Profile Applicability:
 Level 1

Description:
 Regularly reviewing security configurations ensures that any changes in AWS services, compliance requirements, or security best practices are addressed promptly. Security reviews should focus on database configurations, IAM roles, and security groups to mitigate any risk of misconfigurations or non-compliance.

Rationale:
 Security configurations evolve over time as new vulnerabilities are discovered and new best practices are established. Regular reviews ensure that security controls remain effective, configurations are optimized, and risks are minimized. This is crucial for maintaining a strong security posture and adhering to industry standards.

Impact:
 Failing to review security configurations can lead to outdated or misconfigured security settings that expose resources to unnecessary risk. Regular reviews ensure that vulnerabilities are caught early and that security policies are aligned with current best practices.

Default Value:
 By default, AWS does not provide an automated mechanism for reviewing security configurations. Regular reviews need to be scheduled and managed manually or with third-party tools.

Pre-requisites:

  • An AWS account with administrative access.

  • Knowledge of AWS services such as IAM, VPC, RDS, and security tools.

  • A scheduled review process (quarterly, bi-annually).

Test Plan:

Using AWS Console:

  1. Navigate to the IAM Dashboard and review all roles, policies, and access controls.

  2. In RDS, inspect the security groups and configurations for Aurora or other databases.

  3. Verify that security logging and monitoring tools (e.g., CloudWatch, CloudTrail) are set up and functioning correctly.

  4. Ensure VPC security settings are reviewed, including NACLs, security groups, and subnet configurations.

Using AWS CLI:

  1. List IAM roles and policies:

     aws iam list-roles
 aws iam list-policies


  2. Check RDS security group settings:
     

    aws rds describe-db-instances --query "DBInstances[].{DBInstanceIdentifier:DBInstanceIdentifier, VpcSecurityGroups:VpcSecurityGroups}"


  3. Verify CloudTrail configuration for security auditing:

     aws cloudtrail describe-trails


  4. Check VPC security group configurations:

     aws ec2 describe-security-groups


Implementation Plan

Using AWS Console:

  1. Set up a recurring security review schedule for all security groups, IAM policies, and database configurations (e.g., quarterly).

  2. Create a security audit checklist that includes reviewing IAM roles, reviewing database access permissions, ensuring encryption configurations, and verifying security logging tools.

  3. Use AWS Config to monitor and track changes to security settings automatically, ensuring compliance.

  4. Utilize AWS Security Hub to get automated insights into your security posture.

Using AWS CLI:

  1. Use AWS Config to set up configuration rules for monitoring security settings:

     aws configservice put-config-rule --config-rule <rule-name> --source <source>


  2. Schedule periodic reviews using AWS Lambda or AWS Step Functions to trigger configuration assessments and security audits.

  3. Implement AWS Security Hub to get findings related to non-compliant resources:
     

    aws securityhub describe-findings

Backout Plan

Using AWS Console:

  1. Disable or remove any scheduled security reviews that were set up.

  2. Restore previous security configurations by using backups or configurations stored in AWS Config or CloudFormation templates.

  3. Turn off AWS Config and Security Hub if they were set up for continuous monitoring and auditing.

Using AWS CLI:

  1. Disable AWS Config rule:

     aws configservice delete-config-rule --config-rule-name <rule-name>


  2. Remove scheduled Lambda or Step Functions executions:

     aws lambda delete-function --function-name <function-name>



  3. Deactivate Security Hub:

     aws securityhub disable-security-hub


References: