In addition to the flat-out exploitation of AWS services and resources, it is also important to provide your client with a general security audit in as many locations as you can. These types of checks typically fall into a small set of categories:
- Public access:
- Can X be accessed publicly? Should that be possible?
- Encryption:
- Is Y encrypted at-rest? Is Z encrypted in-transit?
- Logging:
- Are logs enabled for C? Is anything being done with those logs?
- Backups:
- Is D being backed up? How often?
- Other security controls:
- Is MFA being used?
- Password policy strength?
- Deletion protection on the right resources?
Of course, there is more to it than just those few, but generally these are the most common types of findings.
There are already many tools out there to provide this kind of insight into an environment, including the following...
