AWS Foundational Security Best Practices controls

To configure API caching for a given stage

1. Open the API Gateway console at https://console.aws.amazon.com/apigateway/.

2. Choose the API.

3. Choose Stages.

4. In the Stages list for the API, choose the stage to add caching to.

5. Choose Settings.

6. Choose Enable API cache.

7. Update the desired settings, then select Encrypt cache data.

8. Choose Save Changes.

To enable Elastic Load Balancing health checks

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, under Auto Scaling, choose Auto Scaling Groups.

3. Select the check box for your group.

4. Choose Edit.

5. Under Health checks, for Health check type, choose ELB.

6. For Health check grace period, enter 300.

7. At the bottom of the page, choose Update.

To create a new trail in CloudTrail

1. Open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

2. If you haven't used CloudTrail before, choose Get Started Now.

3. Choose Trails and then choose Create trail.

4. Enter a name for the trail.

5. Under Storage location, do one of the following:

   1. To create a new S3 bucket for CloudTrail logs, for Create a new S3 bucket, choose Yes, then enter a name for the new S3 bucket.

   2. To use an existing S3 bucket, for Create a new S3 bucket, choose No, then select the S3 bucket to use.

6. Under Additional settings, choose Advanced. For Enable log file validation, select Enabled.

7. Choose Create.

To update an existing trail in CloudTrail

1. Open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

2. Choose Trails.

3. In the Name column, choose the name of the trail.

4. For Management events, choose Edit.

5. For Read/Write events, select Management events.

6. Under API Activity, select Read and Write.

To enable encryption for CloudTrail logs

1. Open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

2. Choose Trails.

3. Choose the trail to update.

4. Under General details, choose Edit.

5. For Log file SSE-KMS encryption, select Enabled.

6. For Create a new KMS key, do one of the following:

   • To create a key, choose New. Then in AWS KMS alias, enter an alias for the key. The key is created in the same Region as the S3 bucket.

   • To use an existing key, choose Existing, then from AWS KMS alias, choose the key.

     The AWS KMS key and S3 bucket must be in the same Region.

7. Choose Save.

   You might need to modify the policy for CloudTrail to successfully interact with your KMS key. For more information, see Encrypting CloudTrail log files with AWS KMS–managed keys (SSE-KMS) in the AWS CloudTrail User Guide.

To enable CloudTrail log file validation

1. Open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

2. Choose Trails.

3. Under Name, choose the name of a trail to edit.

4. Under General details, choose Edit.

5. Under Additional settings, for Log file validation, choose Enabled.

6. Choose Save changes.

To enable CloudTrail integration with CloudWatch Logs

1. Open the CloudTrail console at https://console.aws.amazon.com/cloudtrail/.

2. Choose Trails.

3. Choose the trail that does not have a value for CloudWatch Logs Log group.

4. Under CloudWatch Logs, choose Edit.

5. Select Enabled.

6. For Log group, do one of the following:

   • To use the default log group, keep the name as is.

   • To use an existing log group, choose Existing and then enter the name of the log group to use.

   • To create a new log group, choose New and then enter a name for the log group to create.

7. For IAM role, do one of the following:

   • To use an existing role, choose Existing and then choose the role from the drop-down list.

   • To create a new role, choose New and then enter a name for the role to create. The new role is assigned a policy that grants the necessary permissions.

   To view the permissions granted to the role, expand Policy document.

8. Choose Save changes.

To remove basic authentication / (GitHub) Personal Access Token from CodeBuild project source

1. Open the CodeBuild console at https://console.aws.amazon.com/codebuild/.

2. Choose the build project that contains personal access tokens or a user name and password.

3. From Edit, choose Source.

4. Choose Disconnect from GitHub / Bitbucket.

5. Choose Connect using OAuth, then choose Connect to GitHub / Bitbucket.

6. When prompted, choose authorize as appropriate.

7. Reconfigure your repository URL and additional configuration settings, as needed.

8. Choose Update source.

To remove environment variables from a CodeBuild project

1. Open the CodeBuild console at https://console.aws.amazon.com/codebuild/.

2. Expand Build.

3. Choose Build project, and then choose the build project that contains plaintext credentials.

4. From Edit, choose Environment.

5. Expand Additional configuration.

6. Choose Remove next to the environment variables.

7. Choose Update environment.

To store sensitive values in the Amazon EC2 Systems Manager Parameter Store and then retrieve them from your build spec

1. Open the CodeBuild console at https://console.aws.amazon.com/codebuild/.

2. Expand Build.

3. Choose Build project, and then choose the build project that contains plaintext credentials.

4. From Edit, choose Environment.

5. Expand Additional configuration and scroll to Environment variables.

6. Follow this tutorial to create a Systems Manager parameter that contains your sensitive data.

7. After you create the parameter, copy the parameter name.

8. Back in the CodeBuild console, choose Create environmental variable.

9. Enter the name of your variable as it appears in your build spec.

10. For Value, paste the name of your parameter.

11. For Type, choose Parameter.

12. To remove your noncompliant environmental variable that contains plaintext credentials, choose Remove.

13. Choose Update environment.

To configure AWS Config settings

1. Open the AWS Config console at https://console.aws.amazon.com/config/.

2. Choose the Region to configure AWS Config in.

3. If you have not used AWS Config before, choose Get started.

4. On the Settings page, do the following:

   1. Under Resource types to record, choose Record all resources supported in this region and Include global resources (e.g. AWS IAM resources).

   2. Under AWS Config role, either choose Create AWS Config service-linked role or Choose a role from your account and then choose the role to use.

   3. Under Amazon S3 bucket, specify the bucket to use or create a bucket and optionally include a prefix.

   4. Under Amazon SNS topic, choose an Amazon SNS topic from your account or create one. For more information about Amazon SNS, see the Amazon Simple Notification Service Getting Started Guide.

5. Choose Next.

6. On the AWS Config rules page, choose Next.

7. Choose Confirm.

To configure the AWS DMS replication instances setting to block public access

1. Open the AWS Database Migration Service console at https://console.aws.amazon.com/dms/.

2. Navigate to Replication instances, then delete the public instance. Choose the instance, choose Actions, then choose delete.

3. Choose Create replication instance. Provide the configuration details.

4. To disable public access, make sure that Publicly accessible is not selected.

5. Choose Create.

To enable DynamoDB point-in-time recovery for an existing table

1. Open the DynamoDB console at https://console.aws.amazon.com/dynamodb/.

2. Choose the table that you want to work with, and then choose Backups.

3. In the Point-in-time Recovery section, under Status, choose Enable.

4. Choose Enable again to confirm the change.

To make a public EBS snapshot private

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, under Elastic Block Store, choose Snapshots menu and then choose your public snapshot.

3. From Actions, choose Modify permissions.

4. Choose Private.

5. (Optional) Add the AWS account numbers of the authorized accounts to share your snapshot with and choose Add Permission.

6. Choose Save.

To create new security groups and assign them to your resources

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Security groups. View the default security groups details to see the resources that are assigned to them.

3. Create a set of least-privilege security groups for the resources. For details on how to create security groups, see Creating a security group in the Amazon VPC User Guide.

4. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

5. On the Amazon EC2 console, change the security group for the resources that use the default security groups to the least-privilege security group you created. See Changing an instance's security groups in the Amazon VPC User Guide.

To remove the rules from the default security group

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Security groups.

3. Select a default security group and choose the Inbound rules tab. Choose Edit inbound rules. Then delete all inbound rules. Choose Save rules.

4. Repeat the previous step for each default security group.

5. Select a default security group and choose the Outbound rule tab. Choose Edit outbound rules. Then delete all outbound rules. Choose Save rules.

6. Repeat the previous step for each default security group.

To terminate an EC2 instance (console)

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, under Instances, choose Instances.

