| name | aws-security |
| description | Enforce AWS security baselines for IAM, networking, logging, and managed services like RDS. Use when building, reviewing, or auditing AWS infrastructure, IAM policies, VPC configuration, or RDS deployments.
|
| category | secure_development |
| subcategory | cloud-infrastructure |
AWS Security
General AWS Requirements
These apply to all AWS services (e.g., ElastiCache, RDS, MSK).
Logging and Auditing
- Enable AWS CloudTrail to log all API and user activity
- Ensure CloudTrail logs are stored in a protected S3 bucket with versioning and encryption
Network Security
- Deploy services in a VPC with security groups and network ACLs that restrict traffic to only required ports and sources
- Restrict security group rules to the minimum required ports and source IPs
- Use private subnets for services that do not need Internet-facing access
IAM
- Create individual IAM accounts for each person managing AWS resources; never use root credentials
- Grant each user the minimum set of permissions required for their duties
- Use IAM groups to manage permissions for multiple users
- Rotate IAM credentials regularly
- Never put sensitive identifying information (customer account numbers, PII) in free-form IAM fields such as Name
Amazon RDS Security
Encryption
- Encrypt data in transit using SSL/TLS connections
- Encrypt database storage and backups at rest using AWS KMS
Credential Management
- Do not use the master credentials created during instance setup; they use the public schema without fine-grained permissions
- Create application-specific database users with least-privilege grants
- Configure AWS Secrets Manager to automatically rotate database credentials
Patching and Access
- Use RDS versions that do not have known security vulnerabilities; apply patches promptly
- Restrict access using security groups that allow only specific IP addresses or EC2 instances
- Create individual IAM users for each person managing RDS; never use root
Amazon ElastiCache / Redis
For detailed Redis and ElastiCache security guidance (authentication, encryption, ACLs, network isolation), see the dedicated skill: redis-elasticache-security. Apply the General AWS Requirements above (IAM, VPC, CloudTrail) to all ElastiCache deployments.
Implementation Checklist
References
