Everyone loves tools. Here are a few free ones to add to your toolkit.
Using checklists in life is a great way to keep track of the important (and sometimes less-so) things. Same applies when considering IT Operations and Security.
Below are a few things I have put on ‘my list’ and they also serve as a great guide to giving your AWS environment a healthy and friendly assessment of its readiness for operations and security as well as providing a great set of benchmark documentation for you to keep.
Use these as a guide depending on the size of your environment or company (Enterprises usually have much more rigour than a start-up or smaller shop), complex and compliance needs. Of course, you can always create your own to suit your requirements as well. Review these for inspiration.
AWS Checklists
AWS_Security_Checklist_General.pdf
AWS_Auditing_Security_Checklist.pdf
The Auditing Checklist can be used to assist auditors of your environment understand the how auditing in AWS can be achieved, considering controls such as the AWS Shared Responsibility Model.
Plus the bonuses Using a checklist for operation and security fitness are key foundations of the Security and Operational Pillars for a AWS Well-Architected environment, using the Well-Architected Framework as a basis.
CIS – AWS Foundation Benchmark
The Centre for Internet Security (CIS) has released an extensive set of security recommendations specifically for use with AWS environments. Use this excellent AWS CIS benchmark document to improve and validate your security posture. Advanced techniques within this guide are included.
PCI Cloud Compliance Technical Workbook
If you are operating in a more sensitive environment to meet compliance requirements you might find it useful to also check out this handy technical workbook from Anitian. It outlines controls which can be used with AWS to achieve PCI-DSS compliance. Also check out the AWS Risk and Compliance Whitepaper for further compliance information for various standards.