cloudproof — AWS Compliance Audit Report

aws apigateway update-stage --rest-api-id "$API" --stage-name "$STAGE" \
  --patch-operations op=replace,path=/*/*/logging/loglevel,value=INFO

resource "aws_api_gateway_method_settings" "all" {
  rest_api_id = aws_api_gateway_rest_api.this.id
  stage_name  = aws_api_gateway_stage.this.stage_name
  method_path = "*/*"
  settings { logging_level = "INFO" }
}

Adjust the relevant setting in the resource's console page or via its modify/update API.

Adjust the relevant setting in the resource's console page or via its modify/update API.

Adjust the relevant setting in the resource's console page or via its modify/update API.

aws cloudtrail update-trail --name org-multiregion-trail --enable-log-file-validation

resource "aws_cloudtrail" "main" {
  name                       = "org-multiregion-trail"
  enable_log_file_validation = true
  # ...other settings...
}

new cloudtrail.Trail(this, 'OrgTrail', { enableFileValidation: true });

new aws.cloudtrail.Trail("org-multiregion-trail", { enableLogFileValidation: true });

aws cloudtrail create-trail \
  --name org-multiregion-trail \
  --s3-bucket-name my-cloudtrail-logs-bucket \
  --is-multi-region-trail --enable-log-file-validation
aws cloudtrail start-logging --name org-multiregion-trail

resource "aws_cloudtrail" "main" {
  name                          = "org-multiregion-trail"
  s3_bucket_name                = aws_s3_bucket.trail.id
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  include_global_service_events = true
}

resource "aws_s3_bucket" "trail" {
  bucket = "my-cloudtrail-logs-bucket"
}
# NB: attach the CloudTrail bucket policy granting cloudtrail.amazonaws.com PutObject.

new cloudtrail.Trail(this, 'OrgTrail', {
  isMultiRegionTrail: true,
  enableFileValidation: true,
  includeGlobalServiceEvents: true,
});

const bucket = new aws.s3.BucketV2("trail-logs", {});
new aws.cloudtrail.Trail("org-multiregion-trail", {
  s3BucketName:               bucket.id,
  isMultiRegionTrail:         true,
  enableLogFileValidation:    true,
  includeGlobalServiceEvents: true,
});

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-config-changes" \
  --filter-pattern '{ ($.eventName=PutConfigurationRecorder)||($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel) }' \
  --metric-transformations metricName=CIS-config-changes,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-config-changes" \
  --metric-name CIS-config-changes --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-config-changes" {
  name           = "CIS-config-changes"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName=PutConfigurationRecorder)||($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel) }"
  metric_transformation {
    name      = "CIS-config-changes"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-config-changes" {
  alarm_name          = "CIS-config-changes"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-config-changes"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-console-auth-failures" \
  --filter-pattern '{ ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }' \
  --metric-transformations metricName=CIS-console-auth-failures,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-console-auth-failures" \
  --metric-name CIS-console-auth-failures --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-console-auth-failures" {
  name           = "CIS-console-auth-failures"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }"
  metric_transformation {
    name      = "CIS-console-auth-failures"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-console-auth-failures" {
  alarm_name          = "CIS-console-auth-failures"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-console-auth-failures"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-console-signin-no-mfa" \
  --filter-pattern '{ ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") }' \
  --metric-transformations metricName=CIS-console-signin-no-mfa,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-console-signin-no-mfa" \
  --metric-name CIS-console-signin-no-mfa --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-console-signin-no-mfa" {
  name           = "CIS-console-signin-no-mfa"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") }"
  metric_transformation {
    name      = "CIS-console-signin-no-mfa"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-console-signin-no-mfa" {
  alarm_name          = "CIS-console-signin-no-mfa"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-console-signin-no-mfa"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-iam-policy-changes" \
  --filter-pattern '{ ($.eventName=DeleteGroupPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=AttachRolePolicy) }' \
  --metric-transformations metricName=CIS-iam-policy-changes,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-iam-policy-changes" \
  --metric-name CIS-iam-policy-changes --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-iam-policy-changes" {
  name           = "CIS-iam-policy-changes"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName=DeleteGroupPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=AttachRolePolicy) }"
  metric_transformation {
    name      = "CIS-iam-policy-changes"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-iam-policy-changes" {
  alarm_name          = "CIS-iam-policy-changes"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-iam-policy-changes"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-kms-key-deletion" \
  --filter-pattern '{ ($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }' \
  --metric-transformations metricName=CIS-kms-key-deletion,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-kms-key-deletion" \
  --metric-name CIS-kms-key-deletion --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-kms-key-deletion" {
  name           = "CIS-kms-key-deletion"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }"
  metric_transformation {
    name      = "CIS-kms-key-deletion"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-kms-key-deletion" {
  alarm_name          = "CIS-kms-key-deletion"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-kms-key-deletion"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-network-gateway-changes" \
  --filter-pattern '{ ($.eventName=CreateCustomerGateway)||($.eventName=AttachInternetGateway)||($.eventName=DeleteInternetGateway) }' \
  --metric-transformations metricName=CIS-network-gateway-changes,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-network-gateway-changes" \
  --metric-name CIS-network-gateway-changes --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-network-gateway-changes" {
  name           = "CIS-network-gateway-changes"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName=CreateCustomerGateway)||($.eventName=AttachInternetGateway)||($.eventName=DeleteInternetGateway) }"
  metric_transformation {
    name      = "CIS-network-gateway-changes"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-network-gateway-changes" {
  alarm_name          = "CIS-network-gateway-changes"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-network-gateway-changes"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-root-usage" \
  --filter-pattern '{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }' \
  --metric-transformations metricName=CIS-root-usage,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-root-usage" \
  --metric-name CIS-root-usage --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-root-usage" {
  name           = "CIS-root-usage"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }"
  metric_transformation {
    name      = "CIS-root-usage"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-root-usage" {
  alarm_name          = "CIS-root-usage"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-root-usage"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-route-table-changes" \
  --filter-pattern '{ ($.eventName=CreateRoute)||($.eventName=DeleteRoute)||($.eventName=DeleteRouteTable)||($.eventName=ReplaceRoute) }' \
  --metric-transformations metricName=CIS-route-table-changes,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-route-table-changes" \
  --metric-name CIS-route-table-changes --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-route-table-changes" {
  name           = "CIS-route-table-changes"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName=CreateRoute)||($.eventName=DeleteRoute)||($.eventName=DeleteRouteTable)||($.eventName=ReplaceRoute) }"
  metric_transformation {
    name      = "CIS-route-table-changes"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-route-table-changes" {
  alarm_name          = "CIS-route-table-changes"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-route-table-changes"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

LOG_GROUP=<your-cloudtrail-log-group>; TOPIC_ARN=<your-sns-topic-arn>
aws logs put-metric-filter --log-group-name "$LOG_GROUP" \
  --filter-name "CIS-vpc-changes" \
  --filter-pattern '{ ($.eventName=CreateVpc)||($.eventName=DeleteVpc)||($.eventName=ModifyVpcAttribute)||($.eventName=CreateVpcPeeringConnection) }' \
  --metric-transformations metricName=CIS-vpc-changes,metricNamespace=CISBenchmark,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name "CIS-vpc-changes" \
  --metric-name CIS-vpc-changes --namespace CISBenchmark \
  --statistic Sum --period 300 --threshold 1 --evaluation-periods 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --alarm-actions "$TOPIC_ARN"

resource "aws_cloudwatch_log_metric_filter" "CIS-vpc-changes" {
  name           = "CIS-vpc-changes"
  log_group_name = var.cloudtrail_log_group
  pattern        = "{ ($.eventName=CreateVpc)||($.eventName=DeleteVpc)||($.eventName=ModifyVpcAttribute)||($.eventName=CreateVpcPeeringConnection) }"
  metric_transformation {
    name      = "CIS-vpc-changes"
    namespace = "CISBenchmark"
    value     = "1"
  }
}
resource "aws_cloudwatch_metric_alarm" "CIS-vpc-changes" {
  alarm_name          = "CIS-vpc-changes"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "CIS-vpc-changes"
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
  alarm_actions       = [var.sns_topic_arn]
}

Adjust the relevant setting in the resource's console page or via its modify/update API.

# Requires an S3 bucket and an IAM role for Config first.
aws configservice put-configuration-recorder --region "$REGION" \
  --configuration-recorder name=default,roleARN="$CONFIG_ROLE_ARN" \
  --recording-group allSupported=true,includeGlobalResourceTypes=true
aws configservice put-delivery-channel --region "$REGION" \
  --delivery-channel name=default,s3BucketName="$CONFIG_BUCKET"
aws configservice start-configuration-recorder --region "$REGION" --configuration-recorder-name default

resource "aws_config_configuration_recorder" "this" {
  name     = "default"
  role_arn = aws_iam_role.config.arn
  recording_group { all_supported = true, include_global_resource_types = true }
}
resource "aws_config_delivery_channel" "this" {
  name           = "default"
  s3_bucket_name = aws_s3_bucket.config.bucket
  depends_on     = [aws_config_configuration_recorder.this]
}
resource "aws_config_configuration_recorder_status" "this" {
  name       = aws_config_configuration_recorder.this.name
  is_enabled = true
  depends_on = [aws_config_delivery_channel.this]
}

const recorder = new aws.cfg.Recorder("default", { roleArn: configRole.arn,
  recordingGroup: { allSupported: true, includeGlobalResourceTypes: true } });
new aws.cfg.DeliveryChannel("default", { s3BucketName: bucket.bucket }, { dependsOn: recorder });

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

resource "aws_docdb_cluster" "c" { storage_encrypted = true, kms_key_id = aws_kms_key.cmk.arn /* ... */ }

aws dynamodb update-table --table-name "$T" \
  --sse-specification Enabled=true,SSEType=KMS

resource "aws_dynamodb_table" "t" {
  # ...
  server_side_encryption { enabled = true, kms_key_arn = aws_kms_key.cmk.arn }
}

# Strips the default SG rules in every region — but BACKS THEM UP FIRST to
# ./sg-backup/ so you can roll back (see the Rollback section below).
# describe-regions itself needs a region to call into:
mkdir -p sg-backup
for region in $(aws ec2 describe-regions --region us-east-1 --query 'Regions[].RegionName' --output text); do
  sg=$(aws ec2 describe-security-groups --region "$region" \
    --filters Name=group-name,Values=default \
    --query 'SecurityGroups[0].GroupId' --output text)
  # 1) Back up the current rules BEFORE touching anything:
  aws ec2 describe-security-groups --region "$region" --group-ids "$sg" \
    --query 'SecurityGroups[0].{ingress:IpPermissions,egress:IpPermissionsEgress}' \
    --output json > "sg-backup/${region}_${sg}.json"
  # 2) Revoke all rules (skip when already empty):
  ing=$(aws ec2 describe-security-groups --region "$region" --group-ids "$sg" --query 'SecurityGroups[0].IpPermissions' --output json)
  egr=$(aws ec2 describe-security-groups --region "$region" --group-ids "$sg" --query 'SecurityGroups[0].IpPermissionsEgress' --output json)
  [ "$ing" != "[]" ] && aws ec2 revoke-security-group-ingress --region "$region" --group-id "$sg" --ip-permissions "$ing"
  [ "$egr" != "[]" ] && aws ec2 revoke-security-group-egress  --region "$region" --group-id "$sg" --ip-permissions "$egr"
done

# Adopt the default SG and declare no rules (empty ingress/egress):
resource "aws_default_security_group" "default" {
  vpc_id  = aws_vpc.main.id
  ingress = []
  egress  = []
}

// CDK has no default-SG L2; restrict it via a custom resource:
new cr.AwsCustomResource(this, 'LockDefaultSg', {
  onUpdate: {
    service: 'EC2',
    action: 'revokeSecurityGroupIngress',
    parameters: { GroupId: vpc.vpcDefaultSecurityGroup, IpPermissions: [] },
    physicalResourceId: cr.PhysicalResourceId.of('lock-default-sg'),
  },
  policy: cr.AwsCustomResourcePolicy.fromSdkCalls({ resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE }),
});

new aws.ec2.DefaultSecurityGroup("default", {
  vpcId:   vpc.id,
  ingress: [],
  egress:  [],
});

aws ec2 enable-ebs-encryption-by-default --region "$REGION"  # prevent new unencrypted volumes

aws ec2 modify-instance-metadata-options --region "$REGION" \
  --instance-id "$ID" --http-tokens required --http-put-response-hop-limit 1

resource "aws_instance" "this" {
  # ...
  metadata_options { http_tokens = "required", http_endpoint = "enabled" }
}

new aws.ec2.Instance("this", { metadataOptions: { httpTokens: "required" } /* ... */ });

aws ec2 modify-image-attribute --region "$REGION" --image-id "$AMI" \
  --launch-permission '{"Remove":[{"Group":"all"}]}'

aws ec2 modify-snapshot-attribute --region "$REGION" \
  --snapshot-id "$SNAP_ID" --attribute createVolumePermission \
  --operation-type remove --group-names all

# Manage sharing explicitly; do NOT include a public ec2_snapshot share.
# Detect/prevent drift with the aws_ebs_snapshot resource and avoid
# aws_snapshot_create_volume_permission granting account_id = "all".

aws ecr put-image-scanning-configuration --region "$REGION" \
  --repository-name "$REPO" --image-scanning-configuration scanOnPush=true

resource "aws_ecr_repository" "this" {
  name = "my-repo"
  image_scanning_configuration { scan_on_push = true }
}

new aws.ecr.Repository("this", { imageScanningConfiguration: { scanOnPush: true } });

# In the container definition, replace environment with secrets:
# "secrets": [{ "name": "DB_PASSWORD",
#   "valueFrom": "arn:aws:secretsmanager:...:secret:db-password" }]

# Store the secret, then reference it via valueFrom in a new task def revision:
aws secretsmanager create-secret --name db-password --secret-string "$VALUE"

aws efs create-file-system --encrypted --kms-key-id alias/aws/elasticfilesystem

resource "aws_efs_file_system" "fs" {
  encrypted  = true
  kms_key_id = aws_kms_key.cmk.arn  # CMK to satisfy requireCmk
}

aws eks associate-encryption-config --region "$REGION" --cluster-name "$CLUSTER" \
  --encryption-config '[{"resources":["secrets"],"provider":{"keyArn":"'$CMK_ARN'"}}]'

resource "aws_eks_cluster" "this" {
  # ...
  encryption_config {
    resources = ["secrets"]
    provider { key_arn = aws_kms_key.cmk.arn }
  }
}

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

for region in $(aws ec2 describe-regions --region us-east-1 --query 'Regions[].RegionName' --output text); do
  aws guardduty create-detector --region "$region" --enable >/dev/null 2>&1 \
    && echo "enabled in $region" || echo "already enabled in $region"
done

resource "aws_guardduty_detector" "this" {
  enable = true
}

new guardduty.CfnDetector(this, 'Detector', { enable: true });

new aws.guardduty.Detector("this", { enable: true });

# Enforce via policy: deny actions unless MFA is present (attach to users/groups).
# To remove console access entirely for a service user:
aws iam delete-login-profile --user-name "$USER"

# Require MFA with a policy condition:
data "aws_iam_policy_document" "require_mfa" {
  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["*"]
    condition {
      test     = "BoolIfExists"
      variable = "aws:MultiFactorAuthPresent"
      values   = ["false"]
    }
  }
}

aws iam add-user-to-group --user-name "$U" --group-name "$G"
aws iam detach-user-policy --user-name "$U" --policy-arn "$ARN"

aws iam update-account-password-policy \
  --minimum-password-length 14 \
  --require-symbols --require-numbers \
  --require-uppercase-characters --require-lowercase-characters \
  --max-password-age 90 --password-reuse-prevention 24

resource "aws_iam_account_password_policy" "strict" {
  minimum_password_length        = 14
  require_symbols                = true
  require_numbers                = true
  require_uppercase_characters   = true
  require_lowercase_characters   = true
  max_password_age               = 90
  password_reuse_prevention      = 24
}

// No L2 construct; set it via a custom resource:
new cr.AwsCustomResource(this, 'PasswordPolicy', {
  onUpdate: {
    service: 'IAM',
    action: 'updateAccountPasswordPolicy',
    parameters: {
      MinimumPasswordLength: 14, RequireSymbols: true, RequireNumbers: true,
      RequireUppercaseCharacters: true, RequireLowercaseCharacters: true,
      MaxPasswordAge: 90, PasswordReusePrevention: 24,
    },
    physicalResourceId: cr.PhysicalResourceId.of('account-password-policy'),
  },
  policy: cr.AwsCustomResourcePolicy.fromSdkCalls({ resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE }),
});

new aws.iam.AccountPasswordPolicy("strict", {
  minimumPasswordLength:      14,
  requireSymbols:             true,
  requireNumbers:             true,
  requireUppercaseCharacters: true,
  requireLowercaseCharacters: true,
  maxPasswordAge:             90,
  passwordReusePrevention:    24,
});

aws iam update-account-password-policy --password-reuse-prevention 24 \
  --minimum-password-length 14 --require-symbols --require-numbers \
  --require-uppercase-characters --require-lowercase-characters

resource "aws_iam_account_password_policy" "strict" {
  password_reuse_prevention = 24
  minimum_password_length   = 14
  # ...complexity settings...
}

new aws.iam.AccountPasswordPolicy("strict", {
  passwordReusePrevention: 24,
  minimumPasswordLength:   14,
});

# Verify only (root keys are managed in the root console):
aws iam get-account-summary --query 'SummaryMap.AccountAccessKeysPresent'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "iam-root-access-key-check",
  "Source": {"Owner": "AWS", "SourceIdentifier": "IAM_ROOT_ACCESS_KEY_CHECK"}
}'

resource "aws_config_config_rule" "root_access_key" {
  name = "iam-root-access-key-check"
  source {
    owner             = "AWS"
    source_identifier = "IAM_ROOT_ACCESS_KEY_CHECK"
  }
}

new config.ManagedRule(this, 'RootAccessKeyCheck', {
  identifier: config.ManagedRuleIdentifiers.IAM_ROOT_ACCESS_KEY_CHECK,
  configRuleName: 'iam-root-access-key-check',
});

new aws.cfg.Rule("iam-root-access-key-check", {
  source: { owner: "AWS", sourceIdentifier: "IAM_ROOT_ACCESS_KEY_CHECK" },
});

# Verify only (cannot enable root MFA via CLI):
aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'

# Deploy the managed detective rule:
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "root-account-mfa-enabled",
  "Source": {"Owner": "AWS", "SourceIdentifier": "ROOT_ACCOUNT_MFA_ENABLED"}
}'

resource "aws_config_config_rule" "root_mfa" {
  name = "root-account-mfa-enabled"
  source {
    owner             = "AWS"
    source_identifier = "ROOT_ACCOUNT_MFA_ENABLED"
  }
}

new config.ManagedRule(this, 'RootMfaEnabled', {
  identifier: config.ManagedRuleIdentifiers.ROOT_ACCOUNT_MFA_ENABLED,
  configRuleName: 'root-account-mfa-enabled',
});

new aws.cfg.Rule("root-account-mfa-enabled", {
  source: { owner: "AWS", sourceIdentifier: "ROOT_ACCOUNT_MFA_ENABLED" },
});

# Deactivate an unused access key:
aws iam update-access-key --user-name "$USER" --access-key-id "$KEY" --status Inactive
# Remove unused console access:
aws iam delete-login-profile --user-name "$USER"

aws inspector2 enable --region "$REGION" --resource-types EC2 ECR LAMBDA

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

Adjust the relevant setting in the resource's console page or via its modify/update API.

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

Disable public access in the resource settings and restrict its security group / resource policy to known principals.

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

Open the resource's settings and enable encryption (select a customer-managed KMS key to also satisfy requireCmk).

Adjust the relevant setting in the resource's console page or via its modify/update API.

resource "aws_opensearch_domain" "d" { encrypt_at_rest { enabled = true } /* ... */ }

resource "aws_opensearch_domain" "d" { vpc_options { subnet_ids = var.subnets, security_group_ids = var.sgs } }

Adjust the relevant setting in the resource's console page or via its modify/update API.

aws rds modify-db-instance --db-instance-identifier "$DB" --backup-retention-period 7 --apply-immediately

resource "aws_db_instance" "this" { backup_retention_period = 7 /* ... */ }

Adjust the relevant setting in the resource's console page or via its modify/update API.

aws rds modify-db-instance --db-instance-identifier "$DB" --multi-az --apply-immediately

resource "aws_db_instance" "this" { multi_az = true /* ... */ }

# Migrate an existing instance to encrypted via snapshot copy:
aws rds create-db-snapshot --db-instance-identifier "$DB" --db-snapshot-identifier "$DB-snap"
aws rds copy-db-snapshot --source-db-snapshot-identifier "$DB-snap" \
  --target-db-snapshot-identifier "$DB-snap-enc" --kms-key-id alias/aws/rds
aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier "$DB-enc" --db-snapshot-identifier "$DB-snap-enc"

resource "aws_db_instance" "this" {
  # ...
  storage_encrypted = true
  kms_key_id        = aws_kms_key.rds.arn # optional CMK
}

new aws.rds.Instance("this", { storageEncrypted: true /* ... */ });

aws redshift modify-cluster --cluster-identifier "$CLUSTER" --encrypted

resource "aws_redshift_cluster" "this" {
  # ...
  encrypted  = true
  kms_key_id = aws_kms_key.cmk.arn  # optional CMK
}

Disable public access in the resource settings and restrict its security group / resource policy to known principals.

Enable the service from its console page, or via the corresponding enable/create API; prefer org-wide delegated administration.

aws s3control put-public-access-block \
  --account-id "$(aws sts get-caller-identity --query Account --output text)" \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

data "aws_caller_identity" "current" {}

resource "aws_s3_account_public_access_block" "account" {
  account_id              = data.aws_caller_identity.current.account_id
  block_public_acls       = true
  ignore_public_acls      = true
  block_public_policy      = true
  restrict_public_buckets  = true
}

new s3.CfnAccountPublicAccessBlock(this, 'AccountPab', {
  blockPublicAcls: true,
  ignorePublicAcls: true,
  blockPublicPolicy: true,
  restrictPublicBuckets: true,
});

const id = aws.getCallerIdentity({});
new aws.s3.AccountPublicAccessBlock("account", {
  accountId:             id.then(i => i.accountId),
  blockPublicAcls:       true,
  ignorePublicAcls:      true,
  blockPublicPolicy:     true,
  restrictPublicBuckets: true,
});

resource "aws_s3_bucket_logging" "l" { bucket = aws_s3_bucket.b.id, target_bucket = aws_s3_bucket.logs.id, target_prefix = "s3/" }

aws s3api put-bucket-versioning --bucket "$B" --versioning-configuration Status=Enabled

resource "aws_s3_bucket_versioning" "v" { bucket = aws_s3_bucket.b.id, versioning_configuration { status = "Enabled" } }

aws s3api put-bucket-encryption --bucket "$B" \
  --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

resource "aws_s3_bucket_server_side_encryption_configuration" "e" {
  bucket = aws_s3_bucket.b.id
  rule { apply_server_side_encryption_by_default { sse_algorithm = "aws:kms" } }
}

resource "aws_sagemaker_notebook_instance" "n" { direct_internet_access = "Disabled", subnet_id = var.subnet /* ... */ }

for region in $(aws ec2 describe-regions --region us-east-1 --query 'Regions[].RegionName' --output text); do
  aws securityhub enable-security-hub --region "$region" --enable-default-standards 2>/dev/null \
    && echo "enabled in $region" || echo "already enabled in $region"
done

resource "aws_securityhub_account" "this" {}

new aws.securityhub.Account("this", {});

resource "aws_sfn_state_machine" "sm" {
  logging_configuration { level = "ALL", log_destination = "${aws_cloudwatch_log_group.sfn.arn}:*", include_execution_data = true }
}

Disable public access in the resource settings and restrict its security group / resource policy to known principals.

Disable public access in the resource settings and restrict its security group / resource policy to known principals.

aws ec2 create-flow-logs --region "$REGION" \
  --resource-type VPC --resource-ids "$VPC_ID" \
  --traffic-type ALL --log-destination-type s3 \
  --log-destination arn:aws:s3:::my-flow-logs-bucket

resource "aws_flow_log" "this" {
  vpc_id               = aws_vpc.main.id
  traffic_type         = "ALL"
  log_destination      = aws_s3_bucket.flow_logs.arn
  log_destination_type = "s3"
}

vpc.addFlowLog('FlowLog', { destination: ec2.FlowLogDestination.toS3(bucket) });

new aws.ec2.FlowLog("this", {
  vpcId: vpc.id, trafficType: "ALL",
  logDestinationType: "s3", logDestination: bucket.arn,
});