Cloud security articles

Ensure CloudTrail configuration changes are monitored

Ensure CloudTrail is enabled in all regions

Ensure CloudTrail log file validation is enabled

Ensure CloudTrail logs are encrypted at rest using KMS CMKs

Ensure EBS Volume Encryption is Enabled in all Regions

Ensure IAM password policy prevents password reuse

Ensure IAM policy changes are monitored

Ensure MFA Delete is enabled on S3 buckets

Ensure MFA is enabled for the 'root' user account

Ensure S3 Bucket Policy is set to deny HTTP requests

Ensure S3 bucket policy changes are monitored

Ensure VPC changes are monitored

Ensure VPC flow logging is enabled in all VPCs

Ensure access keys are rotated every 90 days or less

Ensure access to AWSCloudShellFullAccess is restricted

Ensure changes to network gateways are monitored

Ensure hardware MFA is enabled for the 'root' user account

Ensure management console sign-in without MFA is monitored

Ensure no 'root' user account access key exists

Ensure route table changes are monitored

Ensure routing tables for VPC peering are "least access"

Ensure security contact information is registered

Ensure security group changes are monitored

Ensure security questions are registered in the AWS account

Ensure that EC2 Metadata Service only allows IMDSv2

Ensure that IAM Access analyzer is enabled for all regions

Ensure that encryption is enabled for EFS file systems

Ensure that encryption-at-rest is enabled for RDS Instances

Ensure that public access is not given to RDS Instance

Ensure unauthorized API calls are monitored

Ensure usage of 'root' account is monitored

Ensure-iam-users-receive-permissions-only-through-groups

Environmental Systems | Plerion

Equipment Identification | Plerion

Equipment Location | Plerion

Equipment Redundancy | Plerion

Event Triage Processes | Plerion

Exception Management | Plerion

External Library Vulnerabilities

Failures and Anomalies Reporting

Governance Program Policy and Procedures

Governance Responsibility Model

Identity Inventory | Plerion

Identity and Access Management Policy and Procedures

Incident Response Metrics | Plerion

Incident Response Plans | Plerion

Incident Response Testing | Plerion

Independent Assessments | Plerion

Information Security Program | Plerion

Information System Regulatory Mapping

Infrastructure and Virtualization Security Policy Guidelines

Internal Compliance Testing | Plerion

Interoperability and Portability Policy and Procedures

Key Activation | Plerion

Key Archival | Plerion

Key Compromise | Plerion

Key Deactivation | Plerion

Key Destruction | Plerion

Key Generation | Plerion

Key Inventory Management | Plerion

Key Purpose | Plerion

Key Recovery | Plerion

Key Revocation | Plerion

Key Rotation | Plerion

Key Suspension | Plerion

Least Privilege | Plerion

Limit IAM Users to One Active Access Key at a Time

Limitation of Production Data Use

Limitation of Purpose in Personal Data Processing

Log Protection | Plerion

Log Records | Plerion

Logging Scope | Plerion

Logging and Monitoring Policy and Procedures

Maintain current contact details

Malware Protection Policy and Procedures

Manage IAM Users via Identity Federation or AWS Organizations

Management of Privileged Access Roles

Migration to Cloud Environments

Monitor AWS Management Console Authentication Failures

Monitor Changes to Network Access Control Lists (NACLs)

Monitor Deletion or Disabling of Customer-Created CMKs

Network Architecture Documentation

Network Defense | Plerion

Network Security | Plerion

Non-Disclosure Agreements | Plerion

OS Hardening and Base Controls

Off-Site Equipment Disposal Policy and Procedures

Off-Site Transfer Authorization Policy and Procedures

Operating Systems | Plerion

Organizational Policy Reviews | Plerion

Passwords Management | Plerion

Penetration Testing | Plerion

Personal Data Access, Reversal, Rectification and Deletion

Personal Data Sub-processing | Plerion

Personal and Sensitive Data Awareness and Training

Personnel Roles and Responsibilities

Points of Contact Maintenance | Plerion

Policy Exception Process | Plerion

Primary Service and Contractual Agreement

Production and Non-Production Environments