3. Select the instance, and then choose Actions, Instance State, Terminate.

4. When prompted for confirmation, choose Yes, Terminate.

To enable VPC flow logging

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. Under Virtual Private Cloud, choose Your VPCs.

3. Select a VPC to update.

4. At the bottom of the page, choose Flow Logs.

5. Choose Create flow log.

6. For Filter, choose Reject.

7. For Destination log group, choose the log group to use.

8. For IAM role, choose the IAM role to use.

9. Choose Create.

To configure the default encryption for Amazon EBS encryption for a Region

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. From the navigation pane, select EC2 Dashboard.

3. In the upper-right corner of the page, choose Account Attributes, EBS encryption.

4. Choose Manage.

5. Select Enable. You can keep the AWS managed key with the alias alias/aws/ebs created on your behalf as the default encryption key, or choose a symmetric customer managed key.

6. Choose Update EBS encryption.

To configure your new EC2 instance with IMDSv2 from the console

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. Choose Launch instance and then choose Launch instance.

3. In the Configure Instance Details step, under Advanced Details, for Metadata version, choose V2 (token required).

4. Choose Review and Launch.

To disassociate an Elastic IP address

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Elastic IPs.

3. Select the Elastic IP address to disassociate.

4. From Actions, choose Disassociate Elastic IP address.

5. Choose Disassociate.

To create an interface endpoint to Amazon EC2 from the Amazon VPC console

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Endpoints.

3. Choose Create Endpoint.

4. For Service category, choose AWS services.

5. For Service Name, choose com.amazonaws.<region>.ec2.

6. For Type, choose Interface.

7. Complete the following information.

   1. For VPC, select a VPC in which to create the endpoint.

   2. For Subnets, select the subnets (Availability Zones) in which to create the endpoint network interfaces. Not all Availability Zones are supported for all AWS services.

   3. To enable private DNS for the interface endpoint, select the check box for Enable DNS Name. This option is enabled by default.

      To use the private DNS option, the following attributes of your VPC must be set to true:

      • enableDnsHostnames

      • enableDnsSupport

      For more information, see Viewing and updating DNS support for your VPC in the Amazon VPC User Guide.

   4. For Security group, select the security groups to associate with the endpoint network interfaces.

   5. (Optional) Add or remove a tag. To add a tag, choose Add tag and do the following:

      • For Key, enter the tag name.

      • For Value, enter the tag value.

   6. To remove a tag, choose the delete button (x) to the right of the tag Key and Value.

8. Choose Create endpoint.

To configure a subnet to not assign public IP addresses

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Subnets.

3. Select your subnet and then choose Subnet Actions, Modify auto-assign IP settings.

4. Clear the Enable auto-assign public IPv4 address check box and then choose Save.

To detach a network interface

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. Under Network & Security, choose Network Interfaces.

3. Filter the list by the noncompliant instance IDs to see the associated ENIs.

4. Select the ENIs that you want to remove.

5. From the Actions menu, choose Detach.

6. If you see the prompt Are you sure that you want to detach the following network interface?, choose Detach.

To enable automatic backups for an existing file system

1. Open the Amazon Elastic File System console at https://console.aws.amazon.com/efs/.

2. On the File systems page, choose the file system for which to enable automatic backups.

   The File system details page is displayed.

3. Under General, choose Edit.

4. To enable automatic backups, select Enable automatic backups.

5. Choose Save changes.

To change all noncompliant listeners to TLS/HTTPS listeners

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Load Balancers. Then choose your Classic Load Balancer.

3. Choose the Listeners tab, and then choose Edit.

4. For all listeners where Load Balancer Protocol is not set to HTTPS or SSL, change the setting to HTTPS or SSL.

5. For all modified listeners, under SSL Certificate, choose Change.

6. For all modified listeners, select Choose a certificate from ACM.

7. Select the certificate from the Certificates drop-down list. Then choose Save.

8. After you update all of the listeners, choose Save.

To configure the load balancer to drop invalid header fields

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Load balancers.

