The AWS best practices checker & fixer. Inspired by AWS config and skyuecx0630/bp-check but improved performance via async jobs and better memoization.

Also provides Web based UI powered by bootstrap!

Screenshots



BP List	Fixing Non Compliant

Features

Web based UI
Best Practice Checker
Non Compliant Resource Fixer
Categorized & Prioritized BPSet Lists
Easy to Implement Best Practices

Implemented BPSets

WAFv2LoggingEnabled: Ensures that AWS WAFv2 WebACLs have logging enabled.
WAFv2RuleGroupLoggingEnabled: Ensures that AWS WAFv2 Rule Groups have logging enabled.
WAFv2RuleGroupNotEmpty: Ensures WAFv2 Rule Groups are not empty and contain at least one rule.
WAFv2WebACLNotEmpty: Ensures WAFv2 Web ACLs are not empty and contain at least one rule.
EC2TransitGatewayAutoVPCAttachDisabled: Ensures that Transit Gateways have Auto VPC Attachments disabled.
RestrictedCommonPorts: Ensures that common ports (e.g., SSH, HTTP, database ports) are not exposed to the public without proper restrictions.
RestrictedSSH: Ensures SSH (port 22) is not accessible from 0.0.0.0/0 in security groups.
SubnetAutoAssignPublicIPDisabled: Ensures that subnets do not automatically assign public IPs.
VPCDefaultSecurityGroupClosed: Ensures that default VPC security groups have no ingress or egress rules.
VPCFlowLogsEnabled: Ensures that VPC Flow Logs are enabled for all VPCs.
VPCNetworkACLUnusedCheck: Ensures that unused network ACLs are identified and removed.
VPCPeeringDNSResolutionCheck: Ensures that DNS resolution is enabled for all VPC peering connections.
VPCSGOpenOnlyToAuthorizedPorts: Ensures that security group rules do not allow unrestricted access to unauthorized ports.
SNSEncryptedKMS: Ensures that all SNS topics are encrypted with a KMS key.
SNSTopicMessageDeliveryNotificationEnabled: Ensures that SNS topics have message delivery notifications enabled.
SecurityHubEnabled: Ensures that AWS Security Hub is enabled for the AWS account.
SecretsManagerRotationEnabledCheck: Ensures all Secrets Manager secrets have rotation enabled.
SecretsManagerScheduledRotationSuccessCheck: Checks if Secrets Manager secrets have successfully rotated within their scheduled period.
SecretsManagerSecretPeriodicRotation: Ensures that Secrets Manager secrets are rotated periodically (every 90 days).
S3AccessPointInVpcOnly: Ensures that all S3 access points are restricted to a VPC.
S3BucketDefaultLockEnabled: Ensures that all S3 buckets have default object lock configuration enabled.
S3BucketLevelPublicAccessProhibited: Ensures that S3 buckets have public access blocked at the bucket level.
S3BucketLoggingEnabled: Ensures that S3 buckets have logging enabled.
S3BucketSSLRequestsOnly: Ensures that all S3 bucket requests are made using SSL.
S3BucketVersioningEnabled: Ensures that versioning is enabled on all S3 buckets.
S3DefaultEncryptionKMS: Ensures that all S3 buckets have default encryption enabled using AWS KMS.
S3EventNotificationsEnabled: Ensures that S3 buckets have event notifications configured.
S3LastBackupRecoveryPointCreated: Ensures that S3 buckets have recent backup recovery points.
S3LifecyclePolicyCheck: Ensures that all S3 buckets have lifecycle policies configured.
AuroraLastBackupRecoveryPointCreated: Ensures that Aurora DB clusters have a recovery point created within the last 24 hours.
AuroraMySQLBacktrackingEnabled: Ensures that backtracking is enabled for Aurora MySQL clusters.
DBInstanceBackupEnabled: Ensures that backups are enabled for RDS instances.
RDSClusterAutoMinorVersionUpgradeEnabled: Ensures Auto Minor Version Upgrade is enabled for RDS clusters.
RDSClusterDefaultAdminCheck: Ensures that RDS clusters do not use default administrative usernames (e.g., admin, postgres).
RDSClusterDeletionProtectionEnabled: Ensures that RDS clusters have deletion protection enabled.
RDSClusterEncryptedAtRest: Ensures that RDS clusters have encryption at rest enabled.
RDSClusterIAMAuthenticationEnabled: Ensures that IAM Database Authentication is enabled for RDS clusters.
RDSClusterMultiAZEnabled: Ensures that RDS clusters are deployed across multiple availability zones.
RDSDBSecurityGroupNotAllowed: Ensures RDS clusters are not associated with the default security group.
RDSEnhancedMonitoringEnabled: Ensures that Enhanced Monitoring is enabled for RDS instances.
RDSInstancePublicAccessCheck: Ensures RDS instances are not publicly accessible.
RDSLoggingEnabled: Ensures that logging is enabled for RDS clusters.
RDSSnapshotEncrypted: Ensures RDS cluster snapshots are encrypted.
LambdaDLQCheck: Ensures that Lambda functions have a configured Dead Letter Queue (DLQ).
LambdaFunctionPublicAccessProhibited: Ensures that Lambda functions do not allow public access via their resource-based policies.
LambdaFunctionSettingsCheck: Ensures Lambda functions have non-default timeout and memory size configurations.
LambdaInsideVPC: Ensures Lambda functions are configured to run inside a VPC.
IAMPolicyNoStatementsWithAdminAccess: Ensures IAM policies do not contain statements granting full administrative access.
IAMPolicyNoStatementsWithFullAccess: Ensures IAM policies do not have statements granting full access.
IAMRoleManagedPolicyCheck: Checks whether managed IAM policies are attached to any entities (roles, users, or groups).
ElastiCacheAutoMinorVersionUpgradeCheck: Ensures that ElastiCache clusters have auto minor version upgrade enabled.
ElastiCacheRedisClusterAutomaticBackupCheck: Ensures that Redis clusters in ElastiCache have automatic backups enabled.
ElastiCacheReplGrpAutoFailoverEnabled: Ensures that automatic failover is enabled for ElastiCache replication groups.
ElastiCacheReplGrpEncryptedAtRest: Ensures that ElastiCache replication groups are encrypted at rest.
ElastiCacheReplGrpEncryptedInTransit: Ensures that ElastiCache replication groups have in-transit encryption enabled.
ElastiCacheSubnetGroupCheck: Ensures ElastiCache clusters are not using the default subnet group.
EKSClusterLoggingEnabled: Ensures that all EKS clusters have full logging enabled.
EKSClusterSecretsEncrypted: Ensures that all EKS clusters have secrets encrypted with a KMS key.
EKSEndpointNoPublicAccess: Ensures EKS cluster endpoint does not have public access enabled.
EFSAccessPointEnforceRootDirectory: Ensures that EFS Access Points enforce a specific root directory.
EFSAccessPointEnforceUserIdentity: Ensures that EFS Access Points enforce a specific PosixUser identity.
EFSAutomaticBackupsEnabled: Ensures that EFS file systems have automatic backups enabled.
EFSEncryptedCheck: Ensures that all EFS file systems are encrypted.
EFSMountTargetPublicAccessible: Checks if EFS mount targets are publicly accessible.
ECSAwsVpcNetworkingEnabled: Ensures that ECS task definitions are configured to use the awsvpc network mode.
ECSContainerInsightsEnabled: Ensures that ECS clusters have Container Insights enabled.
ECSContainersNonPrivileged: Ensures that containers in ECS task definitions are not running in privileged mode.
ECSContainersReadonlyAccess: Ensures that containers in ECS task definitions have readonly root filesystems enabled.
ECSFargateLatestPlatformVersion: Ensures ECS Fargate services are using the latest platform version.
ECSTaskDefinitionLogConfiguration: Ensures that ECS task definitions have log configuration enabled.
ECSTaskDefinitionMemoryHardLimit: Ensures all containers in ECS task definitions have a memory hard limit set.
ECSTaskDefinitionNonRootUser: Ensures all ECS containers in task definitions run as non-root users.
ECRKmsEncryption1: Ensures ECR repositories are encrypted using AWS KMS.
ECRPrivateImageScanningEnabled: Ensures that image scanning on push is enabled for private ECR repositories.
ECRPrivateLifecyclePolicyConfigured: Ensures that private ECR repositories have lifecycle policies configured.
