Auditing Objectives →

• organizational governance →
• asset configuration →
• logical access controls
• operating systems
• database + application security configurations

basic audit

• Review user permissions in AWS IAM
  • IAM → Users → Security credentials
• Capture audit evidence using AWS IAM Policy Simulator
  • User/Group → Permissions → List of Policies
  • IAM Policy Simulator
• Review Inbound and Outbound networking rules for Amazon EC2 Security Groups
  • EC2 → Instances → Network & Security → Security Groups → Inbound Rules
  • ex. review inbound + outbound rules for web and sql servers
• Review Amazon VPC configurations, subnets, and Network ACLs
  • Instance Summary → VPC ID
  • VPC → Details → Main network ACL
• Review Amazon CloudWatch performance metrics
  • CloudWatch → Metrics → All metrics → Browse EC2 → Per-Instance Metrics → CPUUtilization → SQL Server → graphed metrics
  • EC2 → Elastic Block Store → Volumes → select Volume attached to web server instance → Details → Monitoring
• Review raw Amazon CloudTrail logs within Amazon S3
  • CloudTrail → Trails → Details
  • S3 → choose bucket → choose AWSLogs/

user permissions

see how many access keys a user has, when an access key was created, whether a Multi-Factor Authentication (MFA) device is assigned

• Access Keys: Keys can be active or inactive and only administrators have the ability to inactivate or delete keys. If a user with limited permissions tried to deactivate or delete an access key, they would receive a message similar to the following:
  • We encountered the following errors while processing your request: User:arn:aws:iam::111122223333:user/user-1_01 is not authorized to perform: iam:UpdateAccessKey on resource: user user-1_01
• Signing Certificates: Can be signed certificates, X.509 Certificate and/or third party tools (e.g. OpenSSL).
• Console password: Users with access to the AWS Management Console require a password. Passwords can be generated and/or changed by administrators within the IAM dashboard. Passwords can be auto-generated or custom-generated based on organization preferences.
• Assigned MFA (Multi-Factor Authentication) Device: Multi-Factor Authentication is a simple best practice that adds an extra layer of protection on top of your username and password.
• Virtual: Use your existing smartphone, tablet, or computer running any application that supports the open TOTP standard.