Checks

Realtime log analysis is not available without enabling CloudWatch logging.

CloudTrail is a web service that records AWS API calls made in a given account. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.

CloudTrail uses Amazon S3 for log file storage and delivery, so log files are stored durably. In addition to capturing CloudTrail logs in a specified Amazon S3 bucket for long-term analysis, you can perform real-time analysis by configuring CloudTrail to send logs to CloudWatch Logs.

For a trail that is enabled in all Regions in an account, CloudTrail sends log files from all those Regions to a CloudWatch Logs log group.

Amazon S3 bucket access logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed. CIS recommends that you enable bucket access logging on the CloudTrail S3 bucket. By enabling S3 bucket logging on target S3 buckets, you can capture all events that might affect objects in a target bucket. Configuring logs to be placed in a separate bucket enables access to log information, which can be useful in security and incident response workflows.

You should limit the provision of public IP addresses for resources. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application.

Hardware MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they're prompted for their user name and password and for an authentication code from their AWS MFA device.

AWS IAM users can access AWS resources using different types of credentials, such as passwords or access keys. It is recommended that all credentials that have been unused in45 or greater days be deactivated or removed.

Multiple active access keys widens the scope for compromise.

Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate will be

deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB), which can

damage the credibility of the application/website behind the ELB. As a best practice, it is

recommended to delete expired certificates.

Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete an object version, adding another layer of security in the event your security credentials are compromised or unauthorized access is obtained.

Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.

Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.

Configuring all VPC default security groups to restrict all traffic will encourage least

privilege security group development and mindful placement of AWS resources into

security groups which will in-turn reduce the exposure of those resources.

Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.

Ensure IAM Database Authentication is enabled for RDS database instances to manage database access

Ensure deletion protection is enabled for RDS database instances.

VPC Flow Logs provide visibility into network traffic that traverses the VPC and can be used to detect anomalous traffic or insight during security workflows.

Encryption should be forced for Kafka clusters, including at rest. This ensures sensitive data is kept private.

Ensures RDS instances and RDS Cluster instances are not launched into the public cloud.

A REST API in API Gateway is a collection of resources and methods that are integrated with backend HTTP endpoints, Lambda functions, or other AWS services. You can enable API caching in Amazon API Gateway to cache your endpoint responses. With caching, you can reduce the number of calls made to your endpoint and also improve the latency of requests to your API.

Ensures that S3 buckets have DNS complaint bucket names.

Ensures any IAM pass role attached to roles are flagged and warned.

Ensure deletion protection is enabled for RDS clusters.

AWS AMI data source should specify owners to avoid using unverified AMIs. The owners field helps ensure you're using AMIs from known and trusted sources.

Ensure that the creation of the unrestricted S3 IAM policies is disallowed.

Unnecessary access to S3 buckets can lead to unauthorized access or information disclosure.