Checks

Workspace volumes for both user and root should be encrypted to protect the data stored on them.

Method cache encryption ensures that any sensitive data in the cache is not vulnerable to compromise in the event of interception

X-Ray tracing enables end-to-end debugging and analysis of all API Gateway HTTP requests.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.

API Gateway stages should have access log settings block configured to track all access to a particular stage. This should be applied to both v1 and v2 gateway stages.

X-Ray tracing enables end-to-end debugging and analysis of all state machine activities.

Logging enables end-to-end debugging and analysis of all state machine activities.

Encryption should be enabled at all available levels to ensure that data is protected if compromised.

When creating Launch Configurations, user data can be used for the initial configuration of the instance. User data must not contain any sensitive data.

IAM groups should be protected with multi factor authentication to add safe guards to password compromise.

Security group rules should include a description for auditing purposes.

Simplifies auditing, debugging, and managing security groups.

X-Ray tracing enables end-to-end debugging and analysis of the function.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Redshift clusters that are created without subnet details will be created in EC2 classic mode, meaning that they will be outside of a known VPC and running in tenant. In order to benefit from the additional security features achieved with using an owned VPC, the subnet should be set.

Encryption using AWS keys provides protection for your Neptune underlying storage. To increase control of the encryption and manage factors like rotation use customer managed keys.

EC2 instance data is used to pass start up information into the EC2 instance. This userdata must not contain access key credentials. Instead use an IAM Instance Profile assigned to the instance to grant access to other AWS Services.

IMDS v2 (Instance Metadata Service) introduced session authentication tokens which improve security when talking to IMDS.

By default <code>aws_instance</code> resource sets IMDS session auth tokens to be optional.

To fully protect IMDS you need to enable session tokens by using <code>metadata_options</code> block and its <code>http_tokens</code> variable set to <code>required</code>.

Block devices should be encrypted to ensure sensitive data is held securely at rest.

Encryption using AWS keys provides protection for your S3 buckets. To gain greater control over encryption, such as key rotation, access policies, and auditability, use customer managed keys (CMKs) with SSE-KMS. Note that SSE-KMS is not supported for S3 server access logging destination buckets; in such cases, use SSE-S3 instead.

Enabling Performance insights allows for greater depth in monitoring data. For example, information about active sessions could help diagose a compromise or assist in the investigation

Queues should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular control over access to specific queues.

Topics should be encrypted with customer managed KMS keys and not default AWS managed keys, in order to allow granular key management.

Data stored within an EMR cluster should be encrypted to ensure sensitive data is kept private.