Closed AdrianHu99 closed 5 years ago
Automation
All infrastructure is recorded as code (e.g. Terraform, CloudFormation, Ansible, etc.)
All infrastructure changes are made by an automated tool
Console logins are restricted (perhaps to a handful of admins)
Teams are educated and empowered to make necessary changes with automation
IAM
Any existing directory (e.g. Active Directory) is replicated into AWS and used as the system of record
Root account usage is limited to the tasks that require the root account
Root account has MFA enabled
Root account has no access keys (if possible)
Users have no permissions outside ability to use STS to assume roles (side effect: less console usage!)
MFA is enabled for all human users
MFA required to access privileged roles
Users are trained and given tools to make role assumption seamless and easy
Users have no inline IAM policies
Network Design
Everything is deployed inside a VPC
Flow logs are enabled and monitored
Everything has a security group attached
Any security group that allows access from 0.0.0.0/0 (any host on the Internet) has a detailed description and justification (perhaps using tags)
Encryption
All master keys / key encryption keys are stored with KMS
All KMS keys have the rotation option enabled
All AWS services that store data should use KMS
Data encryption keys are generated using KMS master keys and stored encrypted
Auditing
Configuration analysis is performed at least daily, if not for every change
CloudTrail is enabled for all active regions (or for all regions!)
CloudWatch metrics and alarms are implemented for major violation cases
GuardDuty is enabled
Continuous Integration
All infrastructure changes trigger configuration audits
Critical issues found in CI trigger an immediate response
Use the CI pipeline to create a sign-off process that allows teams to move faster
https://8thlight.com/blog/colin-jones/2019/05/14/aws-security-essentials.html