TEST NAME

Ensure security contact information is registered

Description

AWS provides customers with the option of specifying the contact information for account's security team. It is recommended that this information be provided.

Rationale

Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.

Impact

Recommendation and Steps

Perform the following to establish security contact information:
From Console:
1. Click on your account name at the top right corner of the console.
2. From the drop-down menu Click My Account
3. Scroll down to the Alternate Contacts section
4. Enter contact information in the Security section
From Command Line:
Run the following command with the following input parameters:
--email-address, --name, and --phone-number.

aws account put-alternate-contact --alternate-contact-type SECURITY
Note: Consider specifying an internal email distribution list to ensure emails are
regularly monitored by more than one individual.

Associated Items

Affected Objects

TEST NAME

Ensure security questions are registered in the AWS account

Description

The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established.

Rationale

When creating a new AWS account, a default super user is automatically created. This account is referred to as the 'root user' or 'root' account. It is recommended that the use of this account be limited and highly controlled. During events in which the 'root' password is no longer accessible or the MFA token associated with 'root' is lost/destroyed it is possible, through authentication using secret questions and associated answers, to recover 'root' user login access.

Impact

Recommendation and Steps

From Console:
1. Login to the AWS Account as the 'root' user
2. Click on the  from the top right of the console
3. From the drop-down menu Click My Account
4. Scroll down to the Configure Security Questions section
5. Click on Edit
6. Click on each Question
-From the drop-down select an appropriate question
-Click on the Answer section
-Enter an appropriate answer
o Follow process for all 3 questions
7. Click Update when complete
8. Save Questions and Answers and place in a secure physical location

Associated Items

Affected Objects

TEST NAME

Ensure MFA is enabled for the root user account

Description

The 'root' user account is the most privileged user in an AWS account. Multi-factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their username and password as well as for an authentication code from their AWS MFA device. Note: When virtual MFA is used for 'root' accounts, it is recommended that the device used is NOT a personal device, but rather a dedicated mobile device (tablet or phone)that is managed to be kept charged and secured independent of any individual personal devices. (non-personal virtual MFA) This lessens the risks of losing access to the MFA due to device loss, device trade-in or if the individual owning the device is no longer employed at the company.

Rationale

Enabling MFA provides increased security for console access as it requires theauthenticating principal to possess a device that emits a time-sensitive key and haveknowledge of a credential.

Impact

Recommendation and Steps

Perform the following to establish MFA for the 'root' user account:
1. Sign in to the AWS Management Console and open the IAM console at
https://console.aws.amazon.com/iam/.
Note: to manage MFA devices for the 'root' AWS account, you must use your 'root'
account credentials to sign in to AWS. You cannot manage MFA devices for the 'root'
account using other credentials.
2. Choose Dashboard , and under Security Status , expand Activate MFA on your
root account.
3. Choose Activate MFA
4. In the wizard, choose A virtual MFA device and then choose Next Step .
5. IAM generates and displays configuration information for the virtual MFA device,
including a QR code graphic. The graphic is a representation of the 'secret
configuration key' that is available for manual entry on devices that do not
support QR codes.
6. Open your virtual MFA application. (For a list of apps that you can use for hosting
virtual MFA devices, see Virtual MFA Applications.) If the virtual MFA application
supports multiple accounts (multiple virtual MFA devices), choose the option to
create a new account (a new virtual MFA device).
7. Determine whether the MFA app supports QR codes, and then do one of the
following:
o Use the app to scan the QR code. For example, you might choose the
camera icon or choose an option similar to Scan code, and then use the
device's camera to scan the code.
o In the Manage MFA Device wizard, choose Show secret key for manual
configuration, and then type the secret configuration key into your MFA
application.
When you are finished, the virtual MFA device starts generating one-time passwords.
In the Manage MFA Device wizard, in the Authentication Code 1 box, type the one-time
password that currently appears in the virtual MFA device. Wait up to 30 seconds for
the device to generate a new one-time password. Then type the second one-time
password into the Authentication Code 2 box. Choose Assign Virtual MFA.

Associated Items

Affected Objects

TEST NAME

Ensure hardware MFA is enabled for the root user account

Description

The 'root' user account is the most privileged user in an AWS account. MFA adds anextra layer of protection on top of a user name and password. With MFA enabled, whena user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level2, it is recommended that the 'root' user account be protected with a hardware MFA.

Rationale

A hardware MFA has a smaller attack surface than a virtual MFA. For example, ahardware MFA does not suffer the attack surface introduced by the mobile smartphoneon which a virtual MFA resides.Note: Using hardware MFA for many, many AWS accounts may create a logisticaldevice management issue. If this is the case, consider implementing this Level 2recommendation selectively to the highest security AWS accounts and the Level 1recommendation applied to the remaining accounts.

Impact

Recommendation and Steps

Perform the following to establish a hardware MFA for the 'root' user account:
1. Sign in to the AWS Management Console and open the IAM console at
https://console.aws.amazon.com/iam/.
Note: to manage MFA devices for the AWS 'root' user account, you must use
your 'root' account credentials to sign in to AWS. You cannot manage MFA
devices for the 'root' account using other credentials.
2. Choose Dashboard , and under Security Status , expand Activate MFA on your
root account.
3. Choose Activate MFA
4. In the wizard, choose A hardware MFA device and then choose Next Step .
5. In the Serial Number box, enter the serial number that is found on the back of the
MFA device.
6. In the Authentication Code 1 box, enter the six-digit number displayed by the
MFA device. You might need to press the button on the front of the device to
display the number.
7. Wait 30 seconds while the device refreshes the code, and then enter the next
six-digit number into the Authentication Code 2 box. You might need to press
the button on the front of the device again to display the second number.
8. Choose Next Step . The MFA device is now associated with the AWS account.
The next time you use your AWS account credentials to sign in, you must type a
code from the hardware MFA device.
Remediation for this recommendation is not available through AWS CLI.

Associated Items

Affected Objects

TEST NAME

Ensure IAM password policy requires minimum length of 14 or greater

Description

Password policies are, in part, used to enforce password complexity requirements. IAMpassword policies can be used to ensure password are at least a given length. It is recommended that the password policy require a minimum password length 14.

Rationale

Setting a password complexity policy increases account resiliency against brute forcelogin attempts.

Impact

Recommendation and Steps

Perform the following to set the password policy as prescribed:
From Console:
1. Login to AWS Console (with appropriate permissions to View Identity Access
Management Account Settings)
2. Go to IAM Service on the AWS Console
3. Click on Account Settings on the Left Pane
4. Set Minimum password length to 14 or greater.
5. Click Apply password policy
Page 31
From Command Line:
aws iam update-account-password-policy --minimum-password-length 14
Note: All commands starting with aws iam update-account-password-policy can be
combined into a single command.

Associated Items

Affected Objects

TEST NAME

Ensure IAM password policy prevents password reuse

Description

Page 321.9 Ensure IAM password policy prevents password reuse(Automated)Profile Applicability:? Level 1Description:IAM password policies can prevent the reuse of a given password by the same user. Itis recommended that the password policy prevent the reuse of passwords.

Rationale

Preventing password reuse increases account resiliency against brute force loginattempts.

Impact

Recommendation and Steps

Perform the following to set the password policy as prescribed:
From Console:
1. Login to AWS Console (with appropriate permissions to View Identity Access
Management Account Settings)
2. Go to IAM Service on the AWS Console
3. Click on Account Settings on the Left Pane
4. Check Prevent password reuse
5. Set Number of passwords to remember is set to 24
Page 33
From Command Line:
aws iam update-account-password-policy --password-reuse-prevention 24
Note: All commands starting with aws iam update-account-password-policy can be
combined into a single command.

