IAM Policies
42 articles
- Ensure there are no EC2 AMIs set as Public
- Ensure users of groups with AdministratorAccess policy have MFA tokens enabled
- Ensure there are no EBS Snapshots set as Public
- Ensure there are no S3 buckets open to the Everyone or Any AWS user
- Ensure there are no Security Groups without ingress filtering being used
- Ensure every Security Group is being used by at least one resource
- Ensure Amazon Macie is enabled
- Ensure CloudFront distributions have logging enabled
- Ensure Amazon Elasticsearch Service (ES) domains have logging enabled
- Ensure Elastic Load Balancers have logging enabled
- Ensure S3 Bucket Logging Enabled
- Ensure Route53 public hosted zones are logging queries to CloudWatch Logs
- Ensure Lambda functions invoke API operations are being recorded by CloudTrail
- Ensure Redshift cluster has audit logging enabled
- Ensure ACM certificates have Certificate Transparency logging enabled
- Ensure Trusted Advisor is enabled for errors and warnings
- Ensure SQS queues have Server Side Encryption enabled
- Ensure there are no EBS Volumes unencrypted
- Ensure Geo restrictions are enabled in CloudFront distributions
- Ensure the providers SAML-Based Federation for API Access to AWS:
- Ensure S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it
- Ensure RDS instances storage is encrypted
- Ensure RDS instances have backup enabled
- Ensure EBS snapshots are encrypted
- Ensure API Gateway endpoint are not publicly accessible
- Ensure RDS instances is integrated with CloudWatch Logs
- Ensure EC2 Instances is not older than 6 months
- Ensure EC2 Instances is not older than 12 months
- Ensure there are no secrets in Lambda functions variables
- Ensure there are no secrets in Lambda functions code
- Ensure EBS Default Encryption is activated
- Ensure there are no obsolete Lambda runtimes
- Ensure S3 buckets have object versioning enabled
- Ensure IAM Access Analyzer is enabled and its findings
- Ensure Required IAM Policies for IAM Roles Check
- Ensure there are no empty IAM Groups
- Ensure IAM users have Hardware MFA enabled
- Check if IAM users have two active access keys
- Ensure IAM Blacklisted Policies Check
- Ensure No Inline IAM Policies Allowed
- Ensure credentials unused for 30 days or greater are disabled
- Ensure that no custom IAM policies exist which allow permissive role assumption