AWS Account Security Onboarding

aws_account_security_onboarding_aws

AWS-Account-Security-Onboarding

OfficialVerified

Checklist when onboarding new AWS Accounts to existing AWS Organization.

83requirements49checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance aws_account_security_onboarding_aws

Requirements (83)

Deploy account from predefined IaC template816

Predefine IAM RolesCheck if exists predefine IAM Roles4

Attributes

Type: Automated
Section: Deploy account from predefined IaC template
Service: IAM

Enabled security servicesCheck if security services are enabled4

Attributes

Type: Automated
Section: Deploy account from predefined IaC template
Service: SecurityServices

IDC integration, SSO configurationCheck if IDC integration and SSO configuration is enabled0

Attributes

Type: Manual
Section: Deploy account from predefined IaC template
Service: IAM Identity Center

Organization invitationCheck if organization invitation is enabled0

Attributes

Type: Manual
Section: Deploy account from predefined IaC template
Service: Organizations

Billing, emergency, security contactsCheck if billing, emergency, security contacts are configured2

Attributes

Type: Automated
Section: Deploy account from predefined IaC template
Service: Billing

Root user - distribution email + MFACheck if root user has distribution email and MFA enabled2

Attributes

Type: Automated
Section: Deploy account from predefined IaC template
Service: IAM

S3 Block Public AccessBlock public access to S3 buckets3

Attributes

Type: Automated
Section: Deploy account from predefined IaC template
Service: S3

SCPs53

Block unused regionsBlock unsued regions1

Attributes

Type: Automated
Section: SCPs
Service: IAM
Sub Section: Apply existing SCPs based on OU placement

Restrict instances typesRestrict instances types0

Attributes

Type: Manual
Section: SCPs
Service: IAM
Sub Section: Apply existing SCPs based on OU placement

Block root userBlock root user2

Attributes

Type: Automated
Section: SCPs
Service: IAM
Sub Section: Apply existing SCPs based on OU placement

Add custom SCPs if requiredAdd custom SCPs if required0

Attributes

Type: Manual
Section: SCPs
Service: IAM

Logging43

Send DNS Resolvers queries to SIEMSend DNS Resolvers queries to SIEM0

Attributes

Type: Manual
Section: Logging
Service: Logging

Send VPC Flow Logs (only DENYs) to S3 bucketSend VPC Flow Logs (only DENYs) to S3 bucket1

Attributes

Type: Automated
Section: Logging
Service: Logging

Send S3 access logs for critical buckets to separate S3 bucketSend S3 access logs for critical buckets to separate S3 bucket2

Attributes

Type: Automated
Section: Logging
Service: Logging

Establish ready-to-be-enabled pipelines to deliver ALB and CFD to SIEM to toggle in case of emergency and investigationsEstablish ready-to-be-enabled pipelines to deliver ALB and CFD to SIEM to toggle in case of emergency and investigations0

Attributes

Type: Manual
Section: Logging
Service: Logging

Alerting164

Alert on each High findingChecks that GuardDuty is enabled and configured to send High findings to CloudWatch Events1

Attributes

Type: Automated
Section: Alerting
Service: GuardDuty
Sub Section: GuardDuty

Alerts based on aggregated findings with severity Medium and belowAlert based on aggregated findings with severity Medium and below0

Attributes

Type: Manual
Section: Alerting
Service: GuardDuty
Sub Section: GuardDuty

Critical alert on every root user activitySend critical alert on every root user activity1

Attributes

Type: Automated
Section: Alerting
Service: CloudTrail
Sub Section: CloudTrail

Critical alert on cloudtrail settings changesSend critical alert on cloudtrail settings changes1

Attributes

Type: Automated
Section: Alerting
Service: CloudTrail
Sub Section: CloudTrail

Alert on rise of ConsoleLoginFailures eventsAlert on rise ConsoleLoginFailures events1

