AWS Security Transformation Dashboard

Region: us-east-1 Last scan: 2026-07-25T07:01:26Z
Security Overview Recommendations & Remediation
1
Critical Actions
7
High Priority
6
Medium Priority
14
Total Recommendations

Prioritized Remediation Plan

Recommendations sorted by severity and impact. Address Critical items immediately, then work through High and Medium priority.

CRITICAL

Restrict Security Group Ingress

Effort: Medium Impact: Critical Ec2 Network 5 resources

Security group allows inbound traffic from 0.0.0.0/0 (the entire internet) on sensitive ports.

Risk: Open security groups expose services to the entire internet including automated scanners and attackers. SSH/RDP open to the world is one of the most common breach vectors.

Remediation Steps

  1. Identify which resources use this security group
  2. Determine the minimum required source IPs/ranges
  3. Replace 0.0.0.0/0 with specific CIDR blocks (corporate IPs, VPN ranges)
  4. For web servers, use an ALB + WAF in front instead of direct public access
  5. Or run: python 04-network-exposure/harden_network.py --action security-groups --no-dry-run

AWS CLI Command

$ aws ec2 revoke-security-group-ingress --group-id SG_ID --protocol tcp --port PORT --cidr 0.0.0.0/0

Affected Resources

sg-04f834d6014fc51b1 sg-04f834d6014fc51b1 sg-04f834d6014fc51b1 sg-0b10cbf99c42a54c0 sg-0b10cbf99c42a54c0
HIGH

Strengthen IAM Password Policy

Effort: Low Impact: High Iam 1 resource

The account password policy does not meet organizational security standards. Minimum length should be 14 characters with complexity requirements.

Risk: Users with weak passwords are vulnerable to brute force and credential stuffing attacks.

Remediation Steps

  1. Navigate to IAM > Account Settings > Password Policy
  2. Set minimum length to 14 characters
  3. Enable: require uppercase, lowercase, numbers, and symbols
  4. Set password expiration to 90 days
  5. Enable password reuse prevention (24 passwords)
  6. Or run: python 02-iam/iam_hardening.py --action password-policy --no-dry-run

AWS CLI Command

$ aws iam update-account-password-policy --minimum-password-length 14 --require-symbols --require-numbers --require-uppercase-characters --require-lowercase-characters --max-password-age 90 --password-reuse-prevention 24 --allow-users-to-change-password

Affected Resources

AccountPasswordPolicy
HIGH

Rotate Stale Access Keys

Effort: Medium Impact: High Iam 12 resources

Access keys older than 90 days should be rotated to limit the window of exposure if compromised.

Risk: Long-lived access keys are high-value targets. If leaked to code repos or logs, they provide persistent access.

Remediation Steps

  1. Create a new access key for the user
  2. Update applications using the old key with the new key
  3. Deactivate the old access key (monitor for issues)
  4. After confirmation, delete the old key
  5. Or run: python 02-iam/iam_hardening.py --action stale-keys --no-dry-run

AWS CLI Command

$ aws iam create-access-key --user-name USERNAME $ aws iam update-access-key --user-name USERNAME --access-key-id OLD_KEY_ID --status Inactive

Affected Resources

<root_account> a2cuser cross-account-copy Former2 manaskatu +7 more
HIGH

Enable S3 Public Access Block

Effort: Low Impact: High S3 2 resources

Buckets without public access block can be accidentally made public, exposing data.

Risk: Without public access block, a single misconfigured policy or ACL can expose all bucket data to the internet.

Remediation Steps

  1. Enable all four public access block settings on the bucket
  2. Verify no applications depend on public access
  3. Or run: python 07-remediation/remediate.py --finding-type S3_NO_PUBLIC_ACCESS_BLOCK --no-dry-run

AWS CLI Command

$ aws s3api put-public-access-block --bucket BUCKET_NAME --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Affected Resources

manasmondal.com myresume-04062022
HIGH

Enable VPC Flow Logs

Effort: Low Impact: High Ec2 Network 1 resource

VPC Flow Logs provide network traffic visibility critical for security investigations and monitoring.

Risk: Without flow logs, you have no visibility into network traffic patterns, making breach detection and forensics impossible.

Remediation Steps

  1. Create a CloudWatch Log Group for flow logs
  2. Create an IAM role for VPC Flow Logs
  3. Enable flow logs on the VPC
  4. Set retention to 90 days
  5. Or run: python 04-network-exposure/harden_network.py --action flow-logs --no-dry-run

AWS CLI Command

$ aws ec2 create-flow-logs --resource-ids VPC_ID --resource-type VPC --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name /aws/vpc-flow-logs/VPC_ID

Affected Resources

vpc-0bf43605f8f2c6179
HIGH

Enable EBS Default Encryption

Effort: Low Impact: High Encryption 1 resource

New EBS volumes will not be encrypted by default, requiring teams to remember encryption for each volume.

Risk: Without default encryption, developers may create unencrypted volumes containing sensitive data.

