Free AWS Security Quick Check

10 yes/no questions, 2 minutes. Get your score and the fixes that matter most. Nothing is sent anywhere until you choose to.

  1. Is MFA enabled on the root account, and is root never used for daily work?

  2. Do all human users sign in with MFA (no long-lived IAM user passwords without MFA)?

  3. Are there no access keys older than 90 days?

  4. Do applications run with narrow IAM roles instead of AdministratorAccess?

  5. Is CloudTrail turned on in every region and sent to a protected S3 bucket?

  6. Is GuardDuty (or another threat detection tool) enabled and monitored?

  7. Is S3 Block Public Access on at the account level?

  8. Are SSH (22) and RDP (3389) closed to 0.0.0.0/0 in every security group?

  9. Are EBS volumes, RDS databases and S3 buckets encrypted at rest?

  10. Do you have automated backups, and have you tested a restore in the last 6 months?