Attributes

Type: Automated
Section: Alerting
Service: CloudTrail
Sub Section: CloudTrail

Alert on IAM user changesAlert on IAM user changes0

Attributes

Type: Manual
Section: Alerting
Service: CloudTrail
Sub Section: CloudTrail

Alert on snapshot manipulationsAlert when a snapshot is manipulated0

Attributes

Type: Manual
Section: Alerting
Service: CloudTrail
Sub Section: CloudTrail

Alerts on raised cost anomaly eventsAlert when cost anomaly events are raised0

Attributes

Type: Manual
Section: Alerting
Service: Billing
Sub Section: Cost Anomaly

Alerts based on (at least) each new CRITICAL findingAlerts triggered by every new CRITICAL finding, at a minimum.0

Attributes

Type: Manual
Section: Alerting
Service: SecurityHub
Sub Section: SecurityHub

Realert on inactivity in a set periodActivate a re-alert system for detecting inactivity within a specified time frame.0

Attributes

Type: Manual
Section: Alerting
Service: SecurityHub
Sub Section: SecurityHub

Alerts based on rate-based rulesNotifications triggered by rate-based regulations0

Attributes

Type: Manual
Section: Alerting
Service: WAF
Sub Section: WAF

Alerts based on high amount of blocked requests by managed rulesNotifications triggered by a significant number of blocked requests as a result of managed rules.0

Attributes

Type: Manual
Section: Alerting
Service: WAF
Sub Section: WAF

Alert based on DDoSDetected metricGenerate an alert triggered by the detection of a DDoS attack based on the DDoSDetected metric.0

Attributes

Type: Manual
Section: Alerting
Service: Shield
Sub Section: Shield

Adopt incident response guide and prepared battle cardUtilize the incident response manual and have the battle card ready for use.0

Attributes

Type: Manual
Section: Alerting
Service: Shield
Sub Section: Shield

Alert on blocked DNS queryNotify when a DNS query is obstructed.0

Attributes

Type: Manual
Section: Alerting
Service: Route53
Sub Section: R53 DNS Resolver

Alert on critical vulnerabilities in AMIs/ImagesNotification regarding severe vulnerabilities detected in AMIs/Images.0

Attributes

Type: Manual
Section: Alerting
Service: Inspector
Sub Section: Vulnerability Scanning

Budget Alarms30

Create Cost Anomaly Detection monitors to alert spending anomalies (Prod)Develop monitoring systems for detecting cost anomalies and generating alerts for irregular spending patterns.0

Attributes

Type: Manual
Section: Budget Alarms
Service: CloudWatch
Sub Section: Prod

Create Cost Anomaly Detection monitors to alert spending anomalies (QA)Establish monitoring systems for cost anomaly detection to promptly notify about unusual spending patterns.0

Attributes

Type: Manual
Section: Budget Alarms
Service: CloudWatch
Sub Section: QA

Configure Budgets Actions to stop services in cases of big unexpected spendingsSet up Budgets Actions to halt services when significant unexpected expenses occur.0

Attributes

Type: Manual
Section: Budget Alarms
Service: SNS
Sub Section: QA

IAM Access Analyzer25

Create analyzers in each active regionsEstablish analyzers within every active region.2

Attributes

Type: Automated
Section: IAM Access Analyzer
Service: IAM Access Analyzer

Verify that events are present in SecurityHub aggregated viewConfirm the presence of events within the aggregated view of SecurityHub.3

Attributes

Type: Automated
Section: IAM Access Analyzer
Service: SecurityHub

Macie11

Consider enabling for critical buckets onlyPlease contemplate activating this feature exclusively for essential or crucial buckets.1

Attributes

Type: Automated
Section: Macie
Service: Macie

Vulnerability Scanning58

Enable and configure AWS InspectorEnable and set up AWS Inspector.1

Attributes

Type: Automated
Section: Vulnerability Scanning
Service: EC2
Sub Section: EC2 used as servers

