Skip to content

AWS configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On AWS, Black Cat runs 27 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the AWS connector needs.

Checks (27)

severity: high S3 Bucket Encryption Disabled fix difficulty: easy #

Enable default server-side encryption on the flagged S3 bucket

  1. Navigate to S3 > Buckets in the AWS Console
  2. Click the bucket name to open it
  3. Select the "Properties" tab
  4. Under "Default encryption", click "Edit"
  5. Select "Server-side encryption with Amazon S3 managed keys (SSE-S3)" or "AWS KMS" for stronger control
  6. Click "Save changes"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.ii GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low S3 Bucket Versioning Disabled fix difficulty: easy #

Enable versioning on the flagged S3 bucket to protect against accidental deletion and overwrites

  1. Navigate to S3 > Buckets in the AWS Console
  2. Click the bucket name to open it
  3. Select the "Properties" tab
  4. Under "Bucket Versioning", click "Edit"
  5. Select "Enable" and click "Save changes"
  6. Optionally configure a lifecycle policy to expire old versions and control storage costs

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low S3 Bucket Logging Disabled fix difficulty: easy #

Enable server access logging on the flagged S3 bucket for audit visibility

  1. Navigate to S3 > Buckets in the AWS Console
  2. Click the bucket name to open it
  3. Select the "Properties" tab
  4. Under "Server access logging", click "Edit"
  5. Select "Enable" and specify a target bucket (and optional prefix) for the log files
  6. Ensure the target bucket grants write access to the logging service principal
  7. Click "Save changes"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical Unrestricted SSH Access fix difficulty: medium #

Restrict inbound SSH (port 22) access in the security group to specific IP ranges

  1. Navigate to EC2 > Security Groups in the AWS Console
  2. Select the security group flagged by this finding
  3. Click "Edit inbound rules"
  4. Locate the rule allowing SSH (port 22) from 0.0.0.0/0 or ::/0
  5. Change the source to a specific CIDR block (e.g. your corporate VPN IP range) or remove the rule entirely
  6. Click "Save rules"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical Unrestricted RDP Access fix difficulty: medium #

Restrict inbound RDP (port 3389) access in the security group to specific IP ranges

  1. Navigate to EC2 > Security Groups in the AWS Console
  2. Select the security group flagged by this finding
  3. Click "Edit inbound rules"
  4. Locate the rule allowing RDP (port 3389) from 0.0.0.0/0 or ::/0
  5. Change the source to a specific CIDR block (e.g. your corporate VPN IP range) or remove the rule entirely
  6. Click "Save rules"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Unrestricted Egress fix difficulty: medium #

Replace the default "all traffic to 0.0.0.0/0" egress rule with specific destinations

  1. Navigate to EC2 > Security Groups in the AWS Console
  2. Open the flagged security group and select "Edit outbound rules"
  3. Remove the "All traffic to 0.0.0.0/0" rule
  4. Add rules only for the services the workload actually needs (e.g. HTTPS to specific CIDR blocks, NAT gateway ranges, or VPC endpoint prefix lists)
  5. Click "Save rules" and verify the workload still functions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Default Security Group Has Rules fix difficulty: medium #

Strip all ingress and egress rules from the default VPC security group

  1. Navigate to EC2 > Security Groups in the AWS Console
  2. Filter for "Group name: default" to list every VPC's default SG
  3. For each flagged default SG, click Edit inbound rules and remove every rule (including the self-reference)
  4. Click Edit outbound rules and remove every rule (including the allow-all to 0.0.0.0/0)
  5. Ensure no workloads are attached to the default SG — create dedicated SGs instead
  6. Save changes and verify the default SG now has zero rules

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium KMS Key Rotation Disabled fix difficulty: easy #