Associated Items

Affected Objects

TEST NAME

Ensure IAM Users Receive Permissions Only Through Groups

Description

IAM users are granted access to services, functions, and data through IAM policies.There are four ways to define policies for a user: 1) Edit the user policy directly, aka aninline, or user, policy; 2) attach a policy directly to a user; 3) add the user to an IAMgroup that has an attached policy; 4) add the user to an IAM group that has an inlinepolicy.Only the third implementation is recommended.

Rationale

Assigning IAM policy only through groups unifies permissions management to a single,flexible layer consistent with organizational functional roles. By unifying permissionsmanagement, the likelihood of excessive permissions is reduced.

Impact

Recommendation and Steps

Perform the following to create an IAM group and assign a policy to it:
1. Sign in to the AWS Management Console and open the IAM console at
https://console.aws.amazon.com/iam/.
2. In the navigation pane, click Groups and then click Create New Group .
3. In the Group Name box, type the name of the group and then click Next Step .
4. In the list of policies, select the check box for each policy that you want to apply
to all members of the group. Then click Next Step .
5. Click Create Group
Perform the following to add a user to a given group:
1. Sign in to the AWS Management Console and open the IAM console at
https://console.aws.amazon.com/iam/.
2. In the navigation pane, click Groups
3. Select the group to add a user to
4. Click Add Users To Group
5. Select the users to be added to the group
6. Click Add Users
Perform the following to remove a direct association between a user and policy:
1. Sign in to the AWS Management Console and open the IAM console at
https://console.aws.amazon.com/iam/.
2. In the left navigation pane, click on Users
3. For each user:
o Select the user
o Click on the Permissions tab
o Expand Permissions policies
o Click X for each policy; then click Detach or Remove (depending on policy
type)

Associated Items

Affected Objects

TEST NAME

Ensure that IAM Access analyzer is enabled for all regions

Description

Enable IAM Access analyzer for IAM policies about all resources in each active AWSregion.IAM Access Analyzer is a technology introduced at AWS reinvent 2019. After theAnalyzer is enabled in IAM, scan results are displayed on the console showing theaccessible resources. Scans show resources that other accounts and federated userscan access, such as KMS keys and IAM roles. So the results allow you to determine ifan unintended user is allowed, making it easier for administrators to monitor leastprivileges access. Access Analyzer analyzes only policies that are applied to resourcesin the same AWS Region.

Rationale

AWS IAM Access Analyzer helps you identify the resources in your organization andaccounts, such as Amazon S3 buckets or IAM roles, that are shared with an externalentity. This lets you identify unintended access to your resources and data. AccessAnalyzer identifies resources that are shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. IAMAccess Analyzer continuously monitors all policies for S3 bucket, IAM roles, KMS (Key Management Service) keys, AWS Lambda functions, and Amazon SQS(Simple QueueService) queues.

Impact

Recommendation and Steps

From Console:
Perform the following to enable IAM Access analyzer for IAM policies:
1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. Choose Access analyzer.
3. Choose Create analyzer.
4. On the Create analyzer page, confirm that the Region displayed is the Region
where you want to enable Access Analyzer.
5. Enter a name for the analyzer. Optional as it will generate a name for you
automatically.
6. Add any tags that you want to apply to the analyzer. Optional.
7. Choose Create Analyzer.
8. Repeat these step for each active region
From Command Line:
Run the following command:
aws accessanalyzer create-analyzer --analyzer-name  --type

Repeat this command above for each active region.
Note: The IAM Access Analyzer is successfully configured only when the account you
use has the necessary permissions.

Associated Items

Affected Objects

TEST NAME

Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments

Description

In multi-account environments, IAM user centralization facilitates greater user control.User access beyond the initial account is then provided via role assumption.Centralization of users can be accomplished through federation with an external identityprovider or through the use of AWS Organizations.

Rationale

Centralizing IAM user management to a single identity store reduces complexity andthus the likelihood of access management errors.

Impact

Recommendation and Steps

The remediation procedure will vary based on the individual organization's
implementation of identity federation and/or AWS Organizations with the acceptance
criteria that no non-service IAM users, and non-root accounts, are present outside the
account providing centralized IAM user management.

Associated Items

Affected Objects

TEST NAME

Maintain current contact details

Description

Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy or indicative of likely security compromise is observed by the AWS Abuse team. Contact details should not be for a single individual, as circumstances may arise where that individual is unavailable. Email contact details should point to a mail alias which forwards email to multiple individuals within the organization; where feasible, phone contact details should point to a PABX hunt group or other call-forwarding system.

Rationale

If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question, so it is in both the customers' and AWS' best interests that prompt contact can be established. This is best achieved by setting AWS account contact details to point to resources which have multiple individuals as recipients, such as email aliases and PABX hunt groups.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure no root user account access key exists

Description

The 'root' user account is the most privileged user in an AWS account. AWS AccessKeys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.

Rationale

Deleting access keys associated with the 'root' user account limits vectors by which the account can be compromised. Additionally, deleting the 'root' access keys encourages the creation and use of role based accounts that are least privileged.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Eliminate use of the root user for administrative and daily tasks

Description

With the creation of an AWS account, a 'root user' is created that cannot be disabled ordeleted. That user has unrestricted access to and control over all resources in the AWSaccount. It is highly recommended that the use of this account be avoided for everydaytasks.

Rationale

The 'root user' has unrestricted access to and control over all account resources. Use ofit is inconsistent with the principles of least privilege and separation of duties, and canlead to unnecessary harm due to error or account compromise.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

Description

Multi-Factor Authentication (MFA) adds an extra layer of authentication assurancebeyond traditional credentials. With MFA enabled, when a user signs in to the AWSConsole, they will be prompted for their user name and password as well as for anauthentication code from their physical or virtual MFA token. It is recommended thatMFA be enabled for all accounts that have a console password.

Rationale

Enabling MFA provides increased security for console access as it requires theauthenticating principal to possess a device that displays a time-sensitive key and haveknowledge of a credential.

Impact

AWS will soon end support for SMS multi-factor authentication (MFA). New customersare not allowed to use this feature. We recommend that existing customers switch toone of the following alternative methods of MFA.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Do not setup access keys during initial user setup for all IAM users that have a console password

Description

AWS console defaults to no check boxes selected when creating a new IAM user.When creating the IAM User credentials you have to determine what type of accessthey require.Programmatic access: The IAM user might need to make API calls, use the AWS CLI,or use the Tools for Windows PowerShell. In that case, create an access key (accesskey ID and a secret access key) for that user.AWS Management Console access: If the user needs to access the AWS Management Console, create a password for the user.

Rationale

Requiring the additional steps be taken by the user for programmatic access after theirprofile has been created will give a stronger indication of intent that access keys are [a]necessary for their work and [b] once the access key is established on an account thatthe keys may be in use somewhere in the organization.Note: Even if it is known the user will need access keys, require them to create the keysthemselves or put in a support ticket to have them created as a separate step from usercreation.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure there is only one active access key available for any single IAM user

Description

Access keys are long-term credentials for an IAM user or the AWS account 'root' user.You can use access keys to sign programmatic requests to the AWS CLI or AWS API(directly or using the AWS SDK)

Rationale

Access keys are long-term credentials for an IAM user or the AWS account 'root' user.You can use access keys to sign programmatic requests to the AWS CLI or AWS API.One of the best ways to protect your account is to not allow users to have multipleaccess keys.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure access keys are rotated every 90 days or less

Description

Access keys consist of an access key ID and secret access key, which are used to signprogrammatic requests that you make to AWS. AWS users need their own access keysto make programmatic calls to AWS from the AWS Command Line Interface (AWS CLI),Tools for Windows PowerShell, the AWS SDKs, or direct HTTP calls using the APIs forindividual AWS services. It is recommended that all access keys be regularly rotated.

