How to Enforce Safer Security Defaults Across AWS Accounts

Article Details

Defense Focus

Establish secure AWS defaults and use Service Control Policies (SCPs) to prevent risky configurations and changes to security guardrails.

Detection Methods

• Review CloudTrail logs before deploying restrictions to identify functionality currently in use.
• Use AWS Access Advisor data to check service usage across the organization and identify where exceptions may be needed.

Data Sources

• CloudTrail logs
• AWS Access Advisor data

Rule Types

• AWS Service Control Policies (SCPs)

Platforms

• AWS

Defensive Actions

• Enable S3 Block Public Access for existing non-public buckets and at the account level where appropriate; deny changes to these settings with an SCP.
• Prevent EC2 AMI public-access protection from being disabled.
• Disable public sharing of Systems Manager documents in each region and deny changes to that setting.
• Require AWS IAM authentication for Lambda function URLs.
• Use SCPs to prevent resource sharing with external accounts where required.
• Disable S3 ACLs by enforcing Bucket owner enforced ownership controls, and deny changes to those controls.
• Use IAM roles instead of IAM users; prevent creation of IAM users, login profiles, and access keys.
• Require IMDSv2 for EC2 instances and prevent changes that weaken instance metadata protections.
• Restrict network modifications that could create paths to the Internet outside the designated network account.
• Enable EBS encryption by default in every region and prevent the setting from being disabled.
• Restrict production administrator access with network controls, such as an IP-address condition.
• Review existing usage before deploying SCPs, create necessary principal or account exceptions, and combine policies as needed to stay within AWS SCP limits.