Enable automatic annual key rotation for the flagged KMS customer managed key

  1. Navigate to KMS > Customer managed keys in the AWS Console
  2. Click the key alias or ID to open the key detail page
  3. Select the "Key rotation" tab
  4. Enable "Automatically rotate this KMS key every year"
  5. Click "Save"
  6. Verify that "Key rotation" shows as enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high KMS Key Pending Deletion fix difficulty: medium #

Cancel the scheduled deletion for the KMS key or confirm deletion and re-encrypt dependent resources

  1. Navigate to KMS > Customer managed keys in the AWS Console
  2. Locate the key flagged as "Pending deletion" (shown in the Status column)
  3. Click the key alias or ID to open the key detail page
  4. Click "Cancel key deletion" to restore the key to an active state if it is still needed
  5. If deletion is intentional, identify all resources encrypted with this key using AWS Config or CloudTrail
  6. Re-encrypt those resources with a different active KMS key before the deletion date

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium KMS Key Disabled fix difficulty: easy #

Re-enable the KMS key if it was manually disabled, or wait out transient Creating/Unavailable states before contacting AWS Support

  1. Navigate to KMS > Customer managed keys in the AWS Console
  2. Locate the key flagged with a non-"Enabled" state
  3. If the state is "Disabled" and the key is still required, select "Key actions" > "Enable"
  4. If the key is no longer needed, confirm no resources still reference it and schedule deletion
  5. If the state is "Creating", wait a few minutes for provisioning to finish and rescan
  6. If the state is "Unavailable", check your account's KMS key limits and contact AWS Support if the state persists
  7. Verify the key status returns to "Enabled" or transitions to "PendingDeletion"

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Default VPC In Use fix difficulty: hard #

Delete the default VPC or explicitly prohibit workloads from using it

  1. Verify no EC2 instances, RDS, ELB, or other resources are running in the default VPC
  2. If resources exist, migrate them into a purpose-built VPC with private subnets
  3. Once empty, navigate to VPC > Your VPCs, select the default VPC, and choose "Actions > Delete VPC"
  4. Alternatively, create an SCP denying launches in the default VPC if you cannot delete it

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high GuardDuty Not Enabled fix difficulty: easy #

Enable GuardDuty in every active region to detect IAM abuse and threats

  1. Navigate to GuardDuty in the flagged region
  2. Click "Get started" if GuardDuty has never been enabled
  3. Accept the default findings destination or configure an S3 bucket
  4. Click "Enable GuardDuty"
  5. Consider enabling S3 protection, Kubernetes protection, and malware protection add-ons

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high EC2 IMDSv2 Not Enforced fix difficulty: easy #

Require IMDSv2 on the EC2 instance to prevent SSRF-based credential theft

  1. Navigate to EC2 > Instances in the AWS Console
  2. Select the flagged instance
  3. Choose "Actions" > "Instance settings" > "Modify instance metadata options"
  4. Set "IMDSv2" to "Required"
  5. Click "Update" and verify the instance metadata options now show "Required"
  6. Update any launch templates or Auto Scaling configurations to require IMDSv2 going forward

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium EC2 Instance Has Public IP fix difficulty: hard #

Remove the public IP from the EC2 instance and route traffic through a load balancer or NAT gateway

  1. Review whether the instance actually needs inbound internet exposure
  2. If not, stop the instance, detach the public Elastic IP (if any), and relaunch in a private subnet
  3. For outbound internet access, route through a NAT Gateway or VPC endpoint
  4. For inbound services, place an Application Load Balancer or Network Load Balancer in front
  5. Confirm the instance no longer has a public IP address in the console

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical RDS Publicly Accessible fix difficulty: hard #

Disable Public accessibility on the RDS instance and move it into private subnets

  1. Navigate to RDS > Databases in the AWS Console
  2. Select the flagged DB instance and click "Modify"
  3. Under "Connectivity" > "Additional configuration", set "Public access" to "Not publicly accessible"
  4. Ensure the DB subnet group uses only private subnets
  5. Apply changes immediately or schedule during the next maintenance window
  6. Update any clients that previously connected via the public endpoint to use VPN, bastion, or a Transit Gateway

