- 1.22 Restrict Access to AWSCloudShellFullAccess (Manual)
- 1.21 Ensure IAM Users Are Managed Centrally via Identity Federation or AWS Organizations in Multi-Account Environments (Manual)
- 1.11 Do Not Create Access Keys During Initial Setup for IAM Users with a Console Password (Manual)
- 1.1 Maintain Current Contact Details (Manual)
- 1.2 Ensure Security Contact Information is Registered (Manual)
AWS CIS V.4 Level 1 Benchmarks
- 4.16 Ensure AWS Security Hub is Enabled (Automated)
- 4.15 Ensure AWS Organizations Changes are Monitored (Manual)
- 4.14 Ensure VPC Changes are Monitored (Manual)
- 4.13 Ensure Route Table Changes are Monitored (Manual)
- 4.12 Ensure Changes to Network Gateways are Monitored (Manual)
- 2.2.4 Ensure Multi-AZ deployments are used for enhanced availability in Amazon RDS
- 2.2.3 Ensure that RDS instances are not publicly accessible
- 2.2.2 Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances
- 2.2.1 Ensure that encryption-at-rest is enabled for RDS instances
- 2.1.4 Ensure that S3 is configured with 'Block Public Access' enabled
- 3.2 Ensure CloudTrail Log File Validation is Enabled (Automated)
- 3.3 Ensure AWS Config is Enabled in All Regions (Automated)
- 3.4 Ensure Server Access Logging is Enabled on the CloudTrail S3 Bucket (Automated)
- 3.5 Ensure CloudTrail Logs Are Encrypted at Rest Using KMS CMKs (Automated)
- 3.6 Ensure Rotation for Customer-Created Symmetric CMKs Is Enabled (Automated)
- 5.7 Ensure that the EC2 Metadata Service Only Allows IMDSv2 (Automated)
- 5.6 Ensure Routing Tables for VPC Peering are "Least Access" (Manual)
- 5.4 Ensure No Security Groups Allow Ingress from ::/0 to Remote Server Administration Ports (Automated)
- 5.3 Ensure No Security Groups Allow Ingress from 0.0.0.0/0 to Remote Server Administration Ports (Automated)
- 5.2 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to Remote Server Administration Ports (Automated)