1. Assessment Phase

  • AWS Data Protection Best Practices Assessment Execution
20 Credits

AWS Data Protection Best Practices Report

Overview

This report assesses AWS resources against 30 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

Macie Settings

  • Amazon Macie Enabled

Macie Findings

  • Amazon Macie Active Findings

Macie Organization Settings

  • Macie Auto-Enroll Accounts in the Organization
  • Macie Findings are Aggregated to a Dedicated Account
  • Macie Management is Delegated in the Organization

Macie S3 Bucket Monitoring

  • Amazon S3 Buckets Are Protected by Macie

S3 Public Access Controls

  • S3 Block Public Access is Enabled (Account-Level)
  • S3 general purpose buckets should block public access

S3 Encryption

  • S3 Bucket Key is Enabled

KMS Keys

  • Ensure that KMS Key Rotation is Enabled
  • KMS Keys Not Pending Deletion

EMR Security Configurations

  • EMR Security Configuration Encryption at Rest Enabled

Secrets Manager Secrets

  • Secrets Manager or Encrypted SSM Parameters Present
  • Secrets Manager Secrets Automatic Rotation is Enabled
  • Secret Resource Policy Configured
  • Secrets Manager Secrets Use Custom KMS Key
  • Secrets Manager Secrets Are Rotated Per Schedule

Systems Manager Automation

  • SSM Parameters Are Encrypted
  • SSM Automation should have CloudWatch logging enabled

Auto Scaling Launch Configurations

  • Auto Scaling Launch Config User Data Has No Sensitive Data

CodeBuild Project Environments

  • CodeBuild Environment Variables Do Not Contain Secrets

CloudFormation Stacks

  • CloudFormation Stack Outputs Do Not Contain Secrets

CloudTrail S3 Log Buckets

  • CloudTrail S3 Bucket Not Publicly Accessible

IAM Policies

  • No IAM Principals with Unrestricted S3 Access
  • No IAM Principals with Unrestricted S3 Read Access
  • No IAM Principals with Access to Get All Secrets

IAM Identity Center Permission Sets

  • No SSO Permission Set with Unrestricted S3 Access
  • No SSO Permission Set with Unrestricted S3 Read Access
  • No SSO Permission Set with Access to Get All Secrets

EC2 User Data

  • EC2 instances user data should not have secrets

The report includes actionable findings and remediation guidance for supported checks.