3. Choose an Application Load Balancer.

4. From Actions, choose Edit attributes.

5. Under Drop Invalid Header Fields, choose Enable.

6. Choose Save.

To enable access logs

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Load balancers.

3. Choose an Application Load Balancer.

4. From Actions, choose Edit attributes.

5. Under Access logs, choose Enable.

6. Enter your S3 location. This location can exist or it can be created for you. If you do not specify a prefix, the access logs are stored in the root of the S3 bucket.

7. Choose Save.

To enable deletion protection from the console

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. On the navigation pane, under LOAD BALANCING, choose Load Balancers.

3. Choose the load balancer.

4. On the Description tab, choose Edit attributes.

5. On the Edit load balancer attributes page, select Enable for Delete Protection, and then choose Save.

6. Choose Save.

To redirect HTTP requests to HTTPS on an Application Load Balancer

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Load balancers.

3. Choose an Application Load Balancer.

4. Choose the Listeners tab.

5. Choose an HTTP listener (port 80 TCP) and then choose Edit.

6. If there is an existing rule, you must delete it. Otherwise, choose Add action and then choose Redirect to...

7. Choose HTTPS and then enter 443.

8. Choose the check mark in a circle symbol and then choose Update.

To modify the number of data nodes in an Elasticsearch domain

1. Open the Amazon OpenSearch Service console at https://console.aws.amazon.com/es/.

2. Under My domains, choose the name of the domain to edit.

3. Choose Edit domain.

4. Under Data nodes, set Number of nodes to a number greater than or equal to three.

   For three Availability Zone deployments, set to a multiple of three to ensure equal distribution across Availability Zones.

5. Choose Submit.

To modify the number of dedicated master nodes in an OpenSearch domain

1. Open the Amazon OpenSearch Service console at https://console.aws.amazon.com/es/.

2. Under My domains, choose the name of the domain to edit.

3. Choose Edit domain.

4. Under Dedicated master nodes, set Instance type to the desired instance type.

5. Set Number of master nodes equal to three or greater.

6. Choose Submit.

To modify an IAM policy

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Policies.

3. Choose the button next to the policy to remove.

4. From Policy actions, choose Detach.

5. For each user to detach the policy from, choose the button next to the user, then choose Detach policy.

To create an IAM group

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Groups and then choose Create New Group.

3. Enter a name for the group to create and then choose Next Step.

4. Select each policy to assign to the group and then choose Next Step. The policies that you choose should include any policies currently attached directly to a user account.

5. Add users to a group and then assign the policies to that group. Each user in the group is then assigned the policies that are assigned to the group.

6. Confirm the details on the Review page and then choose Create Group.

To add users to an IAM group

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Groups.

3. Choose Group Actions and then choose Add Users to Group.

4. Select the users to add to the group and then choose Add Users.

To remove a policy attached directly to a user

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Users.

3. For the user to detach a policy from, choose the name in the User name column.

4. For each policy listed under Attached directly, choose the X on the right side of the page to remove the policy from the user and then choose Remove.

5. Confirm that the user can still use AWS services as expected.

To ensure that access keys aren't more than 90 days old

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Users.

3. For each user that shows an Access key age that is greater than 90 days, choose the User name to open the settings for that user.

4. Choose Security credentials.

5. Create a new key for the user:

   1. Choose Create access key.

   2. To save the key content, either download the secret access key, or choose Show and then copy it from the page.

   3. Store the key in a secure location to provide to the user.

   4. Choose Close.

6. Update all applications that were using the previous key to use the new key.

7. For the previous key, choose Make inactive to make the access key inactive. The user now cannot use that key to make requests.

8. Confirm that all applications work as expected with the new key.

9. After confirming that all applications work with the new key, delete the previous key. After you delete the access key, you cannot recover it.

   To delete the previous key, choose the X at the end of the row and then choose Delete.

