Checklist · Cloud

AWS account baseline

First-day security settings for a new AWS account, from the root user to central logging.

Owner: Cloud engineerTime: 1 hourISO 27001 A.5.23ISO 27001 A.8.2ISO 27001 A.8.15ISO 27001 A.8.24

0 of 20

Root and identity

Account created inside the organisation, in the right organizational unit.
Root user has a strong unique password, hardware MFA, no access keys, and is used only for tasks that require it.
Root email is a monitored shared mailbox, not a personal one; alternate contacts are set.
People sign in through the identity provider (IAM Identity Center or federation), not IAM users.
No long-lived access keys; workloads use roles. Any exception is listed with an owner and an expiry.
Permission sets follow least privilege; administrator access is limited and time-bound.

Guardrails

Service control policies block disabling logging, leaving the organisation and use of unapproved regions.
Unused regions are disabled or blocked.
S3 Block Public Access is on at the account level.
Default EBS encryption is on in every used region; default VPC removed or locked down.
IMDSv2 is required on new instances.

Logging and detection

CloudTrail records all regions and is delivered to a central, write-protected log account.
Log file validation is on; the log bucket has object lock or equivalent and restricted deletion.
AWS Config records resource changes; GuardDuty and Security Hub are enabled and aggregated.
Alerts for root login, IAM policy changes, security group changes and failed console logins reach the SOC.

Network, data and cost

Security groups have no 0.0.0.0/0 on management ports; administration uses SSM Session Manager.
Databases and storage are private; any public exposure is an approved exception.
Customer-managed KMS keys for sensitive data, with key policies that separate administrators from users.
Budgets and anomaly detection configured; alerts go to the owning team.
Tags for owner, environment and data classification are enforced.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed. ISO references show where a list helps, not that it satisfies a control.

See these as tasks in Cisodium All checklists

Ready to move
beyond legacy GRC?

14-day free trial. No credit card. Cloud or on-premises.

Request demo Talk to sales →