AWS Security & Operations Checklist

Account Foundation

• Separate AWS account per tenant / environment (AWS Organizations)
• Support plan reviewed — production workloads are not on the Free plan
• Regions in use are documented; unused regions are disabled via SCP
• Billing alerts and a monthly budget with alarm thresholds are configured
• Alternate contacts (billing, operations, security) are set and reachable

Identity & Access Management

• Root password stored in a vault; root has no access keys
• MFA enforced on root and on every IAM / Identity Center user
• Password policy enabled — complexity requirements and expiry (≤ 45 days where policy requires)
• Console access enabled only for accounts that need it
• Access keys stored in a vault, never in code or config files
• No access key is older than 90 days — rotation schedule exists
• Permissions granted via roles and groups, not per-user policies
• Least privilege verified with IAM Access Analyzer — no wildcard admin policies
• Account recovery path documented (security questions / recovery contacts)

Compute (EC2)

• Tiered design — databases live in private subnets / a separate VPC, never beside web tier
• Service quotas (EC2 limits) reviewed against growth plans
• Instance profiles (EC2 roles) defined — no static credentials on instances
• Inbound security-group rules restricted to internal VPC / known sources
• Outbound rules restricted — no default allow-all egress
• Termination protection enabled on production instances
• CloudWatch alarms defined (CPU, status checks, disk, memory via agent)
• SSH keys stored in a vault; unused key pairs deleted
• Launch templates patched and hardened before use
• AMIs come from trusted sources — blocklist / allowlist checked
• AMI sharing permissions reviewed — no unintended public AMIs
• IMDSv2 enforced on all instances (blocks SSRF credential theft)

Storage & Data

• EBS volumes encrypted (account-level default encryption on)
• Snapshots encrypted
• No public snapshots (EBS or RDS)
• Backups encrypted; restore procedure tested, not just assumed
• S3 default encryption enabled on every bucket
• S3 Block Public Access enabled at the account level
• S3 bucket policies reviewed — no wildcard principals
• EFS file system policies reviewed; encryption in transit enforced
• Versioning / Object Lock on buckets that hold backups or logs

Load Balancing (ALB / ELB)

• Target security groups accept traffic only from the ALB
• Deletion protection enabled on the ALB
• TLS terminated with a modern security policy (no legacy ciphers)
• HTTP → HTTPS redirect configured on port 80
• Certificates in ACM; expiry monitored with alarms
• ALB access logs stored in S3

OS Hardening

• OS hardening done — unused services disabled, default ports changed where sensible
• Patch management schedule defined (SSM Patch Manager) and patches current
• Endpoint protection / antivirus installed where required by policy
• SSM Agent used for access — direct SSH minimized or removed

Databases (RDS)

• RDS security groups private — no 0.0.0.0/0, no public accessibility flag
• Storage encryption enabled
• Deletion protection enabled on production instances
• Automated backup schedule defined; retention matches policy
• No public RDS snapshots
• Minor version auto-upgrade decision documented; maintenance window set

Networking & Edge

• DDoS protection in place (Shield; Advanced where the risk justifies it)
• CDN deployed in front of public workloads (CloudFront)
• WAF deployed with managed rule sets and rate limiting (AWS WAF)
• Cutover / failover plan exists — ASG, multi-AZ VPC, ELB, tested runbook
• Origin security groups accept traffic only from WAF / CDN ranges
• VPC Flow Logs enabled on ENIs, shipped to S3 / CloudWatch with alarms
• Administrative access to EC2 only over VPN / SSM — never open to the internet
• Outbound (egress) traffic limited and monitored
• DNS records inventoried — no dangling records pointing at released IPs

SecOps & Monitoring

• CloudTrail enabled in all regions, logs stored in a separate, locked-down S3 bucket
• GuardDuty enabled; findings routed to the on-call channel
• DKIM / SPF / DMARC configured on SES sending domains
• SIEM integration done for all log sources (CloudTrail, ALB, WAF, VPC Flow)
• Periodic penetration tests scheduled and findings tracked to closure
• Periodic infrastructure vulnerability scans (Inspector or equivalent)
• SAST / DAST gates defined in the release pipeline
• Error monitoring with APM — anomaly alerts on 4xx/5xx rate increases
• Compliance rules codified (AWS Config rules / conformance packs)
• Secrets in Secrets Manager / Parameter Store — nothing hardcoded; rotation on

Governance

• Inactive / unused IAM users disabled (review every 90 days)
• Unused SSH public keys deleted
• Access model defined — developers do not hold production console access
• Tagging standard enforced (owner, environment, cost centre)
• Infrastructure managed as code — console changes are the exception and get backported

Encryption & Key Management (KMS)

• Customer-managed KMS keys (CMKs) used instead of AWS-managed keys where policy requires
• Unique key policy per CMK — principals restricted; kms:ViaService conditions for service access
• Separate CMK per application and per environment (dev / QA / staging / prod)
• Separate CMK for the security-logs S3 bucket
• Automatic key rotation enabled on all CMKs
• S3 server-side encryption uses the per-application CMK (not just SSE-S3)
• CloudTrail log files encrypted with a KMS CMK
• Lambda environment variables encrypted at rest with the per-app CMK
• SQS queues use server-side encryption with the per-app CMK
• Redshift / EMR / any other data store that can be made public is encrypted with the per-app CMK

Encryption in Transit (TLS)

• Public endpoints enforce TLS 1.2 minimum — TLS 1.3 preferred
• Perfect Forward Secrecy — ECDHE cipher suites with server order preference on load balancers
• No vulnerable cipher suites (NULL, DES / 3DES, RC4, static RSA) — latest ELB/ALB security policy in use
• SSLv3 and legacy protocols disabled on every load balancer
• Site-to-site IPsec VPN (or Direct Connect with MACsec) between on-premise networks and AWS
• CloudFront viewer protocol policy requires HTTPS (redirect or HTTPS-only)
• No insecure ciphers in CloudFront distributions (modern security policy)
• CloudFront-to-origin connections encrypted — origin protocol policy HTTPS-only

AI-Assisted Operations

• CloudWatch anomaly detection enabled on key metrics instead of static thresholds only
• Alert storms summarized automatically (LLM pipeline) before they reach on-call
• Runbooks retrievable by AI assistants — documented, indexed, current
• AI tooling scoped with least privilege — read-only by default, writes gated by approval
• Cost anomaly detection enabled (AWS Cost Anomaly Detection)