The Cloud Security Checklist I Use at Every Enterprise Engagement

# Check root account MFA
aws iam get-account-summary | grep AccountMFAEnabled

# Find users without MFA
aws iam generate-credential-report
aws iam get-credential-report --output text | awk -F, '$4=="false" {print $1}'

# Find overprivileged roles
aws iam list-policies --only-attached --query 'Policies[?PolicyName==`AdministratorAccess`]'

# Check for access keys older than 90 days
aws iam list-access-keys --query 'AccessKeyMetadata[?CreateDate<`2026-01-18`]'

# Security groups with 0.0.0.0/0 on SSH
aws ec2 describe-security-groups --filters Name=ip-permission.from-port,Values=22 Name=ip-permission.cidr,Values=0.0.0.0/0

# Check for public subnets without NAT
aws ec2 describe-route-tables --query 'RouteTables[*].Routes[?GatewayId!=`local`]'

# VPC Flow Logs enabled?
aws ec2 describe-flow-logs --query 'FlowLogs[*].{VPC:ResourceId,Status:FlowLogStatus}'

# S3 buckets without encryption
aws s3api list-buckets --query Buckets[].Name --output text | xargs -I {} aws s3api get-bucket-encryption --bucket {} 2>&1

# Public S3 buckets
aws s3api list-buckets --query Buckets[].Name --output text | xargs -I {} aws s3api get-public-access-block --bucket {}

# EBS volumes without encryption
aws ec2 describe-volumes --query 'Volumes[?!Encrypted].VolumeId'