AWS security baseline check
Retest after fixes
Score 31 (F) → 97 (A). Fixed: 14 · still failing: 1 · new: 0.
- fixed ID-02 Every console user has MFA
- fixed ID-04 People get permissions through groups, roles or SSO - not attached to users
- fixed ID-05 Full administrator rights are limited to a break-glass role
- fixed LD-02 GuardDuty threat detection is on
- fixed LD-04 Log groups keep logs for at least a year
- fixed DA-02 No bucket is public
- fixed DA-03 Data is encrypted by default (S3 and EBS)
- fixed NC-01 No SSH, RDP or database port is open to the whole internet
- fixed NC-03 Instances require IMDSv2
- fixed NC-04 Only intended instances have public IP addresses
- fixed SP-01 No secrets in Lambda variables, EC2 user data or launch templates
- fixed SP-02 Secrets Manager secrets rotate automatically
- fixed SP-03 CI/CD logs in with short-lived OIDC credentials, not stored keys
- fixed SP-04 Container images are scanned on push and tags are immutable
- open LD-03 AWS Config records configuration changes
Summary
The account was checked against 25 baseline controls covering identity, logging, data, network and secrets, using read-only access only. It scores 97/100 (grade A). The most urgent finding: AWS Config recorder 123456789012 is disabled (LD-03, medium). Config keeps a history of how each resource was configured - the evidence auditors and investigators ask for. Nothing was changed in the account. Every fix below is code or a command for you to review and apply; a retest scan confirms it.
Top risks
| Severity | Control | What we found | First step |
|---|---|---|---|
| medium | LD-03 AWS Config records configuration changes | AWS Config recorder 123456789012 is disabled. (123456789012) |
module.security_baseline: config_recorder = true |
All controls
Identity and access
The root user can do everything, including closing the account. A stolen root password or key is a total loss.
Passwords get phished and reused. MFA stops most account takeovers.
Long-lived keys leak through laptops, CI logs and git history. Datadog found active keys over a year old at 59% of IAM users.
Permissions attached user by user drift and are never reviewed. Groups, roles and IAM Identity Center keep access auditable.
Every identity with AdministratorAccess is a way to lose the whole account. Most teams need two or three, not ten.
Only matters for IAM users with console access, but auditors and customer questionnaires ask for it.
It flags buckets, roles and keys shared with other accounts or the public - for free.
Logging and detection
Without CloudTrail there is no record of who did what - no investigation, and no basis for a breach report.
GuardDuty spots stolen credentials, crypto-mining and unusual API calls. Costs a few dollars a month for small accounts.
Config keeps a history of how each resource was configured - the evidence auditors and investigators ask for.
Evidence (1)
| Resource | Region | Finding |
|---|---|---|
arn:aws:config:ap-south-1:123456789012:recorder | ap-south-1 | AWS Config recorder 123456789012 is disabled. |
How to fix
module.security_baseline: config_recorder = trueLogs kept for days or weeks are gone when an incident is found months later. One year is the minimum many customers - and India's DPDP Rules - expect for security logs. ('Never expire' passes here; the cost check LOGS-001 flags its price.)
A stolen key used for crypto-mining shows up first on the bill. Budgets with email alerts are free.
Data protection
One account-wide switch stops any bucket from being made public by mistake - the cause of many data leaks.
Public buckets are found by automated scanners within hours.
Default encryption is free and protects disks, snapshots and buckets that get copied or shared by mistake.
An RDS instance reachable from the internet, without backups, is one mistake away from a data leak or permanent loss.
A public EBS or RDS snapshot hands a full copy of the disk or database to anyone.
Network and compute
Open admin and database ports are scanned constantly; one weak password or unpatched service is enough.
Resources launched without a chosen group land in the default one; it should block everything.
IMDSv1 lets an SSRF bug in a web app read the instance's cloud credentials (the Capital One breach). Datadog found IMDSv2 enforced on only 49% of instances.
Every public instance is attack surface (and costs $3.65 a month per IPv4 address). Most belong behind a load balancer.
Secrets and pipelines
Anyone with read-only access - including auditors and many SaaS tools - can read these fields.
A secret that never changes stays valid after every leak.
Keys stored in CI were stolen in the tj-actions, Trivy and Checkmarx incidents. OIDC tokens expire in minutes.
Scanning catches known vulnerabilities before deployment; immutable tags stop a pushed image being silently replaced.
Method and limits
- Read-only access: a cross-account role with the AWS-managed
SecurityAuditandViewOnlyAccesspolicies, a few extra read permissions, and an explicit deny on reading data (S3 objects, database rows, secret values, log events). The account's own CloudTrail records every call. - Engine: Prowler 5.47.0 (open source, Apache-2.0) running 48 curated checks, plus two native checks for spend alerts and CI/CD credentials. Each finding was reviewed by a person before delivery.
- Score: each evaluated control counts by severity (critical 10, high 6, medium 3, low 1). Controls with no matching resources, or that could not be evaluated, are left out of the score and shown as coverage instead.
- Findings reflect the configuration at the time of the scan. A baseline check is not a penetration test and not a guarantee that the account cannot be breached.
- Not evaluated in the simulator (ID-01, ID-07, DA-01): it has no root user, IAM Access Analyzer or account-level S3 settings. A scan of a real account evaluates them.
- Retest after the fix pack. AWS Config (LD-03) is still off: this fictional client chose to add it next quarter.