aws-sec-audit

/aws-sec-audit

Structured security audit of AWS configuration covering IAM, S3, VPC, CloudTrail, and common misconfigurations.

Trigger

Use when you need to:

• Review AWS infrastructure configuration for security gaps
• Audit Terraform, CloudFormation, or CDK templates before deployment
• Prepare for a compliance audit or security review
• Validate that security controls are properly configured after changes
• Investigate whether an AWS environment follows security best practices

Input

One of:

• Live environment: AWS CLI access with read-only permissions (SecurityAudit managed policy or equivalent)
• Infrastructure-as-code: Terraform files (.tf), CloudFormation templates (.yaml/.json), CDK code
• Configuration export: Output from aws iam get-account-authorization-details, Security Hub findings, Prowler reports
• Specific scope: Focus area if not a full audit (e.g., "IAM only", "S3 buckets", "network exposure")

Process

Phase 1: Identity & Access Management

1. Root account security

   • MFA enabled on root (aws iam get-account-summary -- check AccountMFAEnabled)
   • No root access keys (aws iam get-account-summary -- check AccountAccessKeysPresent)
   • Root usage in CloudTrail (should be near zero)

2. IAM policies

   • Scan for "Effect": "Allow", "Action": "*", "Resource": "*" (full admin)
   • Check for inline policies vs managed policies (prefer managed)
   • Identify unused IAM roles and users (aws iam generate-credential-report)
   • Review cross-account trust relationships in role assume-role policies
   • Check for iam:PassRole with wildcard resource (privilege escalation vector)

3. Access keys

   • Age of access keys (>90 days is a finding)
   • Users with multiple active access keys
   • Access keys on root account (should not exist)

4. Password policy

   • Minimum length >= 14 characters
   • Complexity requirements enabled
   • Password reuse prevention (remember >= 24)

Phase 2: Storage Security