AWS Security Audit Checklist

A comprehensive 60-point checklist covering identity, storage, compute, and network security controls. Use this guide to audit your AWS infrastructure against industry best practices.

IAM & Identity (15 checks)

• ✓Root account has MFA enabled and no access keys
• ✓IAM password policy enforces minimum length, complexity, and rotation
• ✓No IAM users have active access keys older than 90 days
• ✓IAM roles are used instead of long-term credentials for applications
• ✓Cross-account roles enforce external ID conditions
• ✓IAM policies follow least-privilege — no wildcard actions on sensitive resources
• ✓Unused IAM users, roles, and policies are removed or deactivated
• ✓AWS Organizations SCPs are applied to restrict root-level actions
• ✓IAM Access Analyzer is enabled in all active regions
• ✓Service control policies prevent disabling CloudTrail or Config
• ✓Identity Center (SSO) is configured with MFA for human users
• ✓Permission boundaries are set on developer and CI/CD roles
• ✓Access keys for IAM users are rotated every 90 days
• ✓No inline policies attached directly to users — use managed policies
• ✓STS session duration is limited to 1 hour for privileged roles

S3 & Storage (12 checks)

• ✓All S3 buckets block public access at the account level
• ✓No S3 bucket has public read or write ACLs
• ✓S3 bucket policies explicitly deny non-HTTPS requests
• ✓Default encryption (SSE-S3 or SSE-KMS) is enabled on all buckets
• ✓S3 versioning is enabled on production buckets
• ✓S3 access logging is enabled on sensitive buckets
• ✓Lifecycle policies transition old objects to cheaper storage tiers
• ✓S3 Object Lock is enabled for compliance-required buckets
• ✓Cross-region replication is configured for disaster recovery
• ✓S3 bucket policies restrict access to specific VPC endpoints where applicable
• ✓EBS volumes are encrypted by default in all regions
• ✓EFS file systems use encryption at rest

EC2 & Compute (12 checks)

• ✓EC2 instances use IMDSv2 (metadata service v2) only
• ✓Security groups do not allow inbound from 0.0.0.0/0 on sensitive ports (22, 3389, 3306, 5432)
• ✓Unused EC2 security groups are identified and removed
• ✓EC2 instance profiles are used instead of hardcoded credentials
• ✓EBS volumes attached to instances are encrypted
• ✓AMI images are not publicly shared
• ✓Lambda functions run inside a VPC where applicable
• ✓Lambda environment variables do not contain plaintext secrets
• ✓Lambda execution roles follow least-privilege
• ✓ECS task definitions use AWSVPC network mode (not host)
• ✓Auto Scaling groups use the latest approved AMI
• ✓Instance termination protection is enabled on critical instances

VPC & Networking (12 checks)

• ✓VPC flow logs are enabled on all VPCs
• ✓NACLs restrict inbound/outbound traffic appropriately per subnet
• ✓VPC endpoints are used for S3 and DynamoDB access (no internet gateway)
• ✓NAT gateways are deployed in each AZ for high availability
• ✓WAF is enabled on CloudFront distributions and ALBs
• ✓Shield Advanced is enabled for critical public-facing resources
• ✓Network ACLs include deny rules for known-bad IP ranges
• ✓Route tables are audited for unintended public subnets
• ✓Internet-facing load balancers use HTTPS listeners only
• ✓ALB access logs are enabled and shipped to S3
• ✓CloudFront distributions enforce HTTPS and use SNI
• ✓Transit Gateway is used for multi-VPC connectivity (with route table isolation)

Monitoring & Compliance (9 checks)

• ✓CloudTrail is enabled in all regions with multi-region aggregation
• ✓CloudTrail logs are encrypted with SSE-KMS and validated (log file integrity)
• ✓AWS Config is enabled to track resource configuration changes
• ✓GuardDuty is enabled in all regions
• ✓Security Hub is enabled with relevant standards (CIS, PCI, AWS FSBP)
• ✓CloudWatch alarms exist for root activity, console sign-in failures, and billing anomalies
• ✓SNS topics are configured to notify security teams of critical findings
• ✓Backup plans cover all critical resources with cross-region copies
• ✓Resource tagging strategy is in place for cost allocation and ownership tracking