Rationale

Rotating access keys will reduce the window of opportunity for an access key that isassociated with a compromised or terminated account to be used.Access keys should be rotated to ensure that data cannot be accessed with an old key which might have been lost, cracked, or stolen.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure IAM policies that allow full *-* administrative privileges are not attached

Description

IAM policies are the means by which privileges are granted to users, groups, or roles. Itis recommended and considered a standard security advice to grant least privilege -thatis, granting only the permissions required to perform a task. Determine what users needto do and then craft policies for them that let the users perform only those tasks, insteadof allowing full administrative privileges.

Rationale

It's more secure to start with a minimum set of permissions and grant additionalpermissions as necessary, rather than starting with permissions that are too lenient and then trying to tighten them later.Providing full administrative privileges instead of restricting to the minimum set ofpermissions that the user is required to do exposes the resources to potentiallyunwanted actions.IAM policies that have a statement with Effect: Allow with Action: * overResource: * should be removed.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure a support role has been created to manage incidents with AWS Support

Description

AWS provides a support center that can be used for incident notification and response,as well as technical support and customer services. Create an IAM Role, with theappropriate policy assigned, to allow authorized users to manage incidents with AWSSupport.

Rationale

By implementing least privilege for access control, an IAM Role will require anappropriate IAM Policy to allow Support Center Access in order to manage Incidentswith AWS Support.

Impact

All AWS Support plans include an unlimited number of account and billing supportcases, with no long-term contracts. Support billing calculations are performed on a per-account basis for all plans. Enterprise Support plan customers have the option toinclude multiple enabled accounts in an aggregated monthly billing calculation. Monthlycharges for the Business and Enterprise support plans are based on each month's AWSusage charges, subject to a monthly minimum, billed in advance.When assigning rights, keep in mind that other policies may grant access to Support aswell. This may include AdministratorAccess and other policies including customermanaged policies. Utilizing the AWS managed 'AWSSupportAccess' role is one simpleway of ensuring that this permission is properly granted.To better support the principle of separation of duties, it would be best to only attach thisrole where necessary.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure IAM instance roles are used for AWS resource access from instances

Description

AWS access from within AWS instances can be done by either encoding AWS keys intoAWS API calls or by assigning the instance to a role which has an appropriatepermissions policy for the required access. AWS Access means accessing the APIs ofAWS in order to access AWS resources or manage AWS account resources.

Rationale

AWS IAM roles reduce the risks associated with sharing and rotating credentials thatcan be used outside of AWS itself. If credentials are compromised, they can be usedfrom outside of the AWS account they give access to. In contrast, in order to leveragerole permissions an attacker would need to gain and maintain access to a specificinstance to use the privileges associated with it.Additionally, if credentials are encoded into compiled applications or other hard tochange mechanisms, then they are even more unlikely to be properly rotated due toservice disruption risks. As time goes on, credentials that cannot be rotated are morelikely to be known by an increasing number of individuals who no longer work for theorganization owning the credentials.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure that all the expired SSL-TLS certificates stored in AWS IAM are removed

Description

To enable HTTPS connections to your website or application in AWS, you need anSSL/TLS server certificate. You can use ACM or IAM to store and deploy servercertificates. Use IAM as a certificate manager only when you must support HTTPSconnections in a region that is not supported by ACM. IAM securely encrypts yourprivate keys and stores the encrypted version in IAM SSL certificate storage. IAMsupports deploying server certificates in all regions, but you must obtain your certificatefrom an external provider for use with AWS. You cannot upload an ACM certificate toIAM. Additionally, you cannot manage your certificates from the IAM Console.

Rationale

Removing expired SSL/TLS certificates eliminates the risk that an invalid certificate willbe deployed accidentally to a resource such as AWS Elastic Load Balancer (ELB),which can damage the credibility of the application/website behind the ELB. As a bestpractice, it is recommended to delete expired certificates.

Impact

Deleting the certificate could have implications for your application if you are using anexpired server certificate with Elastic Load Balancing, CloudFront, etc. One has to makeconfigurations at respective services to ensure there is no interruption in applicationfunctionality.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure access to AWSCloudShellFullAccess is restricted

Description

AWS CloudShell is a convenient way of running CLI commands against AWS services;a managed IAM policy ('AWSCloudShellFullAccess') provides full access to CloudShell,which allows file upload and download capability between a user's local system and theCloudShell environment. Within the CloudShell environment a user has sudopermissions, and can access the internet. So it is feasible to install file transfer software(for example) and move data from CloudShell to external internet servers.

Rationale

Access to this policy should be restricted as it presents a potential channel for dataexfiltration by malicious cloud admins that are given full permissions to the service.AWS documentation describes how to create a more restrictive IAM policy which deniesfile transfer permissions.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure credentials unused for 45 days or greater are disabled

Description

AWS IAM users can access AWS resources using different types of credentials, suchas passwords or access keys. It is recommended that all credentials that have beenunused in 45 or greater days be deactivated or removed.

Rationale

Disabling or removing unnecessary credentials will reduce the window of opportunity forcredentials associated with a compromised or abandoned account to be used.

Impact

Recommendation and Steps

From Console:
Perform the following to manage Unused Password (IAM user console access)
1. Login to the AWS Management Console:
2. Click Services
3. Click IAM
4. Click on Users
5. Click on Security Credentials
6. Select user whose Console last sign-in is greater than 45 days
7. Click Security credentials
8. In section Sign-in credentials, Console password click Manage
9. Under Console Access select Disable
10.Click Apply
Perform the following to deactivate Access Keys:
1. Login to the AWS Management Console:
2. Click Services
3. Click IAM
4. Click on Users
5. Click on Security Credentials
6. Select any access keys that are over 45 days old and that have been used and
Page 42
-Click on Make Inactive
7. Select any access keys that are over 45 days old and that have not been used
and
-Click the X to Delete

Associated Items

Affected Objects

TEST NAME

Ensure S3 Bucket Policy is set to deny HTTP requests

Description

At the Amazon S3 bucket level, you can configure permissions through a bucket policymaking the objects accessible only through HTTPS.

Rationale

By default, Amazon S3 allows both HTTP and HTTPS requests. To achieve onlyallowing access to Amazon S3 objects through HTTPS you also have to explicitly denyaccess to HTTP requests. Bucket policies that allow HTTPS requests without explicitlydenying HTTP requests will not comply with this recommendation.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure MFA Delete is enabled on S3 buckets

Description

Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires theuser to have two forms of authentication.

Rationale

Adding MFA delete to an S3 bucket, requires additional authentication when youchange the version state of your bucket or you delete and object version adding anotherlayer of security in the event your security credentials are compromised or unauthorizedaccess is granted.

Impact

Enabling MFA delete on an S3 bucket could required additional administrator oversight.Enabling MFA delete may impact other services that automate the creation and/ordeletion of S3 buckets.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure all data in Amazon S3 has been discovered- classified and secured when required

Description

Amazon S3 buckets can contain sensitive data, that for security purposes should bediscovered, monitored, classified and protected. Macie along with other 3rd party toolscan automatically provide an inventory of Amazon S3 buckets.

Rationale

Using a Cloud service or 3rd Party software to continuously monitor and automate theprocess of data discovery and classification for S3 buckets using machine learning andpattern matching is a strong defense in protecting that information.Amazon Macie is a fully managed data security and data privacy service that usesmachine learning and pattern matching to discover and protect your sensitive data inAWS.

