams have enhanced monitoring enabled

Ensure Kinesis Data Firehose delivery streams encrypt data at rest

Ensure Kinesis Data Firehose has error logging enabled

Ensure Kinesis Data Analytics applications use VPC configuration

Ensure Kinesis Data Streams have appropriate retention period

Ensure Kinesis resource policies restrict access appropriately

Ensure Kinesis streams are right-sized for throughput requirements

Ensure Kinesis Data Firehose has backup to S3 enabled

Supported Compliance Frameworks

Every check is mapped to relevant compliance framework controls

CIS AWS v1.5.0

CIS AWS v2.0

CIS AWS v3.0

CIS AWS v4.0

NIST 800-53 Rev4

NIST 800-53 Rev5

NIST CSF 1.1

NIST CSF 2.0

PCI-DSS v3.2.1

PCI-DSS v4.0

HIPAA

SOC 2 Type II

ISO 27001:2022

FedRAMP Low

FedRAMP Moderate

GDPR

AWS Well-Architected

AWS FTR

MITRE ATT&CK

NIS2

Run All 579+ AWS Security Checks

Get a comprehensive AWS security assessment in minutes. See all misconfigurations and compliance gaps.

Start AWS Scan Schedule Demo

No credit card required • Free tier available • 14-day trial