1. Root account has no MFA or has access keys
Karan Bhatia
Cloud Architect | AWS, Azure, Security | Helping enterprises move to cloud without lighting money on fire
1. Root account has no MFA or has access keys
2. S3 buckets with public ACLs 'just for testing'
3. Security groups with 0.0.0.0/0 on 22 or 5432
4. No CloudTrail in all regions
5. IAM users with AdministratorAccess for CI
6. No budget alerts
None of these need a security team. Spend one afternoon on them.
6 reactions2 comments