To delete access keys

1. Log in to your account using the AWS account root user credentials.

2. Choose the account name near the top-right corner of the page and then choose My Security Credentials.

3. In the pop-up warning, choose Continue to Security Credentials.

4. Choose Access keys (access key ID and secret access key).

5. To permanently delete the key, choose Delete and then choose Yes. You cannot recover deleted keys.

6. If there is more than one root user access key, then repeat steps 4 and 5 for each key.

To configure MFA for a user

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Users.

3. Choose the User name of the user to configure MFA for.

4. Choose Security credentials.

5. Next to Assigned MFA Device, choose Manage.

6. Follow the Manage MFA Device wizard to assign the type of device appropriate for your environment.

To enable hardware-based MFA for the root account

1. Log in to your account using the root user credentials.

2. Choose the account name near the top-right corner of the page and then choose My Security Credentials.

3. In the pop-up warning, choose Continue to Security Credentials.

4. Choose Multi-Factor Authentication (MFA).

5. Choose Activate MFA.

6. Choose a hardware-based (not virtual) device to use for MFA and then choose Continue.

7. Complete the steps to configure the device type appropriate to your selection.

To modify the password policy

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Account settings.

3. Select Requires at least one uppercase letter.

4. Select Requires at least one lowercase letter.

5. Select Requires at least one non-alphanumeric character.

6. Select Requires at least one number.

7. For Minimum password length, enter 8.

8. Choose Apply password policy.

To disable credentials for inactive accounts

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. Choose Users.

3. Choose the name of the user that has credentials over 90 days old.

4. Choose Security credentials.

5. For each sign-in credential and access key that hasn't been used in at least 90 days, choose Make inactive.

To modify an IAM customer managed policy

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the IAM navigation pane, choose Policies.

3. Choose the arrow next to the policy you want to modify.

4. Choose Edit policy.

5. Choose the JSON tab.

6. Change the “Resource” value to the specific key or keys that you want to allow.

7. After you modify the policy, choose Review policy.

8. Choose Save changes.

To modify an IAM inline policy

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the IAM navigation pane, choose Users, Groups, or Roles.

3. Choose the name of the user, group or role for which to modify IAM inline policies.

4. Choose the arrow next to the policy to modify.

5. Choose Edit policy.

6. Choose the JSON tab.

7. Change the "Resource" value to the specific keys you want to allow.

8. After you modify the policy, choose Review policy.

9. Choose Save changes.

To view the resource-based policy for a Lambda function

1. Open the AWS Lambda console at https://console.aws.amazon.com/lambda/.

2. In the navigation pane, choose Functions.

3. Choose the function.

4. Choose Permissions. The resource-based policy shows the permissions that are applied when another account or AWS service attempts to access the function.

5. Examine the resource-based policy. Identify the policy statement that has Principal field values that make the policy public. For example, allowing "*" or { "AWS": "*" }.

   You cannot edit the policy from the console. To remove permissions from the function, you use the remove-permission command from the AWS CLI.

   Note the value of the statement ID (Sid) for the statement that you want to remove.

To verify that the permissions are updated

1. Open the AWS Lambda console at https://console.aws.amazon.com/lambda/.

2. In the navigation pane, choose Functions.

3. Choose the function that you updated.

4. Choose Permissions.

   The resource-based policy should be updated. If there was only one statement in the policy, then the policy is empty.

To remove public access for RDS snapshots

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Navigate to Snapshots and then choose the public snapshot you want to modify.

3. From Actions, choose Share Snapshots.

4. From DB snapshot visibility, choose Private.

5. Under DB snapshot visibility, choose all.

6. Choose Save.

To remove public access from RDS DB instances

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Navigate to Databases and then choose your public database.

3. Choose Modify.

4. Under Connectivity, expand Additional connectivity configuration.

5. Under Public access, choose Not publicly accessible.

6. Choose Continue.

7. Under Scheduling of modifications, choose Apply immediately.

8. Choose Modify DB Instance.

To encrypt an unencrypted RDS snapshot

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Snapshots.