Impact

There is a cost associated with using Amazon Macie. There is also typically a costassociated with 3rd Party tools that perform similar processes and protection.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure that S3 Buckets are configured with Block public access (bucket settings)

Description

Amazon S3 provides Block public access (bucket settings) and Block publicaccess (account settings) to help you manage public access to Amazon S3resources. By default, S3 buckets and objects are created with public access disabled.However, an IAM principal with sufficient S3 permissions can enable public access atthe bucket and/or object level. While enabled, Block public access (bucket settings)prevents an individual bucket, and its contained objects, from becoming publiclyaccessible. Similarly, Block public access (account settings) prevents all buckets,and contained objects, from becoming publicly accessible across the entire account.

Rationale

Amazon S3 Block public access (bucket settings) prevents the accidental ormalicious public exposure of data contained within the respective bucket(s).Amazon S3 Block public access (account settings) prevents the accidental ormalicious public exposure of data contained within all buckets of the respective AWSaccount.Whether blocking public access to all or some buckets is an organizational decision thatshould be based on data sensitivity, least privilege, and use case.

Impact

When you apply Block Public Access settings to an account, the settings apply to allAWS Regions globally. The settings might not take effect in all Regions immediately orsimultaneously, but they eventually propagate to all Regions.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Amazon Simple Storage Service

Description

Amazon Simple Storage Service (Amazon S3) is an object storage service that provides
industry-leading scalability, data availability, security, and performance. It allows
customers of all sizes and industries to store and protect any amount of data for virtually
any use case, including data lakes, cloud-native applications, and mobile apps. With
cost-effective storage classes and intuitive management features, you can optimize
costs, organize data, and configure precise access controls to meet your specific
business, organizational, and compliance requirements.

Rationale

By utilizing S3, businesses of all sizes can efficiently store and protect large amounts of
data, ensuring it is accessible when needed. The service's cost-effective storage
classes and user-friendly management features help optimize costs and streamline data
organization. Additionally, S3's fine-tuned access controls allow organizations to meet
specific business, organizational, and compliance requirements, enhancing overall data
management and security.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure direct data addition to S3

Description

Your bucket name must be unique and not already in use on AWS. Click on your bucket
name, and in the right corner, you will find an option to upload data directly to your S3
bucket. You can choose the file option to upload individual files, images, or even entire
folders.

Rationale

Accessing the upload option within your bucket simplifies the process of adding data,
making it easy to manage and organize your files. This streamlined approach allows for
efficient data storage, retrieval, and management within the AWS S3 environment,
enhancing overall operational efficiency.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Storage Classes are Configured

Description

Amazon S3 offers various storage classes to optimize cost and performance based on
data access patterns and retention needs. Standard Storage is for frequently accessed
data, while Standard-IA and One Zone-IA are for infrequent access, with the latter
offering cost savings by storing in a single Availability Zone. Intelligent-Tiering
automatically moves data between access tiers based on usage, and Glacier and
Glacier Deep Archive provide low-cost options for long-term archival storage with
varying retrieval times. Each class balances availability, durability, performance, and
cost, enabling a tailored storage strategy to meet specific requirements.

Rationale

This approach ensures frequently accessed data is readily available, while infrequently
accessed data is stored cost-effectively, balancing availability, durability, and cost.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure EBS Volume Encryption is Enabled in all Regions

Description

Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic BlockStore (EBS) service. While disabled by default, forcing encryption at EBS volumecreation is supported.

Rationale

Encrypting data at rest reduces the likelihood that it is unintentionally exposed and cannullify the impact of disclosure if the encryption remains unbroken.

Impact

Losing access or removing the KMS key in use by the EBS volumes will result in nolonger being able to access the volumes.

Recommendation and Steps

From Console:
1. Login to AWS Management Console and open the Amazon EC2 console using
https://console.aws.amazon.com/ec2/
2. Under Account attributes, click EBS encryption.
3. Click Manage.
4. Click the Enable checkbox.
5. Click Update EBS encryption
6. Repeat for every region requiring the change.
Note: EBS volume encryption is configured per region.
From Command Line:
1. Run
aws --region  ec2 enable-ebs-encryption-by-default
2. Verify that EbsEncryptionByDefault: true is displayed.
3. Repeat every region requiring the change.
Note: EBS volume encryption is configured per region.

Associated Items

Affected Objects

TEST NAME

Ensure Implementation of EFS

Description

AWS EFS is a fully managed storage service that enables rapid file system deployment
without the need for configuration, patching, or maintenance.

Rationale

The rationale behind using AWS EFS is to simplify and expedite the deployment of file
systems, eliminating the need for manual configuration, patching, and maintenance.
This allows you to focus on other critical aspects of your operations while benefiting
from a reliable, scalable, and fully managed storage solution.

Impact

Not using AWS EFS can lead to increased complexity and time-consuming manual
management for configuration, patching, and maintenance. This raises the risk of
human error, system downtime, and data loss, while also making it more challenging to
scale your file systems efficiently.

Recommendation and Steps

Remediate the issues of manual file system management, follow these steps to
create and use Amazon EFS:
1.
Open the Amazon EFS Console: Sign in to the AWS Management Console and
navigate to the Amazon EFS service.
2.
Create a New File System: Click on Create file system to start the setup
process.
3.
Configure Settings: Select your desired VPC, availability zones, throughput
mode, and any additional settings like lifecycle management.
4.
Set Up Access Points: Configure access points to control permissions and
simplify access management.
5.
Review and Create: Verify your settings and click Create to finalize the file
system setup.
6.
Mount the File System: Use the provided mount targets and instructions to
attach the file system to your EC2 instances or other resources.

Associated Items

Affected Objects

TEST NAME

Ensure EFS and VPC Integration

Description

You can use EFS as a network file system across availability zones on a virtual private
cloud. This capability allows the organization to create a highly available file sharing
solution. Leveraging AWS VPC and EC2 in tandem with AWS EFS makes for a highly
available and scalable cloud file storage solution.

Rationale

Redundancy and scalability are crucial for maintaining uninterrupted services. By
integrating these AWS services, users can harness the full power of AWS, ensuring a
resilient and scalable infrastructure.

Impact

Not integrating AWS services for redundancy and scalability can lead to service
disruptions and increased downtime. This approach also limits your ability to efficiently
handle growing workloads, negatively impacting performance and user experience.

Recommendation and Steps

Create an EC2 instance in each availability zone within your VPC.

Associated Items

Affected Objects

TEST NAME

Ensure controlling Network access to EFS Services

Description

It's important that you secure access to your resources on your AWS VPC network.
There are several ways to ensure that you control what traffic is accessing your
resources. Some of which include tightening down network layer security using a
Security Group and a NACL within the VPC console. You can also tighten down
Security Groups within your EC2 console and by using AWS IAM. Maintaining network
security is a high priority to ensure that no unauthorized users can access the data
stored on your EFS service.

Rationale

Maintaining network security is a best practice essential for keeping your data safe and
secure.

Impact

Failing to maintain network security can lead to significant vulnerabilities, exposing your
data to unauthorized access, breaches, and potential data loss. This can result in
severe financial, operational, and reputational damage to your organization.

Recommendation and Steps

Implement network security access controls.

Associated Items

Affected Objects

TEST NAME

Ensure File-Level Access Control with Mount Targets

Description

Mount targets act as gateways, enabling resources to be accessed across different
availability zones within a VPC. When you create an EFS file system, mount targets are
automatically provisioned in each availability zone associated with the VPC. This
ensures high availability and redundancy, allowing seamless and efficient access to the
EFS file system from any availability zone.

Rationale

Using mount targets ensures seamless access to the EFS file system across different
availability zones within a VPC. This automatic provisioning of mount targets in each
availability zone provides high availability and redundancy, essential for maintaining
uninterrupted data access. It simplifies configuration and enhances the resilience and
scalability of the file system architecture.

