Skip to main content

Checklist

AWS security checklist: 40 points to check on your account

A practical list, grouped by theme, to review the security of an AWS account. Each point can be checked in the console or through the API, with no third-party tool.

Published September 27, 2026 · 2 min read

Account and root user

  • The root user has MFA enabled, preferably a hardware key.
  • The root user has no access keys.
  • The root user is not used for day-to-day tasks.
  • Security, billing and operations contacts are filled in.
  • The root email address is a shared list, not a personal mailbox.
  • Accounts are grouped in AWS Organizations, with SCPs on risky actions.

Identities and access

  • People sign in through federation (IAM Identity Center or an identity provider), not through IAM users.
  • Every IAM user with console access has MFA.
  • The password policy requires 14 characters and forbids reusing the last 24.
  • Credentials unused for 45 days are disabled.
  • Access keys are rotated at least every 90 days, with a single active key per user.
  • No policy grants *:*; permissions go through groups or roles.
  • IAM Access Analyzer is enabled and its findings are handled.

Logging and detection

  • CloudTrail is enabled in all regions, with read and write management events.
  • CloudTrail log file validation is enabled.
  • CloudTrail logs are encrypted with a customer-managed KMS key and stored in a non-public bucket.
  • AWS Config records all resources in all regions.
  • GuardDuty is enabled in every region.
  • Security Hub is enabled, with the FSBP and CIS v3.0 standards.
  • Alarms warn you of root usage, sign-ins without MFA and IAM, network and CloudTrail changes.

Data and encryption

  • S3 Block Public Access is enabled at account level.
  • Bucket policies deny unencrypted HTTP requests.
  • Default EBS encryption is enabled in every region.
  • RDS databases are encrypted and not publicly accessible.
  • Customer-managed KMS keys have automatic rotation enabled.
  • Secrets (passwords, tokens) live in Secrets Manager, with rotation, never in code or in plain-text environment variables.

Networking

  • No security group opens SSH (22) or RDP (3389) to 0.0.0.0/0 or ::/0.
  • The default security group of every VPC blocks all traffic.
  • NACLs do not allow administration ports from the Internet.
  • VPC flow logs are enabled.
  • EC2 instances require IMDSv2.
  • AWS services are reached through VPC endpoints when traffic stays internal.

Exposed applications

  • Public CloudFront distributions, ALBs and API Gateway APIs are protected by AWS WAF.
  • Only recent TLS versions are accepted, with valid certificates.
  • HTTP security headers (HSTS, CSP, X-Content-Type-Options) are in place.
  • Public endpoints are inventoried and tested regularly (DAST scan).

Resilience

  • Critical data is covered by an AWS Backup plan.
  • Production databases are deployed Multi-AZ.
  • A restore has been tested recently, and the time it takes is known.
  • RTO and RPO objectives are defined and consistent with the architecture.

Check these 40 points automatically

Doing this review by hand takes time, and it goes stale quickly. The Silamir audit checks most of these points in read-only mode, across the regions you choose, then ranks the gaps by severity with the affected resources and the fixes to apply.

Ready to audit your AWS account?

Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.

Subscribe on AWS MarketplaceSee how it works