An AWS security checklist is only as useful as its pass tests. This one gives 15 checks, each with the AWS page to open and a yes or no answer. It suits an IT manager in India or the GCC who holds an AWS account and may also run Azure. Azure gets a lighter treatment. Each check has one line from Microsoft Learn, or a plain note when Azure has no clean equivalent. The lines also draw on the documentation named beside each item. The checks read settings. A pass shows a setting matches its intent, but not that the account is safe.
Last reviewed 2026-11-01 by Manish Sharma.
AWS Security Checklist at a Glance: 15 Checks in Four Groups
This AWS security checklist has four groups, in the order a person works through an account. The grouping and the pass tests are Signisys’ own working method, built on AWS documentation, while neither is an AWS or Microsoft standard. Use a test account first, and read with read-only access. Also record yes, no or not applicable for each check, with an owner.
When you open the AWS page named in the table, answer the pass test with yes or no. If a check does not fit your account, mark it not applicable and write down the reason. A no is a finding to assign, but not a verdict on the whole account.
Key Takeaway When a check is done, record yes, no or not applicable with an owner, and assign every no.
AWS Security Checklist, Group 1: Account and Access (Checks 1 to 4)
These four checks decide who can act in the account and where the account keeps its secrets. The IAM page asks for multi-factor authentication and no access keys on the root user, while people sign in centrally. Checks 1 and 2 rest on the IAM User Guide’s best-practices page. The terms multi-factor authentication and identity and access management each have an entry in our encyclopedia.
| Check | Where to look in AWS | Pass test (yes passes) | In Azure |
|---|---|---|---|
| Check 1: Root user | IAM console, security credentials of the root user | Does the root user have multi-factor authentication on and no access keys? | Azure sets up top-level access differently. Look at Microsoft Entra emergency access accounts and multifactor authentication instead. |
| Check 2: Central sign-in | IAM Identity Center console, users and groups | Does each person sign in through the identity provider with multi-factor authentication required, and no separate IAM user made for them? | Check multifactor authentication for each person in Microsoft Entra ID. |
| Check 3: Separate accounts and guardrails | AWS Organizations console, accounts and policies | Is production in its own account, with a service control policy applied above it? | While management groups hold subscriptions, Azure Policy sets rules across them. That is close to, not the same as, a service control policy. |
| Check 4: Secrets | AWS Secrets Manager console, plus a search of code and settings | Does Secrets Manager hold each database password, with none in code or settings? | Azure Key Vault holds secrets in Azure. |
AWS Security Checklist, Group 2: Data and Network (Checks 5 to 8)
This part of the AWS security checklist covers what the internet can reach and how data stays protected if something gets in. A web ACL is the rule set that AWS WAF applies to a web application.
| Check | Where to look in AWS | Pass test (yes passes) | In Azure |
|---|---|---|---|
| Check 5: Public storage | S3 console, Block Public Access, account and each bucket | Is Block Public Access on, with all four settings, for the account, or is each public bucket named on a written list with its owner? AWS recommends the account level, because a bucket policy can let users change a bucket’s own setting. | While Azure uses the anonymous read access setting for blob data, Microsoft Learn says the default prohibits it. |
| Check 6: Security groups | EC2 console, security groups, inbound rules | Are SSH (port 22) and RDP limited to named address ranges, with none open to 0.0.0.0/0 or ::/0? | Azure uses network security groups. |
| Check 7: Edge protection | AWS WAF web ACLs, CloudFront distributions, AWS Shield | Is each internet-facing web application behind an AWS WAF web ACL, with its rules listed and an owner? | Azure DDoS Protection covers network-level attacks, and Azure also has a web application firewall, which this list does not map. |
| Check 8: Encryption | KMS console, customer managed keys; encryption settings of EBS, S3 and databases | Is encryption at rest on for the volumes, databases and buckets that hold business data, with a key owner? | Azure Storage encryption at rest is on for every storage account and can’t be turned off. Key Vault can also hold customer-managed keys. While managed disks have their own encryption page, this list does not map databases. |
AWS Security Checklist, Group 3: Logs and Detection (Checks 9 to 12)
Group 3 of the AWS security checklist is about being able to see what happened, and it only helps if the records were on before an incident. For check 12, the CSPM user guide page describes the standard.