Impact

Not using mount targets can lead to inefficient and unreliable access to the EFS file
system across availability zones. This lack of automatic provisioning reduces high
availability and redundancy, increasing the risk of service interruptions and data access
issues. Consequently, your infrastructure may suffer from decreased performance,
higher latency, and potential data loss or downtime.

Recommendation and Steps

Control access by modifying mount targets in each availability zone.

Associated Items

Affected Objects

TEST NAME

Ensure managing mount target security groups

Description

Managing security groups for mount targets is essential for controlling access to your
Amazon EFS file systems. By configuring these security groups, you ensure that only
authorized network traffic can access your file systems, enhancing security. Regular
reviews and updates of security group rules maintain strict access control, protecting
your data from unauthorized access and potential breaches.

Rationale

The rationale for managing security groups for mount targets is to ensure robust access
control and security for your Amazon EFS file systems. By configuring these security
groups, you restrict access to only authorized network traffic, thereby minimizing the risk
of unauthorized access and potential data breaches. Regularly reviewing and updating
these rules helps maintain strong security measures and compliance with organizational
policies and industry standards.

Impact

Not managing security groups for mount targets can lead to significant vulnerabilities,
exposing your Amazon EFS file systems to unauthorized access and potential
breaches. This lack of control increases the risk of malicious attacks, data theft, and
data corruption. Consequently, your organization may face severe financial losses,
operational disruptions, and damage to its reputation.

Recommendation and Steps

Managing security groups for mount targets is essential for controlling access to your
Amazon EFS file systems. By configuring these security groups, you ensure that only
authorized network traffic can access your file systems, enhancing security. Regular
reviews and updates of security group rules maintain strict access control, protecting
your data from unauthorized access and potential breaches.

The rationale for managing security groups for mount targets is to ensure robust access
control and security for your Amazon EFS file systems. By configuring these security
groups, you restrict access to only authorized network traffic, thereby minimizing the risk
of unauthorized access and potential data breaches. Regularly reviewing and updating
these rules helps maintain strong security measures and compliance with organizational
policies and industry standards.

Associated Items

Affected Objects

TEST NAME

Ensure using VPC endpoints - EFS

Description

With AWS PrivateLink, VPC Endpoints allow services to communicate within AWS
using private IP addresses within approved CIDR ranges. This communication can be
achieved without the need for a VPN, ensuring secure and efficient data transfer.

Rationale

The rationale behind using AWS PrivateLink with VPC Endpoints is to enable secure
and efficient communication between services within AWS. By using private IP
addresses within approved CIDR ranges, it eliminates the need for a VPN, reducing
complexity and potential points of failure. This approach enhances security, reduces
latency, and ensures data remains within the AWS network, aligning with best practices
for secure and reliable cloud architecture.

Impact

Not using AWS PrivateLink with VPC Endpoints can lead to several issues, including
increased security risks and potential data exposure since services would need to
communicate over the public internet or through more complex VPN setups. This can
result in higher latency, reduced performance, and greater vulnerability to attacks.
Additionally, managing VPN connections adds complexity and potential points of failure,
compromising the overall efficiency and reliability of your network architecture.

Recommendation and Steps

Use VPC Endpoints in tandem with AWS Private Link to secure your EFS connections.

Associated Items

Affected Objects

TEST NAME

Ensure managing AWS EFS access points

Description

EFS access points serve as gateways to your EFS file system, allowing applications to
interact with the file system across various resources. Proper configuration of these
access points within your applications is crucial to ensure seamless and secure access.
By configuring EFS access points, you can control and manage which users have
access to specific resources in your EFS environment, enhancing security and
operational efficiency.

Rationale

The rationale behind properly configuring EFS access points is to ensure secure and
efficient interaction between your applications and the EFS file system. By setting up
these access points correctly, you can control and manage user permissions, ensuring
that only authorized users can access specific resources. This not only enhances the
security of your data but also improves operational efficiency by preventing
unauthorized access and potential data breaches.

Impact

Recommendation and Steps

Implement AWS EFS access points

Associated Items

Affected Objects

TEST NAME

Ensure accessing Points and IAM Policies

Description

You can use IAM policies to control access to your EFS access points. To achieve this,
utilize the elasticfilesystem:AccessPointArn IAM condition key. The
AccessPointArn represents the Amazon Resource Name (ARN) of the access point
that the file system is mounted with.

Rationale

The rationale for using IAM policies with the elasticfilesystem:AccessPointArn
condition key is to ensure precise and secure access control to EFS access points. By
specifying the access point's ARN, you can restrict interactions to authorized users and
resources only, thereby enhancing data security and preventing unauthorized access.
This approach maintains the integrity and confidentiality of your data within the AWS
environment.

Impact

Recommendation and Steps

You can use IAM policies to control access to your EFS access points. To achieve this,
utilize the elasticfilesystem:AccessPointArn IAM condition key. The
AccessPointArn represents the Amazon Resource Name (ARN) of the access point
that the file system is mounted with.

The rationale for using IAM policies with the elasticfilesystem:AccessPointArn
condition key is to ensure precise and secure access control to EFS access points. By
specifying the access point's ARN, you can restrict interactions to authorized users and
resources only, thereby enhancing data security and preventing unauthorized access.
This approach maintains the integrity and confidentiality of your data within the AWS
environment.

Associated Items

Affected Objects

TEST NAME

Ensure configuring IAM for AWS Elastic Disaster Recovery

Description

Before installing the AWS Elastic Disaster Recovery client, you need to configure AWS
IAM permissions and users for both the AWS Replication and AWS Failback Client.

Rationale

Configuring AWS IAM permissions and users before installing the AWS Elastic Disaster
Recovery client ensures that the AWS Replication and AWS Failback Client have the
necessary access rights. This setup is essential for maintaining security and preventing
unauthorized access. Proper IAM configuration guarantees the smooth operation of
disaster recovery processes, safeguarding your data and ensuring system reliability.

Impact

Recommendation and Steps

Configure IAM Credentials for AWS Elastic Disaster Recovery.

Associated Items

Affected Objects

TEST NAME

Ensure that encryption is enabled for EFS file systems

Description

EFS data should be encrypted at rest using AWS KMS (Key Management Service).

Rationale

Data should be encrypted at rest to reduce the risk of a data breach via direct access tothe storage device.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure using Security Groups for VPC

Description

A security group controls the traffic that is allowed to reach and leave the resources that
it is associated with. For example, after you associate a security group with an EC2
instance, it controls the inbound and outbound traffic for the instance.

Rationale

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Secure Ports

Description

Securing network ports is essential for protecting AWS storage services like Amazon
S3, EFS, and EBS. By configuring security groups and network access control lists
(NACLs) to allow only necessary traffic, you minimize the risk of unauthorized access.
Regular audits and monitoring of port usage ensure that only approved ports and
protocols are operational, enhancing the overall security of your AWS storage
environment.

Rationale

By limiting traffic to only necessary and approved ports and protocols, you reduce the
attack surface and enhance the overall security of your storage environment. Regular
audits and monitoring further ensure that security measures remain effective and up-to-
date, safeguarding your data from emerging threats.

Impact

Not securing network ports in AWS storage services can lead to significant
vulnerabilities, exposing your data to unauthorized access and potential breaches. This
lack of control increases the risk of attacks, such as port scanning and exploitation of
open ports, which can result in data loss, corruption, and theft. Consequently, your
organization may face severe financial losses, operational disruptions, and damage to
its reputation.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure CloudTrail is enabled in all regions

Description

AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service. CloudTrail provides a history of AWS API calls for an account, including API calls made via the ManagementConsole, SDKs, command line tools, and higher-level AWS services (such as CloudFormation).

