AWS Identity & Access Management Best Practices Report

Overview

This report assesses AWS resources against 53 enabled configuration checks across the areas below. It identifies passed and failed checks, unavailable evidence, and affected resources so you can prioritize configuration changes and investigate operational gaps.

Access Analyzer Settings

• IAM Access Analyzer is Enabled

Access Analyzer Findings

• No Active Access Analyzer Findings

IAM Users and Access Keys

• IAM Access Keys Are Rotated every 90 Days
• No Inline IAM Policies Attached
• Do Not Create Access Keys During Initial Setup for IAM Users with Console Password
• No IAM Users with Administrator Privileges without MFA
• No IAM Users with Two Active Access Keys
• IAM Policies Attached to Roles or Groups Only
• IAM Users in Groups
• IAM Users have Hardware MFA Configured
• MFA for Users with Console Access

IAM CloudShell Access

• Access to AWSCloudShellFullAccess Is Restricted

IAM Password Policy

• IAM Password Policy Expires Passwords within 90 Days or less
• IAM Password Policy Requires Uppercase Characters
• IAM Password Policy Requires Lowercase Characters
• IAM Password Policy Requires Symbols
• IAM Password Policy Requires Numbers
• IAM Password Policy Requires Minimum Length of 14 Characters
• IAM Password Policy Configured to Prevent Password Reuse (24 or Greater)

IAM Policies

• No IAM Principals with access to blocked actions on KMS
• No IAM Principals with Full Administrator Permissions ":"
• No IAM Principals with Sensitive IAM Access
• No IAM Principals with Access to Invoke Any Lambda Function
• No IAM Principals with Unrestricted S3 Access
• No IAM Principals with Unrestricted S3 Read Access
• No IAM Principals with Access to Get All Secrets
• No IAM Principals with all service access or wildcard service access
• No IAM Principal with Unrestricted sts:AssumeRole Permissions

IAM Roles

• No IAM Principals with Unrestricted iam:PassRole Permissions
• Cross-Account IAM Roles use External IDs
• Check if Single Sign-On (SSO) is Used
• IAM Support Role is Created

IAM Root User

• No Access Keys for Root Account
• Hardware MFA for Root Account is Enabled
• Root Account Not Used
• MFA for Root Account is Enabled

IAM Identity Center Permission Sets

• No SSO Permission Set with access to blocked actions on KMS
• No SSO Permission Set with Full Administrator Permissions ":"
• No SSO Permission Set with Unrestricted iam:PassRole Permissions
• No SSO Permission Set with Sensitive IAM Access
• No SSO Permission Set with Access to Invoke Any Lambda Function
• No SSO Permission Set with Unrestricted S3 Access
• No SSO Permission Set with Unrestricted S3 Read Access
• No SSO Permission Set with Access to Get All Secrets
• No SSO Permission Set with all service access or wildcard service access
• No SSO Permission Set with Unrestricted sts:AssumeRole Permissions

Resource Access Manager Shares

• Resource Shares Shared Inside Organization Only

AppSync GraphQL APIs

• AWS AppSync GraphQL APIs should not be authenticated with API keys

Cognito Identity Pools

• Cognito identity pools should not allow unauthenticated identities

Cognito User Pools

• Cognito user pool passwords should require min length 8, lower, upper, number, symbol, and temporary passwords <= 7 days
• MFA should be enabled for Cognito user pools

Bedrock AgentCore Gateways

• Bedrock AgentCore Gateways should require authorization for inbound requests

CloudFormation Stacks

• CloudFormation stacks should have associated service roles

The report includes actionable findings and remediation guidance for supported checks.