AWS Security Checks

AWS Scanners

Cloudsploit includes 100+ AWS security detectors covering IAM, compute, storage, networking, databases, and monitoring. Each detector checks for specific misconfigurations against AWS best practices and CIS benchmarks.

Scanning AWS Account

Start a full AWS scan with all detectors enabled:

bash

1cloudsploit scan aws

To list all AWS-specific detectors:

bash

1cloudsploit detectors --provider aws --list

Identity & Access

IAM Password Policy

IAM_PASSWORD_POLICY

Checks if IAM password policy meets complexity requirements

IAM No Root Access Key

IAM_NO_ROOT_ACCESS_KEY

Ensures root account has no active access keys

IAM Users With Password

IAM_USERS_WITH_PASSWORD

Finds IAM users that have console passwords (should use MFA)

IAM MFA Enabled

IAM_MFA_ENABLED

Verifies MFA is enabled for all IAM users with passwords

IAM UserwithAccessKeysOlderThan90Days

IAM_USER_ACCESS_KEYS_OLDER_THAN_90_DAYS

Access keys should be rotated regularly

IAM Assume Role Policy Allows External Principals

IAM_ASSUME_ROLE_POLICY_ALLOWS_EXTERNAL_PRINCIPALS

Checks for overly permissive trust relationships

Storage

S3 Bucket Public Read

S3_BUCKET_PUBLIC_READ

S3 bucket allows public read access via ACL or policy

S3 Bucket Public Write

S3_BUCKET_PUBLIC_WRITE

S3 bucket allows public write/delete access

S3 Bucket Versioning Disabled

S3_BUCKET_VERSIONING_DISABLED

Versioning not enabled (data recovery risk)

S3 Bucket Encryption Disabled

S3_BUCKET_ENCRYPTION_DISABLED

Server-side encryption not enabled for data at rest

S3 Bucket Logging Disabled

S3_BUCKET_LOGGING_DISABLED

Access logging not configured for audit trail

S3 Bucket Lifecycle Policy Missing

S3_BUCKET_LIFECYCLE_POLICY_MISSING

No lifecycle rules for cost optimization

EBS Volume Unencrypted

EBS_VOLUME_UNENCRYPTED

EBS volume lacks encryption at rest

EFS File System Unencrypted

EFS_FILE_SYSTEM_UNENCRYPTED

EFS file system not encrypted

Compute

EC2 Instance No Public IP

EC2_INSTANCE_NO_PUBLIC_IP

Instance has public IP address (attack surface)

EC2 Instance Detailed Monitoring Disabled

EC2_INSTANCE_DETAILED_MONITORING_DISABLED

CloudWatch detailed monitoring not enabled

EC2 Instance Termination Protection Disabled

EC2_INSTANCE_TERMINATION_PROTECTION_DISABLED

Accidental deletion protection not enabled

EC2 Security Group Open to World

EC2_SECURITY_GROUP_OPEN_TO_WORLD

Security group allows 0.0.0.0/0 on sensitive ports

EC2 Security Group Unrestricted SSH

EC2_SECURITY_GROUP_UNRESTRICTED_SSH

Port 22 open to world (should use bastion)

EC2 Security Group Unrestricted RDP

EC2_SECURITY_GROUP_UNRESTRICTED_RDP

Port 3389 open to world

Lambda Function Public Access

LAMBDA_FUNCTION_PUBLIC_ACCESS

Lambda function policy allows public invoke

Lambda Function Environment Variables Encrypted

LAMBDA_FUNCTION_ENV_VARIABLES_ENCRYPTED

Sensitive env vars not encrypted with KMS

Database

RDS Instance Publicly Accessible

RDS_INSTANCE_PUBLICLY_ACCESSIBLE

RDS database accessible from internet

RDS Instance Storage Encrypted

RDS_INSTANCE_STORAGE_ENCRYPTED

RDS storage encryption not enabled

RDS Instance Backup Retention

RDS_INSTANCE_BACKUP_RETENTION

Automated backups not enabled or retention <7 days

RDS Instance Deletion Protection Disabled

RDS_INSTANCE_DELETION_PROTECTION_DISABLED

Accidental database deletion protection off

ElastiCache Cluster No Public IP

ELASTICACHE_CLUSTER_NO_PUBLIC_IP

Redis/Memcached has public endpoint

DynamoDB Point-in-Time Recovery Disabled

DYNAMODB_PITR_DISABLED

No point-in-time recovery for accidental deletes

Networking

VPC Flow Logs Disabled

VPC_FLOW_LOGS_DISABLED

VPC Flow Logs not enabled for network monitoring

VPC Default Security Group Contains Inbound Rules

VPC_DEFAULT_SECURITY_GROUP_INBOUND_RULES

Default VPC security group allows inbound traffic

VPC Peering Allows External Traffic

VPC_PEERING_ALLOWS_EXTERNAL_TRAFFIC

VPC peering connection accepts traffic from external CIDR

NAT Gateway Check

NAT_GATEWAY_CHECK

Checks NAT Gateway configuration and redundancy

Internet Gateway Attached

INTERNET_GATEWAY_ATTACHED

Checks for unexpected internet-facing resources

Monitoring & Logging

CloudTrail Enabled

CLOUDTRAIL_ENABLED

CloudTrail not enabled for audit logging

CloudTrail Log Validation Enabled

CLOUDTRAIL_LOG_VALIDATION_ENABLED

CloudTrail log file validation disabled

CloudTrail Encrypted

CLOUDTRAIL_ENCRYPTED

CloudTrail logs not encrypted at rest

CloudTrail Multi Region Enabled

CLOUDTRAIL_MULTI_REGION_ENABLED

CloudTrail not enabled in all regions

CloudWatch Log Retention Set

CLOUDWATCH_LOG_RETENTION_SET

CloudWatch log groups have no retention policy

Config Service Enabled

CONFIG_SERVICE_ENABLED

AWS Config not enabled for resource tracking

Security & Encryption

KMS Key Rotation Enabled

KMS_KEY_ROTATION_ENABLED

KMS key automatic rotation not enabled

KMS Key Policy Allows Public Access

KMS_KEY_POLICY_ALLOWS_PUBLIC_ACCESS

KMS key policy grants access to wildcard principal

ACM Certificate Expiration

ACM_CERT_EXPIRATION

SSL/TLS certificate expires within 30 days

ACM Certificate Missing Domains

ACM_CERT_MISSING_DOMAINS

Certificate does not cover all domain variations

Secrets Manager Rotation Disabled

SECRETSMANAGER_ROTATION_DISABLED

Secret rotation not configured for sensitive credentials

WAF WebACL Missing

WAF_WEBACL_MISSING

WebACL not associated with CloudFront/ALB

Suppressing False Positives

Some detectors may trigger on intentional configurations. Suppress specific detector IDs:

bash

1# Suppress multiple detectors
2cloudsploit scan aws --suppress S3_BUCKET_PUBLIC_READ,EC2_SECURITY_GROUP_OPEN_TO_WORLD
3 
4# Use a suppression file (one ID per line)
5cloudsploit scan aws --suppress-file ~/cloudsploit/suppressions.txt
6 
7# Ignore specific resources by ARN
8cloudsploit scan aws --exempt-resources "arn:aws:s3:::public-bucket*,arn:aws:ec2:us-east-1:123456789012:security-group/sg-*"

Next: Azure Scanners