Rationale

The AWS API call history produced by CloudTrail enables security analysis, resource change tracking, and compliance auditing. Additionally,? ensuring that a multi-regions trail exists will ensure that unexpected activity occurring in otherwise unused regions is detected? ensuring that a multi-regions trail exists will ensure that Global Service Logging is enabled for a trail by default to capture recording of events generated on AWS global services? for a multi-regions trail, ensuring that management events configured for all type of Read/Writes ensures recording of management operations that are performed on all resources in an AWS account

Impact

S3 lifecycle features can be used to manage the accumulation and management of logs over time. See the following AWS resource for more information on these features:1. https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure CloudTrail log file validation is enabled

Description

CloudTrail log file validation creates a digitally signed digest file containing a hash ofeach log that CloudTrail writes to S3. These digest files can be used to determine whether a log file was changed, deleted, or unchanged after CloudTrail delivered the log. It is recommended that file validation be enabled on all CloudTrails.

Rationale

Enabling log file validation will provide additional integrity checking of CloudTrail logs.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure AWS Config is enabled in all regions

Description

AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. Itis recommended AWS Config be enabled in all regions.

Rationale

The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking, and compliance auditing.

Impact

It is recommended AWS Config be enabled in all regions.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket

Description

S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket. An access log record contains details about the request, such as the request type, the resources specified in the request worked, andthe time and date the request was processed. It is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.

Rationale

By enabling S3 bucket logging on target S3 buckets, it is possible to capture all events which may affect objects within any target buckets. Configuring logs to be placed in a separate bucket allows access to log information which can be useful in security and incident response workflows.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure CloudTrail logs are encrypted at rest using KMS CMKs

Description

AWS CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS KeyManagement Service (KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses Hardware Security Modules (HSMs) to protect the security of encryption keys. CloudTrail logs can be configured to leverage server side encryption (SSE) and KMS customer created master keys (CMK)to further protect CloudTrail logs. It is recommended that CloudTrail be configured to use SSE-KMS.

Rationale

Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data as a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure rotation for customer-created symmetric CMKs is enabled

Description

AWS Key Management Service (KMS) allows customers to rotate the backing keywhich is key material stored within the KMS which is tied to the key ID of the customer-created customer master key (CMK). It is the backing key that is used to perform cryptographic operations such as encryption and decryption. Automated key rotation currently retains all prior backing keys so that decryption of encrypted data can take place transparently. It is recommended that CMK key rotation be enabled for symmetric keys. Key rotation can not be enabled for any asymmetric CMK.

Rationale

Rotating encryption keys helps reduce the potential impact of a compromised key as data encrypted with a new key cannot be accessed with a previous key that may have been exposed. Keys should be rotated every year, or upon event that would result in the compromise of that key.

Impact

Creation, management, and storage of CMKs may require additional time from an administrator.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure VPC flow logging is enabled in all VPCs

Description

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet Rejects for VPCs.

Rationale

VPC Flow Logs provide visibility into network traffic that traverses the VPC and can beused to detect anomalous traffic or insight during security workflows.

Impact

By default, CloudWatch Logs will store Logs indefinitely unless a specific retention period is defined for the log group. When choosing the number of days to retain, keep in mind the average days it takes an organization to realize they have been breached is210 days (at the time of this writing). Since additional time is required to research a breach, a minimum 365 day retention policy allows time for detection and research. You may also wish to archive the logs to a cheaper storage service rather than simply deleting them. See the following AWS resource to manage CloudWatch Logs retentionperiods:1. https://docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/SettingLogRetention.html

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure that Object-level logging for write events is enabled for S3 bucket

Description

S3 object-level API operations such as GetObject, DeleteObject, and PutObject arecalled data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.

Rationale

Enabling object-level logging will help you meet data compliance requirements withinyour organization, perform comprehensive security analysis, monitor specific patterns ofuser behavior in your AWS account or take immediate actions on any object-level APIactivity within your S3 Buckets using Amazon CloudWatch Events.

Impact

Enabling logging for these object level events may significantly increase the number of events logged and may incur additional cost.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure that Object-level logging for read events is enabled for S3 bucket

Description

S3 object-level API operations such as GetObject, DeleteObject, and PutObject arecalled data events. By default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.

Rationale

Enabling object-level logging will help you meet data compliance requirements withinyour organization, perform comprehensive security analysis, monitor specific patterns ofuser behavior in your AWS account or take immediate actions on any object-level APIactivity using Amazon CloudWatch Events.

Impact

Enabling logging for these object level events may significantly increase the number of events logged and may incur additional cost.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure AWS Security Hub is enabled

Description

Security Hub collects security data from across AWS accounts, services, and supportedthird-party partner products and helps you analyze your security trends and identify thehighest priority security issues. When you enable Security Hub, it begins to consume,aggregate, organize, and prioritize findings from AWS services that you have enabled,such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can alsoenable integrations with AWS partner security products.

Rationale

AWS Security Hub provides you with a comprehensive view of your security state inAWS and helps you check your environment against security industry standards andbest practices - enabling you to quickly assess the security posture across your AWSaccounts.

Impact

It is recommended AWS Security Hub be enabled in all regions. AWS Security Hubrequires AWS Config to be enabled

Recommendation and Steps

To grant the permissions required to enable Security Hub, attach the Security Hub
managed policy AWSSecurityHubFullAccess to an IAM user, group, or role.
Enabling Security Hub
From Console:
1. Use the credentials of the IAM identity to sign in to the Security Hub console.
2. When you open the Security Hub console for the first time, choose Enable AWS
Security Hub.
3. On the welcome page, Security standards list the security standards that Security
Hub supports.
4. Choose Enable Security Hub.
From Command Line:
1. Run the enable-security-hub command. To enable the default standards, include
--enable-default-standards.
aws securityhub enable-security-hub --enable-default-standards
2. To enable the security hub without the default standards, include --no-enable-
default-standards.
aws securityhub enable-security-hub --no-enable-default-standards

Associated Items

Affected Objects

TEST NAME

Ensure unauthorized API calls are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for unauthorized APIcalls.

Rationale

Monitoring unauthorized API calls will help reduce time to detect malicious activity andcan alert you to a potential security incident.CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.

Impact

This alert may be triggered by normal read-only console activities that attempt toopportunistically gather optional information, but gracefully fail if they don't havepermissions.If an excessive number of alerts are being generated then an organization may wish toconsider adding read access to the limited IAM user permissions simply to quiet thealerts.In some cases doing this may allow the users to actually view some areas of the system- any additional access given should be reviewed for alignment with the original limitedIAM user intent.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure management console sign-in without MFA is monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for console logins thatare not protected by multi-factor authentication (MFA).

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring for single-factor console logins will increase visibility into accounts that arenot protected by MFA. These type of accounts are more susceptible to compromise andunauthorized access.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure usage of root account is monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for 'root' login attemptsto detect the unauthorized use, or attempts to use the root account.

Rationale

Monitoring for 'root' account logins will provide visibility into the use of a fully privilegedaccount and an opportunity to reduce the use of it.Cloud Watch is an AWS native service that allows you to observe and monitorresources and applications. CloudTrail Logs can also be sent to an external Securityinformation and event management (SIEM) environment for monitoring and alerting.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure IAM policy changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established changes made toIdentity and Access Management (IAM) policies.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring changes to IAM policies will help ensure authentication and authorizationcontrols remain intact.

Impact

Monitoring these changes may cause a number of false positives more so in largerenvironments. This alert may need more tuning then others to eliminate some of thoseerroneous alerts

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure CloudTrail configuration changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, where metric filters and alarms can be established.It is recommended that a metric filter and alarm be utilized for detecting changes toCloudTrail's configurations.

Rationale

Monitoring changes to CloudTrail's configuration will help ensure sustained visibility toactivities performed in the AWS account.

