Security Controls & Guardrails

/

Control ↕	Severity ↕	Category ↕
Implement Regular Access Reviews for Landing Zone Accounts	high	Compliance
Enable AWS Artifact for Compliance Reports	low	Compliance
Maintain Landing Zone Compliance Documentation	medium	Compliance
Implement Cost Allocation Tagging Strategy	high	Cost Management
Implement S3 Lifecycle Policies for Log Data	medium	Cost Management
Implement Budget Alerts for Central Accounts	medium	Cost Management
Enforce S3 Block Public Access at Organization Level	critical	Data Protection
Enforce KMS Key Policies for Central Landing Zone Accounts	high	Data Protection
Centralize AWS Backup for Landing Zone Core Accounts	high	Data Protection
Secure S3 Audit Trails and CloudTrail Loop Prevention	medium	Data Protection
Prohibit Public EBS and RDS Snapshots	critical	Data Protection
Mandate Encryption for Data at Rest (EBS & S3)	high	Data Protection
Ensure Only Approved Cross-Account IAM Role Trusts	high	Identity & Access
Enforce IAM Account Password Policy for Central Accounts	medium	Identity & Access
Centralized Identity Management with IAM Identity Center	critical	Identity & Access
Enforce Break Glass Access Procedures	critical	Identity & Access
Restrict IAM User Creation in Central Landing Zone Accounts	high	Identity & Access
Enforce OIDC for VCS CI/CD Connections to AWS	critical	Identity & Access
Implement Foundational Service Control Policies (SCPs)	high	Identity & Access
Enable IAM Access Analyzer at Organization Level	high	Identity & Access
Define and Apply Resource Control Policies (RCPs)	high	Identity & Access
Ensure No Root User Account Access Key Exists	critical	Identity & Access
Centralized and Immutable CloudTrail Logging	critical	Logging
Selective CloudWatch Logs Aggregation with Cost Guardrails	medium	Logging
Log Archive Account Isolation and Immutability Guardrails	critical	Logging
Centralized VPC Flow Logging with Partitioning and Compression	medium	Logging
Enforce Customer Managed KMS Keys and Key Rotation for Audit Logs	high	Logging
Selective CloudTrail Data Events Logging with Cost Guardrails	high	Logging
Enforce Foundational IAM Organization Policy Constraints	high	Identity & Access
Enforce Just-In-Time Privileged Access with Privileged Access Manager	high	Identity & Access
Enable Policy Analyzer and IAM Recommender	medium	Identity & Access
Enforce Workload Identity Federation for VCS CI/CD Connections to GCP	critical	Identity & Access

Implement Regular Access Reviews for Landing Zone Accounts

Compliancehigh

Enable AWS Artifact for Compliance Reports

Compliancelow

Maintain Landing Zone Compliance Documentation

Compliancemedium

Implement Cost Allocation Tagging Strategy

Cost Managementhigh

Implement S3 Lifecycle Policies for Log Data

Cost Managementmedium

Implement Budget Alerts for Central Accounts

Cost Managementmedium

Enforce S3 Block Public Access at Organization Level

Data Protectioncritical

Enforce KMS Key Policies for Central Landing Zone Accounts

Data Protectionhigh

Centralize AWS Backup for Landing Zone Core Accounts

Data Protectionhigh

Secure S3 Audit Trails and CloudTrail Loop Prevention

Data Protectionmedium

Prohibit Public EBS and RDS Snapshots

Data Protectioncritical

Mandate Encryption for Data at Rest (EBS & S3)

Data Protectionhigh

Ensure Only Approved Cross-Account IAM Role Trusts

Identity & Accesshigh

Enforce IAM Account Password Policy for Central Accounts

Identity & Accessmedium

Centralized Identity Management with IAM Identity Center

Identity & Accesscritical

Enforce Break Glass Access Procedures

Identity & Accesscritical

Restrict IAM User Creation in Central Landing Zone Accounts

Identity & Accesshigh

Enforce OIDC for VCS CI/CD Connections to AWS

Identity & Accesscritical

Implement Foundational Service Control Policies (SCPs)

Identity & Accesshigh

Enable IAM Access Analyzer at Organization Level

Identity & Accesshigh

Define and Apply Resource Control Policies (RCPs)

Identity & Accesshigh

Ensure No Root User Account Access Key Exists

Identity & Accesscritical

Centralized and Immutable CloudTrail Logging

Loggingcritical

Selective CloudWatch Logs Aggregation with Cost Guardrails

Loggingmedium

Log Archive Account Isolation and Immutability Guardrails

Loggingcritical

Centralized VPC Flow Logging with Partitioning and Compression

Loggingmedium

Enforce Customer Managed KMS Keys and Key Rotation for Audit Logs

Logginghigh

Selective CloudTrail Data Events Logging with Cost Guardrails

Logginghigh

Enforce Foundational IAM Organization Policy Constraints

Identity & Accesshigh

Enforce Just-In-Time Privileged Access with Privileged Access Manager

Identity & Accesshigh

Enable Policy Analyzer and IAM Recommender

Identity & Accessmedium

Enforce Workload Identity Federation for VCS CI/CD Connections to GCP

Identity & Accesscritical

Showing 1–32 of 32

Per page

1/1

Cloud Security Controls Library - Guardrails & Compliance Reference

Implement Regular Access Reviews for Landing Zone Accounts

Enable AWS Artifact for Compliance Reports

Maintain Landing Zone Compliance Documentation

Implement Cost Allocation Tagging Strategy

Implement S3 Lifecycle Policies for Log Data

Implement Budget Alerts for Central Accounts

Enforce S3 Block Public Access at Organization Level

Enforce KMS Key Policies for Central Landing Zone Accounts

Centralize AWS Backup for Landing Zone Core Accounts

Secure S3 Audit Trails and CloudTrail Loop Prevention

Prohibit Public EBS and RDS Snapshots

Mandate Encryption for Data at Rest (EBS & S3)

Ensure Only Approved Cross-Account IAM Role Trusts

Enforce IAM Account Password Policy for Central Accounts

Centralized Identity Management with IAM Identity Center

Enforce Break Glass Access Procedures

Restrict IAM User Creation in Central Landing Zone Accounts

Enforce OIDC for VCS CI/CD Connections to AWS

Implement Foundational Service Control Policies (SCPs)

Enable IAM Access Analyzer at Organization Level

Define and Apply Resource Control Policies (RCPs)

Ensure No Root User Account Access Key Exists

Centralized and Immutable CloudTrail Logging

Selective CloudWatch Logs Aggregation with Cost Guardrails

Log Archive Account Isolation and Immutability Guardrails

Centralized VPC Flow Logging with Partitioning and Compression

Enforce Customer Managed KMS Keys and Key Rotation for Audit Logs

Selective CloudTrail Data Events Logging with Cost Guardrails

Enforce Foundational IAM Organization Policy Constraints

Enforce Just-In-Time Privileged Access with Privileged Access Manager

Enable Policy Analyzer and IAM Recommender

Enforce Workload Identity Federation for VCS CI/CD Connections to GCP