ECRPrivateTagImmutabilityEnabled: Ensures that private ECR repositories have tag immutability enabled.
EC2EbsEncryptionByDefault: Ensures that EBS encryption is enabled by default for all volumes in the AWS account.
EC2Imdsv2Check: Ensures that EC2 instances enforce the use of IMDSv2 for enhanced metadata security.
EC2InstanceDetailedMonitoringEnabled: Ensures that EC2 instances have detailed monitoring enabled.
EC2InstanceManagedBySystemsManager: Ensures that EC2 instances are managed by AWS Systems Manager.
EC2InstanceProfileAttached: Ensures that all EC2 instances have an IAM instance profile attached.
EC2NoAmazonKeyPair: Ensures that EC2 instances are not using an Amazon Key Pair.
EC2StoppedInstance: Ensures that stopped EC2 instances are identified and terminated if necessary.
EC2TokenHopLimitCheck: Ensures that EC2 instances have a Metadata Options HttpPutResponseHopLimit of 1.
DynamoDBAutoscalingEnabled: Ensures DynamoDB tables have autoscaling enabled for both read and write capacity.
DynamoDBLastBackupRecoveryPointCreated: Ensures that DynamoDB tables have a recent recovery point within the last 24 hours.
DynamoDBPITREnabled: Ensures that Point-In-Time Recovery (PITR) is enabled for DynamoDB tables.
DynamoDBTableDeletionProtectionEnabled: Ensures that deletion protection is enabled for DynamoDB tables.
DynamoDBTableEncryptedKMS: Ensures that DynamoDB tables are encrypted with AWS KMS.
DynamoDBTableEncryptionEnabled: Ensures that DynamoDB tables have server-side encryption enabled.
CodeBuildProjectEnvironmentPrivilegedCheck: Ensures that AWS CodeBuild projects are not using privileged mode for their environment.
CodeBuildProjectLoggingEnabled: Ensures that logging is enabled for AWS CodeBuild projects.
CodeDeployAutoRollbackMonitorEnabled: Ensures that auto-rollback and alarm monitoring are enabled for CodeDeploy deployment groups.
CWLogGroupRetentionPeriodCheck: Ensures all CloudWatch log groups have a retention period set.
CloudWatchAlarmSettingsCheck: Ensures that CloudWatch alarms have the required settings configured.
CloudFrontAccessLogsEnabled: Ensures that access logging is enabled for CloudFront distributions.
CloudFrontAssociatedWithWAF: Ensures that CloudFront distributions are associated with a WAF.
CloudFrontDefaultRootObjectConfigured: Ensures that CloudFront distributions have a default root object configured.
CloudFrontNoDeprecatedSSLProtocols: Ensures that CloudFront distributions do not use deprecated SSL protocols like SSLv3.
CloudFrontS3OriginAccessControlEnabled: Ensures that CloudFront distributions with S3 origins have Origin Access Control (OAC) enabled.
CloudFrontViewerPolicyHTTPS: Ensures that CloudFront distributions enforce HTTPS for viewer requests.
AutoScalingGroupELBHealthCheckRequired: Ensures that Auto Scaling groups with ELB or Target Groups use ELB health checks.
AutoScalingLaunchTemplate: Ensures that Auto Scaling groups use a launch template instead of a launch configuration.
AutoScalingMultipleAZ: Ensures that Auto Scaling groups are configured to use multiple Availability Zones.
APIGatewayAssociatedWithWAF: Ensures that API Gateway stages are associated with WAF.
APIGatewayExecutionLoggingEnabled: Ensures that execution logging is enabled for API Gateway stages.
APIGatewayV2AccessLogsEnabled: Ensures that access logging is enabled for API Gateway v2 stages.
APIGatewayV2AuthorizationTypeConfigured: Ensures that authorization type is configured for API Gateway v2 routes.
ALBHttpDropInvalidHeaderEnabled: Ensures that ALBs have invalid HTTP headers dropped.
ALBWAFEnabled: Ensures that WAF is associated with ALBs.
ELBCrossZoneLoadBalancingEnabled: Ensures that cross-zone load balancing is enabled for Elastic Load Balancers.
ELBDeletionProtectionEnabled: Ensures that deletion protection is enabled for Elastic Load Balancers.
ELBLoggingEnabled: Ensures that access logging is enabled for Elastic Load Balancers.