iCompaas Support

Home Solutions Compliance Submit a ticket

Solutions›AWS Checks New Version›AWS New Checks›Ensure that Lightsail instances are not publicly accessible

Ensure that Lightsail instances are not publicly accessible

Last updated 29 May 2026

Ensure that Lightsail instances are not publicly accessible

Related compliance guidance

SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams
Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
ISO/IEC 27001:2022 compliance: a practical implementation guide
ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.

More in AWS New Checks

Ensure secrets are found in Lambda functions variables.
Ensure obsolete Lambda runtimes are found.
Ensure secrets are found in Lambda functions code.
Ensure no secrets are in CloudFormation outputs.
Ensure EKS Control Plane Audit Logging is enabled for all log types
Ensure access to the EKS Control Plane Endpoint is restricted.
Ensure that EKS Clusters are configured with private endpoints enabled and public access disabled.
Ensure the use of root accounts is avoided.
Ensure no root account access key exists.
Ensure IAM password policy requires minimum length of 14 or greater
Ensure only hardware MFA is enabled for the root account.
Ensure that the IAM password policy mandates at least one number.
Ensure no Customer Managed IAM policies allow actions that may lead into Privilege Escalation
Ensure that the IAM password policy prohibits password reuse, specifically 24 or greater.
Ensure that IAM policies are attached only to groups or roles.
Ensure that IAM password policy requires at least one lowercase letter.
Ensure IAM password policy requires at least one uppercase letter
Ensure MFA is enabled for the root account.
Ensure that access keys are not set up during initial user setup for all IAM users that have a console password.
Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed.
Ensure IAM password policy expires passwords within 90 days or less.
Ensure that users within groups holding AdministratorAccess policy have multi-factor authentication (MFA) tokens activated.
Ensure that Lightsail instances are not publicly accessible
Ensure Amazon Opensearch/Elasticsearch domains are not publicly accessible
Ensure no EC2 instances allow ingress from the internet to TCP port 3306 (MySQL).
Ensure Amazon EBS volumes should be protected by a backup plan.
Ensure no EC2 instances allow ingress from the internet to TCP port 5432 (PostgreSQL)
Ensure Elasticache Redis cache clusters have in transit encryption enabled.
Ensure no secrets are in Lambda functions code.
Ensure that RDS Snapshots and Cluster Snapshots are encrypted.

Home Solutions Compliance guides Submit a ticket iCompaas

© 2026 iCompaas, Inc.

Compliance guidesSOC 2 ISO 27001 HIPAA GDPR India DPDP Act NIST SP 800-53 NIST SP 800-171