// Level 3 · Controls
AWS
CIS Amazon Web Services Foundations Benchmark
1.4Critical
Ensure no 'root' user account access key exists
Root keys should not exist; use IAM users.
1.5Critical
Ensure MFA is enabled for the 'root' user account
Protect root with MFA.
1.6High
Ensure hardware MFA is enabled for the 'root' user account
Hardware MFA for root in production.
1.8Medium
Ensure IAM password policy requires minimum length of 14 or greater
Strong password policy.
1.10High
Ensure multi-factor authentication is enabled for all IAM users with console password
MFA for all console users.
1.12Medium
Ensure credentials unused for 45 days or greater are disabled
Reduce credential exposure.
1.14Medium
Ensure access keys are rotated every 90 days or less
Limit blast radius of leaked keys.
1.20High
Ensure that IAM Access analyzer is enabled for all regions
Detect unintended public/cross-account access.
2.1.1High
Ensure S3 Bucket Policy is set to deny HTTP requests
Force HTTPS for S3.
2.1.2High
Ensure MFA Delete is enabled on S3 buckets
Prevent accidental/malicious deletion.
2.1.5Critical
Ensure that S3 Buckets are configured with 'Block public access'
Prevent public S3 exposure by default.
3.1Critical
Ensure CloudTrail is enabled in all regions
Centralised audit log of API calls.
3.2High
Ensure CloudTrail log file validation is enabled
Detect tampering with audit logs.
3.6High
Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
Audit access to the audit log bucket itself.
3.9Medium
Ensure VPC flow logging is enabled in all VPCs
Network-level forensics.
3.10Medium
Ensure that Object-level logging for write events is enabled for S3 bucket
Capture S3 object writes for forensics.
4.1Critical
Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
Block global SSH access.
4.2Critical
Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389
Block global RDP access.
4.3High
Ensure VPC default security group restricts all traffic
Default SG should be a deny-all.
5.1High
Ensure that EBS volume encryption is enabled
Encrypt block storage at rest.