Remediation Steps

  1. Enable EBS encryption by default in the account settings
  2. This affects only new volumes; existing unencrypted volumes require migration
  3. Or run: python 05-encryption-kms/enforce_encryption.py --action ebs-default --no-dry-run

AWS CLI Command

$ aws ec2 enable-ebs-encryption-by-default

Affected Resources

Account-us-east-1
HIGH

Enable Amazon GuardDuty

Effort: Low Impact: High Logging Monitoring 1 resource

GuardDuty provides intelligent threat detection using ML and threat intelligence feeds at no upfront cost.

Risk: Without GuardDuty, compromised credentials, crypto mining, and data exfiltration go undetected.

Remediation Steps

  1. Enable GuardDuty in all regions
  2. Configure S3 protection, EKS audit, and malware scanning
  3. Set up SNS notifications for HIGH/CRITICAL findings
  4. Or run: python 04-network-exposure/harden_network.py --action guardduty --no-dry-run

AWS CLI Command

$ aws guardduty create-detector --enable --data-sources S3Logs={Enable=true}

Affected Resources

GuardDuty
HIGH

Enable AWS Security Hub

Effort: Low Impact: High Logging Monitoring 1 resource

Security Hub centralizes findings from GuardDuty, Inspector, Macie, Config, and third-party tools with automated compliance checks.

Risk: Without Security Hub, there is no centralized view of security posture and no automated compliance scoring.

Remediation Steps

  1. Enable Security Hub in us-east-1
  2. Enable CIS AWS Foundations Benchmark standard
  3. Enable AWS Foundational Security Best Practices standard
  4. Configure cross-region aggregation

AWS CLI Command

$ aws securityhub enable-security-hub --enable-default-standards

Affected Resources

SecurityHub
MEDIUM

Require Symbols in Passwords

Effort: Low Impact: Medium Iam 1 resource

Password policy does not require special characters, reducing password entropy.

Risk: Passwords without symbols are easier to crack via dictionary attacks.

Remediation Steps

  1. Update password policy to require symbols
  2. Included in the full password policy remediation above

AWS CLI Command

$ aws iam update-account-password-policy --require-symbols

Affected Resources

AccountPasswordPolicy
MEDIUM

Require Numbers in Passwords

Effort: Low Impact: Medium Iam 1 resource

Password policy does not require numeric characters.

Risk: Reduced password complexity increases vulnerability to brute force.

Remediation Steps

  1. Update password policy to require numbers

AWS CLI Command

$ aws iam update-account-password-policy --require-numbers

Affected Resources

AccountPasswordPolicy
MEDIUM

Require Uppercase Characters in Passwords

Effort: Low Impact: Medium Iam 1 resource

Password policy does not require uppercase characters.

Risk: Reduced password complexity increases vulnerability to brute force.

Remediation Steps

  1. Update password policy to require uppercase characters

AWS CLI Command

$ aws iam update-account-password-policy --require-uppercase-characters

Affected Resources

AccountPasswordPolicy
MEDIUM

Enable Password Expiration

Effort: Low Impact: Medium Iam 1 resource

Passwords never expire, meaning compromised credentials remain valid indefinitely.

Risk: Stale passwords that are never rotated increase the window of opportunity for attackers.

Remediation Steps

  1. Set maximum password age to 90 days
  2. Communicate to users that they will need to rotate passwords

AWS CLI Command

$ aws iam update-account-password-policy --max-password-age 90

Affected Resources

AccountPasswordPolicy
MEDIUM

Enable S3 Default Encryption

Effort: Low Impact: Medium S3 26 resources

Bucket has no default encryption, meaning objects can be stored unencrypted.

Risk: Data at rest without encryption may violate compliance requirements and is exposed if storage media is compromised.

Remediation Steps

  1. Enable default encryption with SSE-KMS or SSE-S3
  2. KMS encryption provides key management and audit trail

AWS CLI Command

$ aws s3api put-bucket-encryption --bucket BUCKET_NAME --server-side-encryption-configuration '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"},"BucketKeyEnabled":true}]}'

Affected Resources

awstransform07122026 bedrockkbtarget-02082026 cf-templates-1l8wh3qrsl621-us-east-1 cloudcost-06102025 demobedrockagent-02082026 +21 more
MEDIUM

Remove Rules from Default Security Group

Effort: Low Impact: Medium Ec2 Network 1 resource

CIS Benchmark requires the default security group to have no rules. Resources should use custom security groups.

Risk: Resources accidentally placed in the default VPC/SG inherit overly permissive rules.

Remediation Steps

  1. Identify if any resources are using the default SG
  2. Migrate resources to purpose-built security groups
  3. Remove all ingress and egress rules from the default SG

AWS CLI Command

$ aws ec2 revoke-security-group-ingress --group-id DEFAULT_SG_ID --ip-permissions '[CURRENT_RULES]'

Affected Resources

sg-0e6ff667bc6a51cb9