Protect your AWS account and secure your cloud workloads with these recipes
Root account has full permissions across the entire account. Root account should not have access keys. Also, it certainly shouldn't access any service. Instead, create IAM users with predefined roles.
Addresses: Security
Additional Reading:
Root account should not have access keys. If at all you have that, then the keys should be rotated periodically.
Addresses: Security
Additional Reading:
Certificates should not be tied with root accounts.
Addresses: Security
Certificates tied with root accounts needs rotation.
Addresses: Security
Multifactor Authentication is strongly recommended to be enabled for every account with no exceptions.
Addresses: Security
Additional Reading:
Ensure that your root account password is rotated every few days.
Addresses: Security
Your AWS account should have minimum number of admins
Addresses: Security
Your AWS account has too many admins.
Addresses: Security, Operational Maturity
Any unused IAM user without console access and API access should be removed
Addresses: Security
MFA must be enabled on user accounts. AWS recommends that you configure multi-factor authentication (MFA) to help protect your AWS resources.
Addresses: Security
Additional Reading:
The access keys should rotated periodically.
Addresses: Security
Additional Reading:
The certificates should be rotated periodically.
Addresses: Security
Inactive access keys should be dropped.
Addresses: Security
Users who are infrequent or do not need access to console, their account access should be cleared off.
Addresses: Security
Checks inactivity of any user on a service. Those priviledges should be removed for better security posture.
Addresses: Security
IAM users should not have Inline policies. It is recommended that IAM policies be applied directly to groups and roles but not users.
Addresses: Security
Additional Reading:
Multiple access keys for the same user should be avoided. There should be just 1 access key per user account.
Addresses: Security
Inactive roles should be cleaned up.
Addresses: Security
Roles which have access to services but have not used in past several days should be looked into and cleaned up.
Addresses: Security
Role should not have inline policies attached to them.
Addresses: Security
Empty groups should be cleaned up and should not linger around.
Addresses: Security
Ensures that you rotate your certificate before the set configurable days.
Addresses: Security
Password policy should be complex enough so that users can set passwords which are not easy to guess and crack.
Addresses: Security
Additional Reading:
If you are not yet convinced to sign up with Cloudanix, that's not a problem. We recommend you use a comprehensive checklist which your team can use to perform a manual assessment of your workload.