- Ensure IAM password policy requires at least one uppercase letter
- Ensure IAM password policy require at least one lowercase letter
- Ensure IAM password policy require at least one symbol
- Ensure IAM password policy require at least one number
- Ensure IAM password policy requires minimum length of 14 or greater
AWS CIS Benchmark Level 1
- Ensure CloudTrail is enabled in all regions
- Ensure CloudTrail trails are integrated with CloudWatch Logs
- Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
- Ensure a log metric filter and alarm exist for S3 bucket policy changes
- Ensure a log metric filter and alarm exist for changes to network gateways
- Ensure credentials unused for 90 days or greater are disabled
- Ensure access keys are rotated every 90 days or less
- Ensure security contact information is registered
- Ensure a log metric filter and alarm exist for AWS Management Console Authentication failures
- Ensure multi-factor authentication (MFA) is enabled for all users
- Ensure MFA is enabled for the "root" account
- Ensure no security groups allow ingress from all IPs(0.0.0.0/0) to SSH (Port 22)
- Ensure no security groups allow ingress from all IPs to RDP Port(3389)