Security Baseline
Compliance & GovernanceA Security Baseline is the minimum set of security controls that should be enabled in every AWS account, regardless of workload. It establishes the foundation for defense in depth.
Essential Controls
- CloudTrail: enabled in all regions, multi-account via Organizations trail
- AWS Config: recording all supported resource types
- GuardDuty: threat detection across all accounts
- Security Hub: centralized findings with CIS/NIST benchmarks enabled
- IAM Access Analyzer: detect external access to resources
Account-Level Settings
- Root Account: MFA enabled, no access keys, used only for billing/emergency
- Default EBS Encryption: enabled in every region
- S3 Block Public Access: enabled at the account level
- IMDSv2: enforced as default for all new EC2 instances
- Account-level S3 settings: disable ACLs, enable versioning for critical buckets
Automation
- Deploy via Control Tower guardrails or CloudFormation StackSets
- Use Config Conformance Packs for continuous compliance verification
Related AWS Services
Related Terms
A security strategy using multiple layers of controls (network, identity, data, application) so that if one layer fails, others still protect the environment.
A prescriptive security configuration checklist from the Center for Internet Security that defines best practices for securing AWS accounts.
A managed service that automates the setup and governance of a secure, multi-account AWS environment based on AWS best practices (landing zone).
Using multiple AWS accounts to isolate workloads, environments, and teams, providing the strongest security boundary available in AWS.
The framework defining that AWS is responsible for security of the cloud (infrastructure), while customers are responsible for security in the cloud (data, access, configuration).
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.