Impact

These steps can be performed manually in a company's existing SIEM platform in caseswhere CloudTrail logs are monitored outside of the AWS monitoring tools withinCloudWatch.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure AWS Management Console authentication failures are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for failed consoleauthentication attempts.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring failed console logins may decrease lead time to detect an attempt to bruteforce a credential, which may provide an indicator, such as source IP address, that can be used in other event correlation.

Impact

Monitoring for these failures may create a large number of alerts, more so in largerenvironments.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure disabling or scheduled deletion of customer created CMKs is monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for customer createdCMKs which have changed state to disabled or scheduled deletion.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Data encrypted with disabled or deleted keys will no longer be accessible. Changes inthe state of a CMK should be monitored to make sure the change is intentional.

Impact

Creation, storage, and management of CMK may create additional labor requirementscompared to the use of Provide Managed Keys

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure S3 bucket policy changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for changes to S3 bucketpolicies.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring changes to S3 bucket policies may reduce time to detect and correctpermissive policies on sensitive S3 buckets.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure AWS Config configuration changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms.It is recommended that a metric filter and alarm be established for detecting changes toAWS Config's configurations.

Rationale

Monitoring changes to AWS Config configuration will help ensure sustained visibility ofconfiguration items within the AWS account.CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure security group changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms. Security Groupsare a stateful packet filter that controls ingress and egress traffic within a VPC.It is recommended that a metric filter and alarm be established for detecting changes toSecurity Groups.

Rationale

Monitoring changes to security group will help ensure that resources and services arenot unintentionally exposed.CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.

Impact

This may require additional 'tuning' to eliminate false positive and filter out expectedactivity so anomalies are easier to detect.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Network Access Control Lists (NACL) changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms. NACLs are usedas a stateless packet filter to control ingress and egress traffic for subnets within a VPC.It is recommended that a metric filter and alarm be established for changes made toNACLs.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring changes to NACLs will help ensure that AWS resources and services are notunintentionally exposed.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure changes to network gateways are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms. Networkgateways are required to send/receive traffic to a destination outside of a VPC. It is recommended that a metric filter and alarm be established for changes to networkgateways

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring changes to network gateways will help ensure that all ingress/egress traffictraverses the VPC border via a controlled path

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure route table changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms. Routing tablesare used to route network traffic between subnets and to network gateways. It is recommended that a metric filter and alarm be established for changes to route tables.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring changes to route tables will help ensure that all VPC traffic flows through anexpected path and prevent any accidental or intentional modifications that may lead touncontrolled network traffic. An alarm should be triggered every time an AWS API call isperformed to create, replace, delete, or disassociate a Route Table.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure VPC changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, or an external Security information and event management (SIEM)environment, and establishing corresponding metric filters and alarms. It is possible tohave more than 1 VPC within an account, in addition it is also possible to create a peerconnection between 2 VPCs enabling network traffic to route between VPCs. It is recommended that a metric filter and alarm be established for changes made to VPCs

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.VPCs in AWS are logically isolated virtual networks that can be used to launch AWSresources. Monitoring changes to VPC configuration will help ensure VPC traffic flow isnot getting impacted. Changes to VPCs can impact network accessibility from the publicinternet and additionally impact VPC traffic flow to and from resources launched in theVPC.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure AWS Organizations changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs toCloudWatch Logs, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizationschanges made in the master AWS Account.

Rationale

CloudWatch is an AWS native service that allows you to observe and monitor resourcesand applications. CloudTrail Logs can also be sent to an external Security informationand event management (SIEM) environment for monitoring and alerting.Monitoring AWS Organizations changes can help you prevent any unwanted, accidentalor intentional modifications that may lead to unauthorized access or other securitybreaches. This monitoring technique helps you to ensure that any unexpected changesperformed within your AWS Organizations can be investigated and any unwantedchanges can be rolled back.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure no Network ACLs allow ingress from 0000-0 to remote server administration ports

Description

The Network Access Control List (NACL) function provide stateless filtering of ingressand egress network traffic to AWS resources. It is recommended that no NACL allowsunrestricted ingress access to remote server administration ports, such as SSH to port22 and RDP to port 3389, using either the TDP (6), UDP (17) or ALL (-1) protocols

Rationale

Public access to remote server administration ports, such as 22 and 3389, increasesresource attack surface and unnecessarily raises the risk of resource compromise.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure no security groups allow ingress from 0000-0 to remote server administration ports

Description

Security groups provide stateful filtering of ingress and egress network traffic to AWSresources. It is recommended that no security group allows unrestricted ingress accessto remote server administration ports, such as SSH to port 22 and RDP to port 3389,using either the TDP (6), UDP (17) or ALL (-1) protocols

Rationale

Public access to remote server administration ports, such as 22 and 3389, increasesresource attack surface and unnecessarily raises the risk of resource compromise.

Impact

When updating an existing environment, ensure that administrators have access toremote server administration ports through another mechanism before removing accessby deleting the 0.0.0.0/0 inbound rule.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure the default security group of every VPC restricts all traffic

Description

A VPC comes with a default security group whose initial settings deny all inbound traffic,allow all outbound traffic, and allow all traffic between instances assigned to the securitygroup. If you don't specify a security group when you launch an instance, the instance isautomatically assigned to this default security group. Security groups provide statefulfiltering of ingress/egress network traffic to AWS resources. It is recommended that thedefault security group restrict all traffic.The default VPC in every region should have its default security group updated tocomply. Any newly created VPCs will automatically contain a default security group thatwill need remediation to comply with this recommendation.NOTE: When implementing this recommendation, VPC flow logging is invaluable indetermining the least privilege port access required by systems to work properlybecause it can log all packet acceptances and rejections occurring under the currentsecurity groups. This dramatically reduces the primary barrier to least privilegeengineering - discovering the minimum ports required by systems in the environment.Even if the VPC flow logging recommendation in this benchmark is not adopted as apermanent security measure, it should be used during any period of discovery andengineering for least privileged security groups.

Rationale

Configuring all VPC default security groups to restrict all traffic will encourage leastprivilege security group development and mindful placement of AWS resources intosecurity groups which will in-turn reduce the exposure of those resources.

Impact

Implementing this recommendation in an existing VPC containing operating resourcesrequires extremely careful migration planning as the default security groups are likely tobe enabling many ports that are unknown. Enabling VPC flow logging (of accepts) in anexisting environment that is known to be breach free will reveal the current pattern ofports being used for each instance to communicate successfully

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure routing tables for VPC peering are least access

Description

Once a VPC peering connection is established, routing tables must be updated toestablish any connections between the peered VPCs. These routes can be as specificas desired - even peering a VPC to only a single host on the other side of theconnection.

Rationale

Being highly selective in peering routing tables is a very effective way of minimizing theimpact of breach as resources outside of these routes are inaccessible to the peeredVPC.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure that EC2 Metadata Service only allows IMDSv2

Description

When enabling the Metadata Service on AWS EC2 instances, users have the option ofusing either Instance Metadata Service Version 1 (IMDSv1; a request/responsemethod) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).

Rationale

Instance metadata is data about your instance that you can use to configure or managethe running instance. Instance metadata is divided into categories, for example, hostname, events, and security groups.When enabling the Metadata Service on AWS EC2 instances, users have the option ofusing either Instance Metadata Service Version 1 (IMDSv1; a request/responsemethod) or Instance Metadata Service Version 2 (IMDSv2; a session-oriented method).With IMDSv2, every request is now protected by session authentication. A sessionbegins and ends a series of requests that software running on an EC2 instance uses toaccess the locally-stored EC2 instance metadata and credentials.Allowing Version 1 of the service may open EC2 instances to Server-Side RequestForgery (SSRF) attacks, so Amazon recommends utilizing Version 2 for better instancesecurity.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure no security groups allow ingress from ---0 to remote server administration ports

Description

Security groups provide stateful filtering of ingress and egress network traffic to AWSresources. It is recommended that no security group allows unrestricted ingress accessto remote server administration ports, such as SSH to port 22 and RDP to port 3389.

