--- title: "AWS Foundations Self-Check | Vishcore Inc." description: "One yes-or-no question for each test in our public AWS test library, grouped by area and linked to its test. No email, no sign-up, and no score." canonical: https://vishcore.com/resources/self-check --- 1. [Resources](https://vishcore.com/resources) 2. AWS Foundations Self-Check self-check # An AWS foundations self-check, one question per test. Yes-or-no questions worded from the pass conditions of the tests in our public library, grouped by area. No email, no sign-up, and no score: each question links to the test that checks it. [Start discovery](https://vishcore.com/start-discovery) Start the self-check This self-check - One question per test in our public library - Each worded from that test's own pass condition - Works without JavaScript, with nothing to submit - No score, no total, and no verdict at the end by area ## Answer each question for your AWS account. Each question is one library test's Passes when condition, worded as a question with nothing added, so a yes means the test's pass condition holds. A no, or a question you cannot answer yet, points to the test that checks it. - Identity and access - Logging and audit trails - Network exposure - Edge and TLS - Data protection (encryption and backups) - Monitoring and alerting - Compute - Governance ### Identity and access - #### Does every IAM user with a console password have an MFA device? Library test [IAM users with console access have MFA](https://vishcore.com/resources/test-library#test-iam-users-with-console-access-have-mfa) - #### Does the root user have an MFA device active? Library test [The root user has MFA enabled](https://vishcore.com/resources/test-library#test-the-root-user-has-mfa-enabled) - #### Was every active IAM access key created or rotated in the last 90 days? Library test [Active IAM access keys are rotated within 90 days](https://vishcore.com/resources/test-library#test-active-iam-access-keys-are-rotated-within-90-days) - #### Does every Cognito user pool in scope have a password policy defined? Library test [Cognito user pools define a password policy](https://vishcore.com/resources/test-library#test-cognito-user-pools-define-a-password-policy) Back to the areas ### Logging and audit trails - #### Does every CloudTrail trail have log file validation enabled? Library test [CloudTrail trails validate log file integrity](https://vishcore.com/resources/test-library#test-cloudtrail-trails-validate-log-file-integrity) - #### Is it true that a trail is logging and covers every Region? Library test [A CloudTrail trail records activity in every Region](https://vishcore.com/resources/test-library#test-a-cloudtrail-trail-records-activity-in-every-region) - #### Does every CloudWatch log group have a retention period set? Library test [CloudWatch log groups have a retention period](https://vishcore.com/resources/test-library#test-cloudwatch-log-groups-have-a-retention-period) [See the Terraform fix from our lab](https://vishcore.com/resources/terraform-fixes#fix-cloudwatch-log-group-retention) - #### Does every VPC in scope have an active flow log? Library test [VPCs capture Flow Logs](https://vishcore.com/resources/test-library#test-vpcs-capture-flow-logs) Back to the areas ### Network exposure - #### Is it true that no security group allows port 22 from 0.0.0.0/0 or ::/0? Library test [Security groups do not expose SSH to the internet](https://vishcore.com/resources/test-library#test-security-groups-do-not-expose-ssh-to-the-internet) [See the Terraform fix from our lab](https://vishcore.com/resources/terraform-fixes#fix-ec2-exposure) - #### Does every S3 bucket have all four Block Public Access settings on? Library test [S3 buckets block public access at the bucket level](https://vishcore.com/resources/test-library#test-s3-buckets-block-public-access-at-the-bucket-level) - #### Is it true that no RDS instance in scope is marked publicly accessible? Library test [RDS instances are not publicly accessible](https://vishcore.com/resources/test-library#test-rds-instances-are-not-publicly-accessible) - #### Does every S3 bucket policy deny requests made without TLS? Library test [S3 bucket policies deny requests that are not over TLS](https://vishcore.com/resources/test-library#test-s3-bucket-policies-deny-requests-that-are-not-over-tls) Back to the areas ### Edge and TLS - #### Does every HTTP listener on a load balancer redirect to HTTPS? Library test [Load balancer HTTP listeners redirect to HTTPS](https://vishcore.com/resources/test-library#test-load-balancer-http-listeners-redirect-to-https) - #### Does every load balancer in scope have an HTTPS listener