AWS Detection & Response Best Practices Report

Overview

This report assesses AWS resources against 49 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

GuardDuty Settings

• Amazon GuardDuty is Enabled

GuardDuty Findings

• No Active GuardDuty Findings

GuardDuty Organization Settings

• GuardDuty Security Findings are Aggregated to a Dedicated Account
• GuardDuty Auto-Enroll Accounts in the Organization
• GuardDuty Management is Delegated in the Organization

GuardDuty S3 Protection

• GuardDuty S3 Protection Enabled
• GuardDuty S3 Protection Auto-Enroll Accounts in the Organization

GuardDuty EC2 Malware Protection

• GuardDuty EC2 Malware Protection Enabled

GuardDuty Runtime Protection

• GuardDuty Runtime Protection Enabled

GuardDuty Lambda Protection

• GuardDuty Lambda Protection Enabled

GuardDuty RDS Protection

• GuardDuty RDS Login Events Protection Enabled

Security Hub Settings

• AWS Security Hub is Enabled
• AWS Security Best Practices Monitoring Enabled

Security Hub Findings

• No Active Security Hub Findings

Security Hub Organization Settings

• Security Hub Findings Aggregated to Dedicated Security Account
• Security Hub Finding Cross-Region Aggregation is Configured
• Security Hub Auto-Enroll Accounts in the Organization
• Security Hub Auto-Enable New Controls Configured
• Security Hub Management is Delegated in the Organization

Inspector EC2 Scanning

• Inspector Scanning Enabled for EC2
• EC2 Instances Covered by Inspector Vulnerability Scanning
• No Active Inspector Findings for EC2 Instances

Inspector ECR Scanning

• Inspector Scanning Enabled for ECR
• ECR Repositories Covered by Inspector Vulnerability Scanning
• No active Inspector Findings for ECR Repositories

Inspector Lambda Scanning

• Amazon Inspector Lambda Standard Scanning is Enabled
• Inspector Lambda Code Scanning Enabled
• Lambda Functions Covered by Inspector Vulnerability Scanning
• No active Inspector Findings for Lambda Functions

Macie Settings

• Amazon Macie Enabled

Macie Findings

• Amazon Macie Active Findings

Macie Organization Settings

• Macie Auto-Enroll Accounts in the Organization
• Macie Findings are Aggregated to a Dedicated Account

EventBridge Finding Alert Rules

• Real-Time Alerts Configured for GuardDuty Findings
• Real-Time Alerts Configured for Inspector Findings
• Real-Time Alerts Configured for Macie Findings
• Real-Time Alerts Configured for AWS Security Hub Findings
• Real-Time Alerts Configured for Config Compliance Events
• Real-Time Alerts Configured for IAM Access Analyzer Findings

CloudWatch Metric Filter Alarms

• Ensure a log metric filter and alarm exist for usage of root account
• Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
• Ensure a log metric filter and alarm exist for IAM policy changes

CloudWatch Alarms

• CloudWatch Alarm Action is Configured

CloudWatch Metric Filter Alarms

• Ensure a log metric filter and alarm exist for unauthorized API calls
• Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
• Ensure a log metric filter and alarm exist for CloudTrail configuration changes
• Ensure a log metric filter and alarm exist for AWS Config configuration changes

AWS Config Settings

• AWS Config should be enabled and use the service-linked role for resource recording

Config Recorders

• Config configuration recorder should not fail to deliver logs

The report includes actionable findings and remediation guidance for supported checks.