1.1 — Maintain current contact details
Ensure account contact information is current
PASS
1.4 — Ensure no root account access key exists
Root account should not have access keys
FAIL
1.5 — Ensure MFA is enabled for root account
Root account must have MFA enabled
FAIL
1.10 — Ensure MFA enabled for all IAM users with console access
All IAM users with console password should have MFA
FAIL
1.12 — Ensure credentials unused for 45+ days are disabled
Remove or deactivate unused credentials
PASS
1.14 — Ensure access keys are rotated every 90 days
Regular key rotation reduces risk
FAIL
2.1.1 — Ensure S3 buckets are not publicly accessible
S3 buckets should block public access
FAIL
2.1.2 — Ensure S3 bucket policy denies HTTP requests
Enforce encryption in transit for S3
PASS
2.2.1 — Ensure EBS volume encryption is enabled
EBS volumes should be encrypted at rest
FAIL
2.3.1 — Ensure RDS instances are encrypted
RDS database storage should be encrypted
FAIL
3.1 — Ensure CloudTrail is enabled in all regions
CloudTrail provides audit logging
PASS
4.1 — Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
SSH should not be open to the world
FAIL
4.2 — Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389
RDP should not be open to the world
FAIL
4.3 — Ensure default security group restricts all traffic
Default SG should have no inbound/outbound rules
FAIL
5.1 — Ensure no Network ACLs allow unrestricted ingress
NACLs should restrict inbound traffic
PASS