| Check | Where to look in AWS | Pass test (yes passes) | In Azure |
|---|---|---|---|
| Check 9: Activity record | CloudTrail console, trails | Does one trail cover all Regions, deliver to a log bucket in a separate account, and have log file validation on? | The Azure Monitor activity log records actions on Azure resources, which is close to the trail’s management events, although it is not a full match, and you set separately where its records go. |
| Check 10: Network traffic record | VPC console, flow logs for each VPC | Do flow logs run on each VPC that carries business traffic, delivering to one central place? | Azure uses virtual network flow logs instead of NSG flow logs. |
| Check 11: Configuration tracking | AWS Config console, settings and rules | Is AWS Config recording in each account and Region you use, with at least one rule on? | Azure has no one-to-one service, although Azure Policy compliance and Microsoft Defender for Cloud cover part of it. |
| Check 12: Threat detection and posture | GuardDuty console; Security Hub CSPM console, security standards (see CSPM) | Are GuardDuty and the AWS Foundational Security Best Practices standard both on, with each failed control fixed or assigned? | Microsoft Defender for Cloud covers posture management and workload protection. |
Microsoft Learn’s page on NSG flow logs says network security group flow logs retire on 30 September 2027 and no longer support new flow logs. Use virtual network flow logs instead.
AWS Security Checklist, Group 4: Patch, Back Up and Respond (Checks 13 to 15)
The last three checks cover keeping systems current, recovering data and acting on an alert. Patch Manager compliance is the page that shows patch status. AWS Backup restore testing runs restore jobs, while a backup plan alone does not show that a restore works. An incident runbook is a process step that reads the same on both clouds.
| Check | Where to look in AWS | Pass test (yes passes) | In Azure |
|---|---|---|---|
| Check 13: Patching | Systems Manager console, Patch Manager, compliance | Does Patch Manager show each managed server as compliant, with every exception on a written list with an owner? | Azure uses Azure Update Manager. |
| Check 14: Backups | AWS Backup console, backup plans, jobs and restore testing | Is each critical database and volume in a backup plan, and does the restore jobs list show one completed restore job? | Azure uses Azure Backup. |
| Check 15: Incident plan | Your own incident response runbook, and the AWS Security Incident Response Guide | Is there a written runbook for one alert type, with a named contact, that someone has practised? | Azure has no product to check here, while the process step stays the same on both clouds. |
Key Takeaway The last three checks work only if the patches, backups and runbook exist before an alert arrives.
What This Checklist Does Not Cover, and Where to Go Next
This list reads settings in one AWS account and names the Azure counterpart. It is not a full audit, a scan, a compliance standard or a tool comparison. It also does not cover application code or Indian and GCC rules. Trimming unused permissions sits outside the 15 checks, although IAM Access Analyzer is an AWS page to start from. Encryption in transit and the removal of unused users and credentials are also outside the 15 checks. If you can’t run a check, or a no has no owner, ask for a review. For the tools that sit above AWS’s own settings, a plain comparison of posture, workload and SaaS tools covers the choice.
When you want the causes behind a no, read why settings go wrong in the first place. When you want the order in which to fix them, see the ten ordered steps for protecting a cloud account. If a leader wants a view across any cloud, use a leadership audit list for any cloud. When you need definitions, see what cloud security covers. If you want the wider use case, see how to secure a cloud workload. The page About AWS also covers how Signisys works with AWS.
Signisys helps organizations find, prioritize and reduce security risks. Our Solution: VAPT and Cybersecurity Risk Assessment. Our Service: Cybersecurity Services.
AWS Security Checklist FAQ
What should an AWS security checklist include?
Can I use the same checks in Azure?
Which checks should I run first?
When should I re-run the checks?
Does a pass mean my AWS account is secure?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.