Rationale

Public access to remote server administration ports, such as 22 and 3389, increasesresource attack surface and unnecessarily raises the risk of resource compromise.

Impact

When updating an existing environment, ensure that administrators have access toremote server administration ports through another mechanism before removing accessby deleting the ::/0 inbound rule

Recommendation and Steps

Perform the following to implement the prescribed state:
1. Login to the AWS Management Console at
https://console.aws.amazon.com/vpc/home
2. In the left pane, click Security Groups
3. For each security group, perform the following:
4. Select the security group
5. Click the Inbound Rules tab
6. Click the Edit inbound rules button
7. Identify the rules to be edited or removed
8. Either A) update the Source field to a range other than ::/0, or, B) Click Delete to
remove the offending inbound rule
9. Click Save rules

Associated Items

Affected Objects

TEST NAME

Ensure Consistent Naming Convention is used for Organizational AMI

Description

The naming convention for AMI (Amazon Machine Images) should be documented and
followed for any AMI's created.

Rationale

The majority of AWS resources can be named and tagged. Most organizations have
already created standardize naming conventions, and have existing rules in effect. They
simply need to extend that for all AWS cloud resources to include Amazon Machine
Images (AMI)

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Images (AMIs) are encrypted

Description

Amazon Machine Images should utilize EBS Encrypted snapshots

Rationale

AMIs backed by EBS snapshots should use EBS encryption. Snapshot volumes can be
encrypted and attached to an AMI.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Only Approved AMIs (Images) are Used

Description

Ensure that all base AMIs utilized are approved for use by your organization.

Rationale

An approved AMI is a base EC2 machine image that is a pre-configured OS configured
to run your application. Using approved AMIs helps enforce consistency and security.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Images (AMI) are not older than 90 days

Description

Ensure that your AMIs are not older than 90 days

Rationale

Using up-to-date AMIs will provide many benefits from OS updates and security patches
helping to ensure reliability, security and compliance.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Images are not Publicly Available

Description

EC2 allows you to make an AMI public, sharing it with all AWS accounts.

Rationale

Publicly sharing an AMI with all AWS accounts could expose organizational data and
configuration information.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Apply updates to any apps running in Lightsail

Description

Amazon Lightsail is a virtual private server (VPS) provider and is the easiest way to get
started with AWS for developers, small businesses, students, and other users who need
a solution to build and host their applications on cloud.

Rationale

Lightsail offers a range of operating system and application templates that are
automatically installed when you create a new Lightsail instance. Application templates
include WordPress, Drupal, Joomla!, Ghost, Magento, Redmine, LAMP, Nginx (LEMP),
MEAN, Node.js, Django, and more. You can install additional software on your
instances by using the in-browser SSH or your own SSH client.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Change default Administrator login names and passwords for applications

Description

Change the default settings for the administrator login names and passwords of the
application software that you install on Lightsail instances.

Rationale

Default administrator login names and passwords for applications used on Lightsail
instances can be used by hackers and individuals to break into your servers.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Disable SSH and RDP ports for Lightsail instances when not needed

Description

Any ports enable within Lightsail by default are open and exposed to the world. For SSH
and RDP access you should remove and disable these ports when not is use.

Rationale

Any ports enable within Lightsail by default are open and exposed to the world. This can
result in outside traffic trying to access or even deny access to the Lightsail instances.
Removing and disabling a protocol when not in use even if restricted by IP address is
the safest solution especially when it is not required for access.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure SSH is restricted to only IP address that should have this access

Description

Any ports enable within Lightsail by default are open and exposed to the world. For SSH
and RDP access you should identify which IP address need access.

Rationale

Any ports enable within Lightsail by default are open and exposed to the world. This can
result in outside traffic trying to access or even deny access to the Lightsail instances.
Removing and adding approved IP address required for access.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure RDP is restricted to only IP address that should have this access

Description

Any ports enable within Lightsail by default are open and exposed to the world. For SSH
and RDP access you should identify which IP address need access.

Rationale

Any ports enable within Lightsail by default are open and exposed to the world. This can
result in outside traffic trying to access or even deny access to the Lightsail instances.
Removing and adding approved IP address required for access.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Disable IPv6 Networking if not in use within your organization

Description

Any protocols enable within Lightsail by default that aren't being used should be
disabled.

Rationale

Any ports enable within Lightsail by default are open and exposed to the world. This can
result in outside traffic trying to access or even deny access to the Lightsail instances.
Removing and disabling a protocol when not in use even if restricted by IP address is
the safest solution especially when it is not required for access.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure you are using an IAM policy to manage access to buckets in Lightsail

Description

The following policy grants a user access to manage a specific bucket in the Amazon
Lightsail object storage service.

Rationale

This policy grants access to buckets through the Lightsail console, the AWS Command
Line Interface (AWS CLI), AWS API, and AWS SDKs.

Impact

Users who don't have this policy will experience errors when viewing the Objects tab of
the bucket management page in the Lightsail console.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure Lightsail instances are attached to the buckets

Description

Attaching an Amazon Lightsail instance to a Lightsail storage bucket gives it full
programmatic access to the bucket and its objects.

Rationale

When you attach instances to buckets, you don't have to manage credentials like
access keys. Resource access is ideal if you're configuring software or a plugin on your
instance to upload files directly to your bucket. For example, if you want to configure a
WordPress instance to store media files on a bucket configuration with bucket storage
resource access allows for that securely.

Impact

You can attach instances that are in a running state only. Additionally, the instances
have to be in the same AWS Region as the bucket or the buckets have to be in the
same region as the instances.

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure that your Lightsail buckets are not publicly accessible

Description

You can make all objects private, public (read-only) or private while making individual
objects public (read-only). By default when creating a bucket the permissions are set to
All objects are private.

Rationale

When the Bucket access permissions are set to All objects are public (read-only) and All
objects in the bucket are readable by anyone on the internet through the URL of the
bucket.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Enable storage bucket access logging

Description

Access logging provides detailed records for the requests that are made to this bucket.
This information can include the request type, the resources that are specified in the
request, and the time and date that the request was processed. Access logs are useful
for many applications.

Rationale

Access log information is useful in security and access audits.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Ensure your Windows Server based lightsail instances are updated with the latest security patches

Description

Windows server based Lightsail instances are still managed by the consumer and any
security updates or patches have to be installed and maintained by the user.

Rationale

Windows Server-based Lightsail instances need to be updated with the latest security
patches so they are not vulnerable to attacks. Be sure your server is configured to
download and install updates.

Impact

Recommendation and Steps

Associated Items

Affected Objects

TEST NAME

Change the auto-generated password for Windows based instances

Description

When you create a Windows Server-based instance, Lightsail randomly generates a
long password that is hard to guess. You use this password uniquely with your new
instance. You can use the default password to connect quickly to your instance using
remote desktop (RDP). You are always logged in as the Administrator on your Lightsail
instance.

Rationale

Like any password it should be changed from the default and over time. The randomly
generated password can be hard to remember and if anyone gains access to your AWS
Lightsail environment they can utilize that to access your instances. For this reason you
should change the password to something you can remember.

Impact

If you change your password from the unique, default password, be sure to use a strong
password. You should avoid passwords that are based on names or dictionary words,
or repeating sequences of characters.

Recommendation and Steps

Associated Items

Affected Objects