Identity & Access Management
11 CHECKS
IAM-01
Root account MFA enabledCIS 1.1
WHYRoot account compromise is catastrophic. MFA is the single most important IAM control.
IAM-02
Root account has no active access keysCIS 1.4
WHYRoot access keys cannot be scoped — any leak gives total account access.
IAM-03
MFA enabled for all IAM users with console accessCIS 1.10
WHYPasswords alone are insufficient against phishing and credential stuffing.
IAM-04
No IAM users with AdministratorAccess policy attached directlyCIS 1.16
WHYAdmin access must be granted via roles, not directly to users.
IAM-05
Password policy enforces minimum 14 charactersCIS 1.8
WHYShort passwords are vulnerable to brute force. 14+ chars is the CIS standard.
IAM-06
Password policy requires uppercase, lowercase, numbers, and symbolsCIS 1.9
WHYComplexity requirements significantly increase brute-force resistance.
IAM-07
Unused credentials disabled (inactive >90 days)CIS 1.12
WHYDormant credentials are a silent attack surface. Audit and disable quarterly.
IAM-08
No inline IAM policies — managed policies onlyCIS 1.15
WHYInline policies bypass central governance and are harder to audit.
IAM-09
IAM Access Analyzer enabled in all regionsCIS 1.20
WHYFinds resources shared with external entities you may not be aware of.
IAM-10
CloudTrail logging enabled for all IAM actions
WHYEssential for forensics and compliance. All identity actions must be logged.
IAM-11
IAM Identity Center (SSO) configured vs. individual IAM users
WHYCentralized access management reduces sprawl and improves auditability.
S3 Bucket Security
8 CHECKS
S3-01
S3 Block Public Access enabled at account levelCIS 2.1.5
WHYOne misconfigured bucket policy cannot expose data if account-level block is on.
S3-02
No buckets with public read or write ACLsCIS 2.1.1
WHYPublic buckets are one of the most common causes of data breaches in AWS.
S3-03
S3 server-side encryption enabled on all buckets (SSE-S3 or SSE-KMS)CIS 2.1.1
WHYEncryption at rest protects data if physical storage is compromised.
S3-04
S3 access logging enabled on all sensitive buckets
WHYRequired for forensics and HIPAA/SOC 2 compliance.
S3-05
S3 versioning enabled on critical data buckets
WHYProtects against accidental deletion and ransomware attacks.
S3-06
S3 lifecycle policies configured (no unbounded storage growth)
WHYCompliance data retention and cost control.
S3-07
No bucket policies granting access to * (all principals)
WHYWildcard principal policies are almost always misconfigured.
S3-08
Cross-account S3 access reviewed and documented
WHYThird-party access to your data must be intentional and auditable.
Network Security (VPC)
9 CHECKS
NET-01
No security groups with 0.0.0.0/0 inbound on SSH (port 22)CIS 5.2
WHYOpen SSH to the internet is the #1 cause of unauthorized server access.
NET-02
No security groups with 0.0.0.0/0 inbound on RDP (port 3389)CIS 5.3
WHYOpen RDP is a primary ransomware delivery vector. Never expose to internet.
NET-03
Default VPC security group has no inbound or outbound rulesCIS 5.4
WHYDefault security groups are often inadvertently used. Lock them down.
NET-04
VPC Flow Logs enabled in all VPCsCIS 3.9
WHYRequired for network forensics, threat detection, and compliance audits.
NET-05
No resources in default VPC
WHYDefault VPCs have no network segmentation. All workloads need custom VPCs.
NET-06
NACLs configured to restrict inbound traffic by subnet
WHYDefense-in-depth: NACLs add a stateless layer beyond security groups.
NET-07
Internet-facing load balancers reviewed — only necessary services exposed
WHYEvery internet-facing service is an attack surface. Minimize exposure.
NET-08
Private subnets used for databases and internal services
WHYData tier should never be directly reachable from the internet.
NET-09
NAT Gateway used for outbound traffic (not direct internet access)
WHYOutbound traffic must be controlled and logged, not open to all.
Logging & Monitoring
10 CHECKS
LOG-01
CloudTrail enabled in all regions with multi-region trailCIS 3.1
WHYSingle-region trails miss API calls in other regions — attackers know this.
LOG-02
CloudTrail log file validation enabledCIS 3.2
WHYDetects if log files have been tampered with after delivery.
LOG-03
CloudTrail S3 bucket is not publicly accessibleCIS 3.3
WHYAudit logs must be protected from modification and unauthorized access.
LOG-04
CloudTrail integrated with CloudWatch LogsCIS 3.4
WHYEnables real-time alerting on suspicious API activity.
LOG-05
AWS Config enabled in all regionsCIS 3.5
WHYConfig provides a history of all resource configuration changes.
LOG-06
GuardDuty enabled in all regionsCIS 3.8
WHYThreat detection for unusual API calls, compromised instances, and more.
LOG-07
Security Hub enabled and standards activated
WHYCentral view of all security findings across your AWS account.
LOG-08
CloudWatch alarms configured for: root login, policy changes, failed logins
WHYReal-time alerting on high-priority security events.
LOG-09
SNS topic for security alerts has at least one active subscription
WHYAlerts that go nowhere are useless. Verify notification delivery end-to-end.
LOG-10
Log retention policies set (minimum 90 days, 1 year for compliance)
WHYHIPAA and SOC 2 require minimum retention periods for audit logs.
Encryption & Secrets Management
7 CHECKS
ENC-01
KMS Customer Managed Keys (CMKs) used for sensitive data (not AWS-managed keys)
WHYCMKs give you control over key rotation and access — AWS-managed keys do not.
ENC-02
KMS key rotation enabled on all CMKsCIS 3.7
WHYAnnual key rotation limits the blast radius of a key compromise.
ENC-03
EBS volumes encrypted at rest
WHYEC2 instance data must be encrypted. Enable account-level encryption default.
ENC-04
RDS instances encrypted at rest
WHYDatabase encryption is a fundamental baseline and required for HIPAA.
ENC-05
No hardcoded credentials in application code or EC2 user data
WHYCredentials in code are routinely exposed via GitHub and S3.
ENC-06
AWS Secrets Manager used for all API keys, DB passwords, tokens
WHYCentralized secrets management with automatic rotation support.
ENC-07
TLS 1.2+ enforced for all data in transit (load balancers, APIs)
WHYOlder TLS versions have known vulnerabilities. Enforce modern TLS everywhere.
Compute & Container Security
5 CHECKS
CMP-01
EC2 instances use IMDSv2 (metadata service v2) — IMDSv1 disabled
WHYIMDSv1 is vulnerable to SSRF attacks that can steal instance credentials.
CMP-02
EC2 instances use IAM instance profiles (not hardcoded credentials)
WHYInstance profiles provide temporary, auto-rotating credentials.
CMP-03
ECR image scanning enabled on push
WHYContainers must be scanned for known CVEs before deployment.
CMP-04
EKS/ECS tasks use task-level IAM roles (not node-level admin roles)
WHYLeast-privilege at the container level limits blast radius.
CMP-05
Systems Manager Patch Manager configured for EC2 patching
WHYUnpatched instances are the most common vector for ransomware.