with an ACM certificate? Library test [Load balancers terminate TLS with an ACM certificate](https://vishcore.com/resources/test-library#test-load-balancers-terminate-tls-with-an-acm-certificate) - #### Does every CloudFront distribution redirect viewers to HTTPS or allow only HTTPS? Library test [CloudFront distributions require HTTPS from viewers](https://vishcore.com/resources/test-library#test-cloudfront-distributions-require-https-from-viewers) Back to the areas ### Data protection (encryption and backups) - #### Does every RDS instance in scope have storage encryption enabled? Library test [RDS DB instances encrypt storage at rest](https://vishcore.com/resources/test-library#test-rds-db-instances-encrypt-storage-at-rest) - #### Does AWS Backup have at least one backup plan? Library test [AWS Backup has at least one backup plan](https://vishcore.com/resources/test-library#test-aws-backup-has-at-least-one-backup-plan) - #### Does every DynamoDB table in scope have point-in-time recovery enabled? Library test [DynamoDB tables have point-in-time recovery](https://vishcore.com/resources/test-library#test-dynamodb-tables-have-point-in-time-recovery) - #### Is EBS encryption by default on in every Region in scope? Library test [EBS encryption by default is on in each scoped Region](https://vishcore.com/resources/test-library#test-ebs-encryption-by-default-is-on-in-each-scoped-region) - #### Does every customer-managed KMS key have automatic rotation enabled? Library test [Customer-managed KMS keys rotate automatically](https://vishcore.com/resources/test-library#test-customer-managed-kms-keys-rotate-automatically) - #### Does every S3 bucket have default encryption configured? Library test [S3 buckets encrypt objects by default](https://vishcore.com/resources/test-library#test-s3-buckets-encrypt-objects-by-default) Back to the areas ### Monitoring and alerting - #### Does the account have at least one CloudWatch alarm? Library test [The account has at least one CloudWatch alarm](https://vishcore.com/resources/test-library#test-the-account-has-at-least-one-cloudwatch-alarm) [See the Terraform fix from our lab](https://vishcore.com/resources/terraform-fixes#fix-cloudwatch-alarms) - #### Is an AWS Config recorder recording in every Region in scope? Library test [AWS Config recorders are actively recording](https://vishcore.com/resources/test-library#test-aws-config-recorders-are-actively-recording) - #### Does GuardDuty have an enabled detector in every Region in scope? Library test [GuardDuty has an enabled detector in each scoped Region](https://vishcore.com/resources/test-library#test-guardduty-has-an-enabled-detector-in-each-scoped-region) Back to the areas ### Compute - #### Does every EC2 instance in scope require IMDSv2 session tokens? Library test [EC2 instances require IMDSv2](https://vishcore.com/resources/test-library#test-ec2-instances-require-imdsv2) - #### Is it true that every ECR repository scans on push or is covered by Inspector scanning? Library test [ECR repositories scan images on push or through Inspector](https://vishcore.com/resources/test-library#test-ecr-repositories-scan-images-on-push-or-through-inspector) - #### Does every running EC2 instance in scope report to Systems Manager? Library test [Running EC2 instances report to Systems Manager](https://vishcore.com/resources/test-library#test-running-ec2-instances-report-to-systems-manager) Back to the areas ### Governance - #### Does the account have a security alternate contact on record? Library test [The account has a security alternate contact](https://vishcore.com/resources/test-library#test-the-account-has-a-security-alternate-contact) - #### Does the organization have service control policies attached beyond the default? Library test [The organization applies service control policy guardrails](https://vishcore.com/resources/test-library#test-the-organization-applies-service-control-policy-guardrails) - #### Does every critical resource in scope have an Owner tag? Library test [Critical resources carry an Owner tag](https://vishcore.com/resources/test-library#test-critical-resources-carry-an-owner-tag) Back to the areas What your answers mean This self-check has no score and no total. Each question links to the test that checks it, and that test's row in the library says what it checks and when it fails. Your answers here are not an audit opinion. ## Answered no, or not sure? Start with a short note. We confirm fit before any access, and a read-only Cloud Control Scan then evaluates the full catalog against your account. [How the scan works](https://vishcore.com/scan) [Start discovery](https://vishcore.com/start-discovery)