Export scan results as metrics in centralized collector (EC2)Export scan results as metrics to a centralized collector.1

Attributes

Type: Automated
Section: Vulnerability Scanning
Service: EC2
Sub Section: EC2 used as servers

Scan images for vulnerability on upload to ECRCheck uploaded images for vulnerabilities when adding them to the ECR (Elastic Container Registry).5

Attributes

Type: Automated
Section: Vulnerability Scanning
Service: ECR
Sub Section: ECR used as docker images hub

Deploy solution to periodically rescan currently used images and report found vulnerabilitiesImplement a solution to conduct regular scans on currently employed images and notify about any identified vulnerabilities.1

Attributes

Type: Automated
Section: Vulnerability Scanning
Service: ECR
Sub Section: ECR used as docker images hub

Export scan results as metrics in centralized collector (ECR)Generate metric data from scan results and store it in a centralized collector.0

Attributes

Type: Manual
Section: Vulnerability Scanning
Service: ECR
Sub Section: ECR used as docker images hub

AWS Cloudtrail25

Enable as part of Organization trailActivate as a component of the Organization trail.2

Attributes

Type: Automated
Section: AWS Cloudtrail
Service: CloudTrail

Confirm that logs are present in S3 bucket and SIEMVerify the existence of logs within both the S3 bucket and the SIEM system.3

Attributes

Type: Automated
Section: AWS Cloudtrail
Service: CloudTrail

Enable AWS SecurityHub55

Deploy solution to alert on at least critical new findingsImplement a solution to trigger alerts for newly identified critical issues at minimum.1

Attributes

Type: Automated
Section: Enable AWS SecurityHub
Service: SecurityHub

Apply SecurityHub Central Configuration for OrganizationApply SecurityHub Central Configuration for Organization1

Attributes

Type: Automated
Section: Enable AWS SecurityHub
Service: SecurityHub

Enable/disable additional standards and controlsImplement SecurityHub Central Configuration across the organization.1

Attributes

Type: Automated
Section: Enable AWS SecurityHub
Service: SecurityHub

Confirm that findings are being visible in the aggregated viewPlease verify that the findings are visible when viewed in the aggregated perspective.1

Attributes

Type: Automated
Section: Enable AWS SecurityHub
Service: SecurityHub

Ensure that there are no critical (and considered critical) findings present in accountMake certain that there are no critical findings, whether deemed critical or not, within the account.1

Attributes

Type: Automated
Section: Enable AWS SecurityHub
Service: SecurityHub

Enable AWS Config32

Enable continuous recording for most of the resourcesActivate continuous recording for the majority of resources.1

Attributes

Type: Automated
Section: Enable AWS Config
Service: Config

Consider periodic recording for some resources to optimize billThink about implementing scheduled monitoring for specific resources in order to maximize cost efficiency.0

Attributes

Type: Manual
Section: Enable AWS Config
Service: Config

Confirm that records are present in central aggregatorConfirm that records are present in central aggregator1

Attributes

Type: Automated
Section: Enable AWS Config
Service: Config

Enable GuardDuty1120

Enable as part of central configuration for OrganizationPlease verify the existence of records within the central aggregator.2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

Threat DetectionDetection of Threats in your AWS environment2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

RDS protectionProtection for RDS instances2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

Lambda protectionProtection using Lambda2

Attributes

Type: Must
Section: Enable GuardDuty
Service: Lambda

S3 protectionProtection using S32

Attributes

Type: Must
Section: Enable GuardDuty
Service: S3

Malware ScanningConducting a Comprehensive Scan for Malicious Software2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

Confirm that events are present in SIEMConfirm that events are present in SIEM2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

Apply suppression filters to disable useless findingsImplementing suppression filters to deactivate non-essential detections.2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

Include in process of incident response based on eventsIncorporate within the procedural framework of incident response, taking into account the triggering events.2

