AWS Security Check

The root account has two-step sign-in (MFA) turned on.

The root account is the email the AWS account was opened with. The IAM dashboard's security recommendations flag it if MFA is missing.

Nobody uses the root account for day-to-day work.

Download the credential report in IAM. The root row shows when it last signed in; it should be rare.

Everyone has their own login. Nobody shares one.

IAM → Users (or IAM Identity Center): one entry per person, and no shared "admin" or "office" user.

Every person's login has two-step sign-in.

The credential report's mfa_active column should say true for every user who can sign in to the console.

People get access through groups or roles, and only what their job needs.

Full administrator access belongs to one or two people. Everyone else gets a narrower group.

Unused logins and access keys are removed, and old keys are rotated.

The credential report shows when each user and key was last used, and how old each key is. Remove anything idle for 90 days.

Separate workloads live in separate AWS accounts, managed together in AWS Organizations.

At minimum, keep production apart from testing, so a mistake in one cannot reach the other.

No storage bucket is public unless it is meant to be, and someone has checked it.

In S3, turn on Block Public Access for the whole account. A bucket that must be public, such as website images, is a deliberate exception.

Remote-admin ports (SSH 22, RDP 3389) are not open to the whole internet.

EC2 → Security Groups: look for inbound rules from 0.0.0.0/0 on 22 or 3389. Limit them to known addresses, or use Systems Manager Session Manager.

Databases cannot be reached from the public internet.

In RDS, every database's "Publicly accessible" setting should say No.

Servers require the newer instance metadata service (IMDSv2).

A setting on each EC2 server. It makes it much harder for a hacked app to steal the server's AWS credentials.

Private servers sit in private subnets, with only the network routes they need.

Only load balancers and deliberately public servers belong in public subnets.

Servers reach AWS services through private VPC endpoints where they can.

Traffic to S3 and similar services then stays on AWS's network instead of crossing the internet.

Public apps sit behind a web application firewall (AWS WAF) and AWS's DDoS protection.

AWS Shield Standard is on by default; WAF rules are added on the load balancer or CloudFront.

Backups run automatically, and someone has restored one in the last three months.

A backup nobody has restored is a hope. Restore one file or record into a test space and time how long it takes.

Storage, server disks and databases are encrypted at rest.

S3 encrypts new files by default. Turn on "EBS encryption by default" in EC2 settings for each region; RDS encryption is chosen when a database is created.

All traffic to your apps and between services uses HTTPS or TLS.

Plain HTTP should only ever redirect to HTTPS.

Important buckets keep old versions, so a deletion or overwrite can be undone.

Turn on S3 versioning for those buckets. A backup copy in a separate account protects against a stolen password too.

Encryption keys are managed in AWS KMS, rotated, and usable by only a few people.

KMS key policies decide who can use each key. Automatic rotation is a setting on the key.

You know which data is sensitive before deciding where it is stored.

Customer details, payments and staff records need tighter access than marketing images.

You know which AWS region, and so which country, your data is stored in, and someone owns that decision.

Clients and regulators may ask. In Canada's 2022 cloud audit, nobody owned this question.

CloudTrail has a trail recording every region, and its logs cannot be edited or deleted.

Without a trail, AWS keeps only 90 days of event history. Store the trail in a bucket very few people can change.

GuardDuty is on, and someone reads its findings every week.

It flags signs of trouble, such as sign-ins from unusual places or servers talking to known bad addresses.

You get an alert when the root account is used, sign-ins fail repeatedly, or permissions change.

Root sign-in alerts should almost never fire. When one does, someone must see it the same day.

Network and service logs are kept in one place for an agreed period.

VPC Flow Logs and service logs, gathered somewhere they are retained and protected. Security Hub or AWS Config helps track settings over time.

A written one-page plan says who decides, who to call, and where the backups are.

Keep a printed copy somewhere other than the systems it describes.

You know to save evidence, such as disk snapshots, before fixing anything.

AWS's incident response guide advises snapshotting a compromised server before deleting or rebuilding it.

An emergency login for responders is set up in advance and stored safely.

So a locked-out administrator does not stop the response.

The plan is rehearsed at least once a year.

Talk through one scenario with the people on the plan. Canada's audit found rehearsals every 17 months against a 12-month minimum.

Contracts with providers say who handles a breach, and how fast they must tell you.

Vague breach clauses were one of the Canadian audit's findings.