Cloud Security Controls Library - Guardrails & Compliance Reference

Perform manual, quarterly access reviews of IAM roles, users, and access keys across Landing Zone accounts. Use the Organization-level IAM Access Analyzer (deployed separately via [AWS-IAM-010](/controls/AWS-IAM-010/)) to retrieve unused access findings as the authoritative data source for each review cycle.

Use AWS Artifact to access AWS-issued security and compliance reports (SOC 2, ISO 27001, PCI DSS, FedRAMP) and attach them as evidence to AWS Audit Manager, a GRC or audit tool, providing auditors with a unified view of both AWS-managed and customer-managed controls under the Shared Responsibility Model.

Maintain comprehensive documentation of the Landing Zone configuration, policies, and procedures in a centralized repository (e.g., Confluence, Git) and automate evidence collection via AWS Audit Manager.

Define and enforce a mandatory tagging strategy across all Landing Zone accounts to enable accurate cost attribution, financial accountability, asset ownership tracking, and environment-aware governance. Tags are enforced at resource creation via SCPs and monitored for drift via AWS Config.

Configure S3 lifecycle policies on the central logging buckets in the **Log Archive account** to automatically transition log data through cheaper storage classes over time and enforce retention-based expiration. This control applies to all log data centralised in the Log Archive account. The sources, retention requirements, and bucket structure for each log type are defined in the following controls: - **[AWS-SEC-XXX] Enable AWS CloudTrail at the Organization Level** - defines CloudTrail log delivery configuration, bucket naming, and minimum retention requirements. - **[AWS-NET-XXX] Enable VPC Flow Logs** - defines Flow Log delivery targets, format, and account-level activation scope. - **[AWS-SEC-XXX] Enable AWS Config Recording** - defines Config snapshot and history delivery to the Log Archive bucket. Lifecycle policies defined in this control must be applied to the buckets referenced in those controls and must not reduce retention below the minimums they specify.

Create AWS Budgets with SNS-backed alerts for all central Landing Zone accounts (Management, Security, Log Archive, Network) to detect unexpected cost increases early. Complement static budget thresholds with AWS Cost Anomaly Detection for intra-month spike detection that threshold-based budgets alone cannot catch.

Enforce S3 Block Public Access across all Landing Zone accounts using a multi-layered governance strategy: the primary control utilizes the native AWS Organizations S3 Policy type applied globally from the Management account, backed by an SCP to prevent local tampering of bucket/account settings, and continuous AWS Config tracking.

Enforce hardened KMS key policies in the Log Archive and Audit accounts to enforce separation of duties, restrict key usage to authorized AWS services via condition keys, and prevent privilege escalation through key policy overwrites or unrestricted grant creation.

Centrally manage AWS Backup from the Management account to enforce consistent backup coverage for resources in the core landing zone accounts - Management, Log Archive, and Audit - using organization backup policies and cross-account vault copies stored in the Log Archive account.

Enable S3 server access logging for buckets tagged as sensitive while explicitly prohibiting logging on CloudTrail buckets to prevent infinite recursive logging loops and associated cost spikes.

Prevent Amazon EBS and RDS snapshots from being configured as publicly restorable across the entire organization using a combination of SCPs (preventative) and AWS Config managed rules with automated remediation (detective and corrective).

Enforce encryption by default for EBS volumes and S3 buckets across the organization using AWS Organizations SCPs, EC2 account-level defaults, and S3 bucket-level default encryption settings.

Identify and review IAM roles in central accounts that allow external AWS accounts to assume them. This control uses IAM Access Analyzer to detect cross-account access and applies preventive Service Control Policies (SCPs) to restrict trust policy modifications to approved organization boundaries.

Enforce a hardened IAM account password policy across all central landing zone accounts, including minimum length, complexity, expiry, and reuse prevention aligned to CIS benchmark recommendations.

Deploy AWS IAM Identity Center as the sole human access mechanism for all landing zone accounts, integrated with an external IdP, and enforce via SCP that direct IAM user creation and console access are blocked in member accounts.

Establish a documented, auditable break-glass access procedure for emergency access to the Management account when IAM Identity Center or the corporate IdP is unavailable.

Prevent the creation of IAM users in central landing zone accounts (Management, Log Archive, Audit, Security, Network) to enforce exclusive use of IAM Identity Center for human access and IAM roles for service access.

Mandate the use of OIDC federation for all CI/CD pipeline connections from GitHub, GitLab or any other version control system (VCS) to central AWS accounts, eliminating long-lived IAM access keys from VCS secrets entirely.

Establish and maintain a baseline set of Service Control Policies from the Management account to enforce preventative guardrails across the organization. Recommended foundational SCPs for a landing zone: - Deny leaving the AWS Organization (organizations:LeaveOrganization) - Deny disabling or deleting CloudTrail trails - Deny disabling AWS Config or deleting Config recorders and delivery channels - Deny disabling Security Hub or GuardDuty - Deny root user actions (except account-level tasks that require root) - Deny creation of IAM users and long-lived credentials in member accounts - Restrict deployments to approved AWS regions only - Deny disabling EBS encryption by default - Deny making S3 buckets or objects public at the account level - Deny deletion of VPC Flow Logs - Deny modification of designated security roles (e.g. LandingZoneAdminRole) - Deny sharing resources outside the organization via RAM

Enable a single IAM Access Analyzer with zone of trust set to the AWS Organization from the delegated administrator account, providing continuous detection of external access across all member accounts.

Use Resource Control Policies from the Management account to enforce centralized maximum-permission guardrails on resources across the organization, closing the gap that SCPs cannot address. RCPs complement SCPs in the policy evaluation chain: SCPs constrain what identities can do, RCPs constrain what resources can accept. Together they form the data perimeter of the landing zone. Recommended foundational RCPs for a landing zone: - Deny access to S3 buckets from principals outside the organization (prevents cross-account exfiltration via bucket policy) - Deny access to SQS queues from principals outside the organization - Deny access to Secrets Manager secrets from principals outside the organization - Deny sts:AssumeRole on roles from principals outside the organization unless the role trust policy explicitly allows it - Restrict S3 access to known VPC endpoints only for sensitive OUs - Deny ECR image pulls from outside the organization - Deny OpenSearch Serverless collection access from outside the organization

Ensure no active programmatic access keys exist for the root user in any AWS account, and prevent their creation organization-wide via SCP.

Aggregate multi-region AWS CloudTrail audit logs from all AWS Organizations member accounts into a dedicated, centralized Log Archive account secured with KMS CMK encryption, log file validation, and S3 Object Lock compliance retention.

Selectively aggregate security-relevant, compliance-mandated, and audit-grade CloudWatch Log Groups from workload accounts into the central Log Archive account using CloudWatch Logs cross-account destinations, Amazon Data Firehose, and durable S3 cold storage. Explicitly filter out high-volume ephemeral debug, trace, and synthetic health-check streams to prevent severe CloudWatch ingestion and data transfer cost escalation.

Enforce strict account-level isolation and preventative Service Control Policies (SCPs) on the dedicated Log Archive account to prohibit deletion of log groups, destruction of encryption keys, tampering with lifecycle rules, and unauthorized interactive administrative access.