Attributes

Type: Must
Section: Enable GuardDuty
Service: GuardDuty

Runtime protectionBrand new and in need of thorough testing.2

Attributes

Type: Optional
Section: Enable GuardDuty
Service: GuardDuty

EKS protection (if EKS is used)Enhanced Kubernetes Security (EKS) protection, if the Kubernetes service is employed.0

Attributes

Type: Optional
Section: Enable GuardDuty
Service: EKS

R53 DNS Resolver Firewall42

Apply managed domain name lists for Resolver in block mode)Utilize managed domain name lists within Resolver to implement block mode.2

Attributes

Type: Automated
Section: R53 DNS Resolver Firewall
Service: Route53

Use strictly AWS VPC DNS resolverExclusively Employ Amazon Web Services (AWS) Virtual Private Cloud (VPC) DNS Resolver0

Attributes

Type: Manual
Section: R53 DNS Resolver Firewall
Service: Route53

Ban outbound DNS calls from all VPCs to ports 53Prohibit all Virtual Private Clouds (VPCs) from initiating outbound DNS calls on port 53.0

Attributes

Type: Manual
Section: R53 DNS Resolver Firewall
Service: Route53

Apply custom threat list for GuardDuty to alert on access to DoH serversImplement a customized threat list within GuardDuty to generate alerts when there is access to Domain Name System over HTTPS (DoH) servers.0

Attributes

Type: Manual
Section: R53 DNS Resolver Firewall
Service: Route53

Shield Advanced312

Enable Shield Advanced subscription for public facing accountActivate the Shield Advanced subscription for the publicly accessible account.6

Attributes

Type: Automated
Section: Shield Advanced
Service: Shield Advanced

Export metrics in centralized collector (Shield Advanced)Exporting metrics to a centralized collector for data aggregation and analysis.0

Attributes

Type: Manual
Section: Shield Advanced
Service: Shield Advanced

Create DDoS battle card with main info about protected servicesPrepare a Detailed Distributed Denial of Service (DDoS) Battle Card Encompassing Key Information Regarding Safeguarded Services.6

Attributes

Type: Automated
Section: Shield Advanced
Service: Shield Advanced

WAFv21116

CFD + ALB + secret rotation architectureDesigning an Architecture for Computational Fluid Dynamics (CFD), Application Load Balancing (ALB), and Secret Rotation Integration3

Attributes

Type: Must
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Predefined set of managed rulesA pre-established collection of rules under management control.3

Attributes

Type: Must
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Global allow - and block-listsEstablishing International Lists for Permissions and Restrictions3

Attributes

Type: Must
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Blanket rate-based rulesEstablishing rules based on a standardized, all-encompassing rate.0

Attributes

Type: Must
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Service-unique exclusion rulesExclusion rules specific to the service provided.3

Attributes

Type: Must
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Additional managed rulesSupplementary managed rules0

Attributes

Type: Discuss
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Scoped-down rate-based rulesRate-based rules with a narrowed scope3

Attributes

Type: Discuss
Section: WAFv2
Service: WAFv2
Sub Section: Deploy WAF setup for each public web service

Enable Shield Advanced automatic application layer DDoS mitigationActivate automatic application layer Distributed Denial of Service (DDoS) mitigation within Shield Advanced.0

Attributes

Type: Manual
Section: WAFv2
Service: Shield Advanced

Configure R53 health checks for all protected resourcesEstablishing Amazon Route 53 (R53) health checks to monitor the well-being of all safeguarded resources.0

Attributes

Type: Manual
Section: WAFv2
Service: Route53

Configure sensitive fields redaction and send WAF logs to SIEMConfigure the redaction of sensitive fields and transmit Web Application Firewall (WAF) logs to the Security Information and Event Management (SIEM) system.0

Attributes

Type: Manual
Section: WAFv2
Service: WAFv2

Export metrics in centralized collector (WAFv2)Exporting metrics to a centralized collector for comprehensive data aggregation.1

Attributes

Type: Automated
Section: WAFv2
Service: CloudWatch