Does every IAM user with a console password have an MFA device?
Library test
IAM users with console access have MFAself-check
An AWS foundations self-check, one question per test.
Yes-or-no questions worded from the pass conditions of the tests in our public library, grouped by area. No email, no sign-up, and no score: each question links to the test that checks it.
by area
Answer each question for your AWS account.
Each question is one library test's Passes when condition, worded as a question with nothing added, so a yes means the test's pass condition holds. A no, or a question you cannot answer yet, points to the test that checks it.
Identity and access
-
-
Does the root user have an MFA device active?
Library test
The root user has MFA enabled -
Was every active IAM access key created or rotated in the last 90 days?
Library test
Active IAM access keys are rotated within 90 days -
Does every Cognito user pool in scope have a password policy defined?
Library test
Cognito user pools define a password policy
Logging and audit trails
-
Does every CloudTrail trail have log file validation enabled?
Library test
CloudTrail trails validate log file integrity -
Is it true that a trail is logging and covers every Region?
Library test
A CloudTrail trail records activity in every Region -
Does every CloudWatch log group have a retention period set?
-
Does every VPC in scope have an active flow log?
Library test
VPCs capture Flow Logs
Network exposure
-
Is it true that no security group allows port 22 from 0.0.0.0/0 or ::/0?
-
Does every S3 bucket have all four Block Public Access settings on?
Library test
S3 buckets block public access at the bucket level -
Is it true that no RDS instance in scope is marked publicly accessible?
Library test
RDS instances are not publicly accessible -
Does every S3 bucket policy deny requests made without TLS?
Edge and TLS
-
Does every HTTP listener on a load balancer redirect to HTTPS?
Library test
Load balancer HTTP listeners redirect to HTTPS -
Does every load balancer in scope have an HTTPS listener with an ACM certificate?
Library test
Load balancers terminate TLS with an ACM certificate -
Does every CloudFront distribution redirect viewers to HTTPS or allow only HTTPS?
Library test
CloudFront distributions require HTTPS from viewers
Data protection (encryption and backups)
-
Does every RDS instance in scope have storage encryption enabled?
Library test
RDS DB instances encrypt storage at rest -
Does AWS Backup have at least one backup plan?
Library test
AWS Backup has at least one backup plan -
Does every DynamoDB table in scope have point-in-time recovery enabled?
Library test
DynamoDB tables have point-in-time recovery -
Is EBS encryption by default on in every Region in scope?
-
Does every customer-managed KMS key have automatic rotation enabled?
Library test
Customer-managed KMS keys rotate automatically -
Does every S3 bucket have default encryption configured?
Library test
S3 buckets encrypt objects by default
Monitoring and alerting
-
Does the account have at least one CloudWatch alarm?
-
Is an AWS Config recorder recording in every Region in scope?
Library test
AWS Config recorders are actively recording -
Does GuardDuty have an enabled detector in every Region in scope?
Compute
-
Does every EC2 instance in scope require IMDSv2 session tokens?
Library test
EC2 instances require IMDSv2 -
Is it true that every ECR repository scans on push or is covered by Inspector scanning?
-
Does every running EC2 instance in scope report to Systems Manager?
Library test
Running EC2 instances report to Systems Manager
Governance
-
Does the account have a security alternate contact on record?
Library test
The account has a security alternate contact -
Does the organization have service control policies attached beyond the default?
-
Does every critical resource in scope have an Owner tag?
Library test
Critical resources carry an Owner tag
What your answers mean
This self-check has no score and no total. Each question links to the test that checks it, and that test's row in the library says what it checks and when it fails. Your answers here are not an audit opinion.
Answered no, or not sure?
Start with a short note. We confirm fit before any access, and a read‑only Cloud Control Scan then evaluates the full catalog against your account.
How the scan works