AWS self-assessment: 10 questions on security and cost

The questionnaire

Answer from what you know today. "I don't know" counts as the weakest answer: a control nobody checks is not a control.

The score is computed in your browser: no answer is sent or stored.

1. Root account — How is the root account protected?

   • Hardware MFA, no access keys, no day-to-day use
   • Software MFA, or occasional use of the root account
   • No MFA, or I don't know
2. Human access — How do your teams sign in to AWS?

   • IAM Identity Center (SSO), no IAM users
   • IAM users with mandatory MFA
   • IAM users with long-lived access keys and no tracked rotation, or I don't know
3. Detection — Which detection services are enabled in every region you use?

   • Multi-region CloudTrail, GuardDuty and Security Hub (FSBP or CIS)
   • CloudTrail only, or only in some regions
   • I don't know
4. Network exposure — Do you have security groups open to the whole Internet (0.0.0.0/0) on ports other than 80 and 443?

   • No, and an AWS Config or Security Hub rule checks it
   • Probably not, but nothing checks it
   • Yes (SSH, RDP or a database), or I don't know
5. Data and secrets — Where do your S3 buckets, databases and secrets stand?

   • S3 Block Public Access at account level, encryption everywhere, secrets in Secrets Manager or Parameter Store
   • Partial encryption, or some secrets still in environment variables
   • Public buckets possible, secrets in code, or I don't know
6. Resilience — If a database or an Availability Zone went down tomorrow, how would you restore?

   • AWS Backup, Multi-AZ deployment, restore tested in the last 12 months
   • Backups in place, never tested
   • No formal strategy, or I don't know
7. Cost visibility — Do you know who spends what on AWS?

   • Mandatory cost allocation tags, budgets with alerts per team or project
   • Cost Explorer checked now and then, partial tagging
   • We find out when the bill arrives
8. Commitments — Is your steady compute (EC2, Fargate, Lambda, RDS) covered by Savings Plans or Reserved Instances?

   • Yes, coverage tracked and reviewed at least quarterly
   • A few commitments, not tracked
   • No commitments, or I don't know
9. Unused resources — Do you clean up unattached EBS volumes, idle Elastic IPs, old snapshots and non-production environments left running at night?

   • Yes, automated or scheduled cleanup, shutdown outside business hours
   • Manual cleanup, now and then
   • Never, or I don't know
10. Network and data transfer — Do you know what your NAT gateways and data transfer cost?

    • Yes, and S3 and DynamoDB gateway VPC endpoints are in place
    • NAT gateways in place, cost never analysed
    • I don't know

What this self-assessment does not replace

A questionnaire measures what you know about your account, not what it contains. It sees neither the resource forgotten in a little-used region, nor the security group opened for a test two years ago, nor the actual amount of waste. Those findings require reading the account itself: that is what the audit does, read-only, across 10 domains.

Read next

• AWS security checklist

  AWS security best practices checklist: 40 items to secure an AWS account, from the root user, IAM and CloudTrail to GuardDuty, encryption, networking and backups.

• Reduce your AWS bill

  AWS cost optimization checklist: 15 ways to reduce your AWS bill, ranked by savings and effort: rightsizing, Savings Plans, gp3, NAT gateways, unused resources.

• How to audit an AWS account

  Audit an AWS account in 7 steps: scope, read-only access, inventory, CIS v5.0 and FSBP baseline, costs, prioritization. Native tools and options compared.