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high RDS Storage Not Encrypted fix difficulty: hard #

Re-create the RDS instance with storage encryption enabled (cannot be toggled on an existing instance)

  1. Take a snapshot of the unencrypted RDS instance
  2. Copy the snapshot with encryption enabled (select a KMS key)
  3. Restore a new encrypted instance from the encrypted snapshot
  4. Point applications at the new instance endpoint and verify functionality
  5. Retire the old unencrypted instance once the cutover is complete

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium RDS Backup Retention Too Short fix difficulty: easy #

Increase the automated backup retention period to at least 7 days

  1. Navigate to RDS > Databases in the AWS Console
  2. Select the flagged DB instance and click "Modify"
  3. Under "Additional configuration" > "Backup", set "Backup retention period" to 7 or more days
  4. Apply changes immediately or during the next maintenance window
  5. Verify automated snapshots are being taken per the new schedule

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Organization All Features Not Enabled fix difficulty: medium #

Enable All Features in the AWS Organization

  1. Navigate to AWS Organizations in the management account console
  2. Click "Enable all features" if shown in the Organization settings
  3. Review and accept the handshake in each member account
  4. Verify the Organization now shows "All features" mode

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Resource Control Policies Not Used fix difficulty: medium #

Enable Resource Control Policies in the Organization

  1. Navigate to AWS Organizations > Policies
  2. Click "Enable" next to Resource control policies
  3. Create an initial RCP to restrict resource access patterns

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Organization Account Security Alternate Contact Missing fix difficulty: easy #

Add a security alternate contact to the AWS account

  1. Navigate to AWS Account > Alternate contacts in the management account console
  2. Select the affected member account
  3. Add or update the Security alternate contact
  4. Verify the alternate contact is populated with a monitored mailbox

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Organization Account Suspended fix difficulty: easy #

Review and close or reactivate suspended AWS accounts

  1. Navigate to AWS Organizations > Accounts
  2. Identify the SUSPENDED account
  3. If no longer needed, close the account permanently
  4. If needed, contact AWS Support to reactivate

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Security Hub Not Enabled fix difficulty: easy #

Enable AWS Security Hub in the region

  1. Navigate to Security Hub in the target region
  2. Click "Go to Security Hub"
  3. Accept defaults and enable Security Hub
  4. Enable CIS and AWS Foundational standards

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Security Hub No Standards Enabled fix difficulty: easy #

Subscribe to compliance standards in Security Hub

  1. Navigate to Security Hub > Security standards
  2. Enable at least CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices
  3. Wait for initial findings to populate (~24 hours)

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: critical Security Hub Critical Findings Unresolved fix difficulty: hard #

Investigate and remediate critical Security Hub findings within 7 days

  1. Navigate to Security Hub > Findings
  2. Filter by "Severity = CRITICAL" and "Workflow = NEW"
  3. Review each finding and apply the recommended remediation
  4. Mark resolved findings as RESOLVED in workflow status

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Security Hub High Findings Unresolved fix difficulty: medium #

Investigate and remediate high-severity Security Hub findings within 14 days

  1. Navigate to Security Hub > Findings
  2. Filter by "Severity = HIGH" and "Workflow = NEW"
  3. Review each finding and apply the recommended remediation
  4. Mark resolved findings as RESOLVED in workflow status

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Security Hub Auto-Enable Controls Disabled fix difficulty: easy #

Enable automatic control enablement in Security Hub

  1. Navigate to Security Hub > Settings
  2. Enable "Automatically enable new controls"
  3. This ensures newly released controls are active without manual intervention

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Security Hub CIS Standard Not Enabled fix difficulty: easy #

Enable the CIS AWS Foundations Benchmark standard in Security Hub

  1. Navigate to Security Hub > Security standards
  2. Find "CIS AWS Foundations Benchmark" and click "Enable"
  3. Wait for controls to begin evaluating

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More AWS checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial