Admin accounts protected with multi-factor authentication: Verifies MFA is enforced on all IAM user accounts with console access.

Root account secured with multi-factor authentication: Confirms the root account has MFA enabled.

Root account not used for day-to-day operations: Checks that no active programmatic credentials exist on the root account.

Cloud access revoked on employee departure: Verifies no active IAM accounts are mapped to former employees.

Shared account use detected and flagged: Ensures every IAM account is linked to exactly one individual.

Programmatic credentials rotated within policy window: Checks that IAM access keys have been rotated within the required timeframe.

Permissions managed through roles, not direct user assignments: Flags any IAM user with policies attached directly rather than through groups or roles.

Non-human access uses dedicated service roles: Confirms service-to-service access is handled through IAM roles, not user accounts.

Account password complexity requirements enforced: Validates that a compliant IAM password policy is configured for the account.

Network firewall attached to every compute instance: Verifies each EC2 instance has at least one security group or network ACL applied.

Instance metadata endpoint hardened against credential theft: Confirms IMDSv1 is disabled, requiring session-based metadata access only.

Public internet access limited to required ports: Checks that security groups and NACLs restrict inbound public traffic to only necessary ports.

Remote shell access blocked from public internet: Verifies SSH is not reachable from public IP ranges on any EC2 instance.

Compute CPU utilization monitored and alarmed: Confirms an alarm is active for CPU utilization on each instance.

Network firewall attached to all container workloads: Verifies every ECS service task and standalone task has a security group or NACL on its network interface.

Container public exposure restricted to required ports: Checks that security groups on container task interfaces don't allow unnecessary public access.

Kubernetes control plane activity logged: Verifies audit logging is enabled on every EKS cluster's control plane.

Kubernetes API server accessible only over private network: Confirms the cluster's public endpoint is disabled, enforcing private-only access.

Kubernetes private endpoint enabled: Verifies private endpoint access is active so internal workloads can reach the API server.

Kubernetes workload roles use least-privilege permissions: Checks that no IAM role associated with a cluster grants wildcard actions or resources.

Kubernetes cluster protected by network firewall: Confirms at least one security group is attached to each EKS cluster.

Object storage encrypted at rest: Verifies server-side encryption is configured on every S3 bucket in scope.

Object version history preserved: Checks that versioning is enabled so objects can be recovered after deletion or overwrite.

Public object storage access blocked: Confirms S3 public access block settings are fully enabled at the bucket level.

Relational database automated backups enabled: Verifies backup retention is configured on every RDS instance.

Relational database not exposed to public internet: Checks security groups don't allow unrestricted public inbound access on database ports.

Relational database performance metrics monitored: Confirms alarms are active for CPU, memory, I/O, and storage on each database instance.

NoSQL tables encrypted at rest: Verifies server-side encryption is enabled on every DynamoDB table.

NoSQL point-in-time recovery enabled: Confirms PITR is active so tables can be restored to any point within the retention window.

Document database encrypted, backed up, and performance-monitored: Checks encryption, backup retention, and alarm coverage across document database clusters.

Traffic distributed through a managed load balancer: Verifies an active load balancer exists for the inventory resource.

HTTP traffic automatically redirected to HTTPS: Confirms the load balancer has a listener rule enforcing HTTPS-only traffic.

Load balancer health, latency, and errors monitored: Checks alarms are configured for unhealthy host count, response time, and error rates.

API activity audit trail active across all regions: Verifies audit logging is enabled and capturing in every region you have active.

Audit log integrity verification enabled: Confirms log file validation is active so tampering can be detected.

Threat detection running across all regions: Verifies the threat detection service is enabled in every active region.

Threat findings routed to a notification channel: Confirms finding publication is configured so alerts are delivered in real time.

Serverless function error rates monitored: Verifies an alarm is configured for error rates on each Lambda function.

Message queue processing delays alarmed: Checks that an alarm is active for message age on SQS queues to catch processing backlogs early.

Logical access security - IAM MFA enforcement, unique account assignment, access revocation on termination, password policy, root account controls.

Access authorization - Role-based permission management, least-privilege service roles, prevention of direct policy attachments.

Network access restrictions - Security group enforcement, public port restrictions, SSH access controls, container network firewall coverage.

Encryption in transit - HTTPS enforcement on load balancers, TLS-only traffic handling.

Detection and prevention of unauthorized access - Threat detection coverage, security group configuration, public access blocks on storage.

System monitoring - Alarm coverage across compute, databases, load balancers, serverless, and messaging services.

Security event evaluation - Threat detection alert routing, audit trail logging across all regions.

Change management audit trail - API activity logging enabled with log integrity validation.

Recovery and availability - Automated database backups, point-in-time recovery for NoSQL, object version preservation for storage.

Access control - MFA enforcement, account uniqueness, access revocation on departure.

Authentication information - Password complexity policy, credential rotation, root account MFA.

Access rights management - Role-based access, least-privilege roles, no direct user policy attachments.

Secure authentication - MFA on all accounts, hardened root account posture.

Capacity management - Performance alarms for compute, database CPU, memory, I/O, and storage utilization.

Logging - API activity audit trail active across all regions with file integrity validation.

Monitoring activities - Threat detection enabled and alerting, alarm coverage across key services.

Network security - Security group and NACL controls, public port restrictions, container network firewall, SSH denial.

Use of cryptography - Encryption at rest for object storage and all database types; HTTPS enforced at the load balancer.

Information backup - Automated backups for relational and document databases, point-in-time recovery for NoSQL, object versioning for storage.

Access control - IAM MFA, unique user identification, access revocation on termination.

Unique user identification - Each IAM account linked to one individual, shared accounts flagged.

Encryption and decryption - Encryption at rest across all storage and database services.

Audit controls - API activity logging across all regions with tamper-evident log integrity checks.

Integrity - Object versioning on storage, point-in-time recovery for databases.

Transmission security - HTTPS enforced on load balancers, TLS-only traffic.