Checks

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in45 or greater days be deactivated or removed.

Multiple active access keys widens the scope for compromise.

Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be

deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can

damage the credibility of the application/website behind the ELB. As a best practice, it is

recommended to delete expired certificates.

Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete an object version, adding another layer of security in the event your security credentials are compromised or unauthorized access is obtained.

Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.

Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.

Configuring all VPC default security groups to restrict all traffic will encourage least

privilege security group development and mindful placement of AWS resources into

security groups which will in-turn reduce the exposure of those resources.

Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.

Ensure IAM Database Authentication is enabled for RDS database instances to manage database access

Ensure deletion protection is enabled for RDS database instances.

VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.

Encryption should be forced for Kafka clusters, including at rest. This ensures sensitive data is kept private.

Ensures RDS instances and RDS Cluster instances are not launched into the public cloud.

A REST API in API Gateway is a collection of resources and methods that are integrated with backend HTTP endpoints, Lambda functions, or other AWS services. You can enable API caching in Amazon API Gateway to cache your endpoint responses. With caching, you can reduce the number of calls made to your endpoint and also improve the latency of requests to your API.

Ensures that S3 buckets have DNS complaint bucket names.

Ensures any IAM pass role attached to roles are flagged and warned.

Ensure deletion protection is enabled for RDS clusters.

AWS AMI data source should specify owners to avoid using unverified AMIs. The owners field helps ensure you're using AMIs from known and trusted sources.

Ensure that the creation of the unrestricted S3 IAM policies is disallowed.

Unnecessary access to S3 buckets can lead to unauthorized access or information disclosure.

AWS Lambda function environment variables are encrypted at rest using a customer-managed KMS key (CMK) rather than the default AWS-managed Lambda service key.

The presence of a KMSKeyArn on the function configuration indicates CMK-based encryption is active.

AWS Lambda function uses VPC networking with specified subnets and security groups, rather than the default Lambda-managed network.

Presence of a VPC association (vpc_id) indicates private connectivity to VPC resources.

AWS Lambda function invocations are recorded as CloudTrail data events when trails include AWS::Lambda::Function resources.

The finding reflects whether a function's Invoke activity is being logged by an eligible trail.

AWS Lambda functions have a Dead Letter Queue (DLQ) configured — an SQS queue or SNS topic that receives records of failed asynchronous invocations.

Without a DLQ, failed invocations are silently discarded after exhausting retries.