AWS

Composite Recipes
Recipes that include further recipes, often including the individual recipes below.
​Best practices for AWS​
Recipes
​Disable Instance Metadata Service version 1​
​Enable API gateway caching​
​Enable point-in-time recovery for DynamoDB​
​Encrypt Aurora clusters​
​Encrypt CodeBuild projects​
​Encrypt DAX storage at rest​
​Encrypt DocumentDB storage​
​Encrypt EBS snapshots​
​Encrypt EBS volume launch configurations​
​Encrypt EBS volumes​
​Encrypt EFS Volumes in ECS Task Definitions in transit​
​Encrypt ElastiCache Redis at rest​
​Encrypt ElastiCache Redis in transit​
​Encrypt Neptune storage​
​Encrypt RDS clusters​
​Encrypt Redshift storage at rest​
​Ensure AWS CMK rotation is enabled​
​Ensure AWS EFS with encryption for data at rest is enabled​
​Ensure AWS EKS cluster endpoint access is publicly disabled​
​Ensure AWS Elasticsearch domain encryption for data at rest is enabled​
​Ensure AWS Elasticsearch domains have EnforceHTTPS enabled​
​Ensure AWS Elasticsearch has node-to-node encryption enabled​
​Ensure AWS IAM password policy has a minimum of 14 characters​
​Ensure AWS Lambda function is configured for function-level concurrent execution limit​
​Ensure AWS Lambda functions have tracing enabled​
​Ensure AWS RDS database instance is not publicly accessible​
​Ensure AWS S3 object versioning is enabled​
​Ensure Amazon EKS control plane logging enabled for all log types​
​Ensure CloudTrail log file validation is enabled​
​Ensure EC2 is EBS optimized​
​Ensure ECR repositories are encrypted​
​Ensure IAM password policy expires passwords within 90 days or less​
​Ensure IAM password policy prevents password reuse​
​Ensure IAM password policy requires at least one lowercase letter​
​Ensure IAM password policy requires at least one number​
​Ensure IAM password policy requires at least one symbol​
​Ensure IAM password policy requires at least one uppercase letter​
​Ensure Kinesis Stream is securely encrypted​
​Ensure RDS database has IAM authentication enabled​
​Ensure RDS instances have Multi-AZ enabled​
​Ensure VPC subnets do not assign public IP by default​
​Ensure data stored in an S3 bucket is securely encrypted at rest​
​Ensure detailed monitoring for EC2 instances is enabled​
​Ensure enhanced monitoring for Amazon RDS instances is enabled​
​Ensure respective logs of Amazon RDS are enabled​
​Ensure the S3 bucket has access logging enabled​
​Make ECR tags immutable​
​Scan images pushed to ECR​
​Use HTTPS for Cloudfront distribution​
Use a long enough byte length for random resources
Best practices for AWS
Last modified 1mo ago