3. Find the snapshot to encrypt under Manual or System.

4. Select the check box next to the snapshot to encrypt.

5. Choose Actions, then choose Copy Snapshot.

6. Under New DB Snapshot Identifier, type a name for the new snapshot.

7. Under Encryption, select Enable Encryption.

8. Choose the KMS key to use to encrypt the snapshot.

9. Choose Copy Snapshot.

10. After the new snapshot is created, delete the original snapshot.

11. For Backup Retention Period, choose a positive nonzero value. For example, 30 days.

To enable multiple Availability Zones for a DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Databases, and then choose the DB instance that you want to modify.

3. Choose Modify. The Modify DB Instance page appears.

4. Under Instance Specifications, set Multi-AZ deployment to Yes.

5. Choose Continue and then check the summary of modifications.

6. (Optional) Choose Apply immediately to apply the changes immediately. Choosing this option can cause an outage in some cases. For more information, see Using the Apply Immediately setting in the Amazon RDS User Guide.

7. On the confirmation page, review your changes. If they are correct, choose Modify DB Instance to save your changes.

To enable deletion protection for an RDS DB cluster

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Databases, then choose the DB cluster that you want to modify.

3. Choose Modify.

4. Under Deletion protection, choose Enable deletion protection.

5. Choose Continue.

6. Under Scheduling of modifications, choose when to apply modifications. The options are Apply during the next scheduled maintenance window or Apply immediately.

7. Choose Modify Cluster.

To enable deletion protection for an RDS DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Databases, then choose the DB instance that you want to modify.

3. Choose Modify.

4. Under Deletion protection, choose Enable deletion protection.

5. Choose Continue.

6. Under Scheduling of modifications, choose when to apply modifications. The options are Apply during the next scheduled maintenance window or Apply immediately.

7. Choose Modify DB Instance.

To create a custom DB parameter group

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Parameter groups.

3. Choose Create parameter group. The Create parameter group window appears.

4. In the Parameter group family list, choose a DB parameter group family.

5. In the Type list, choose DB Parameter Group.

6. In Group name, enter the name of the new DB parameter group.

7. In Description, enter a description for the new DB parameter group.

8. Choose Create.

To create a new option group for MariaDB logging by using the console

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Option groups.

3. Choose Create group.

4. In the Create option group window, do the following:

   1. For Name, type a name for the option group that is unique within your AWS account. The name can contain only letters, digits, and hyphens.

   2. For Description, type a brief description of the option group. The description is used for display purposes.

   3. For Engine, choose the DB engine that you want.

   4. For Major engine version, choose the major version of the DB engine that you want.

5. To continue, choose Create.

6. Choose the name of the option group you just created.

7. Choose Add option.

8. Choose MARIADB_AUDIT_PLUGIN from the Option name list.

9. Set SERVER_AUDIT_EVENTS to CONNECT, QUERY, TABLE, QUERY_DDL, QUERY_DML, QUERY_DCL.

10. Choose Add option.

To publish SQL Server DB, Oracle DB, or PostgreSQL logs to CloudWatch Logs from the AWS Management Console

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Databases.

3. Choose the DB instance that you want to modify.

4. Choose Modify.

5. Under Log exports, choose all of the log files to start publishing to CloudWatch Logs.

   Log exports is available only for database engine versions that support publishing to CloudWatch Logs.

6. Choose Continue. Then on the summary page, choose Modify DB Instance.

To apply a new DB parameter group or DB options group to an RDS DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Databases.

3. Choose the DB instance that you want to modify.

4. Choose Modify. The Modify DB Instance page appears.

5. Under Database options, change the DB parameter group and DB options group as needed.

6. When you finish you changes, choose Continue. Check the summary of modifications.

7. (Optional) Choose Apply immediately to apply the changes immediately. Choosing this option can cause an outage in some cases. For more information, see Using the Apply Immediately setting in the Amazon RDS User Guide.

8. Choose Modify DB Instance to save your changes.

To enable IAM authentication for an existing DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Choose Databases.

3. Select the DB instance to modify.

4. Choose Modify.

5. Under Database options, choose Enable IAM DB authentication.

6. Choose Continue.

7. Under Scheduling of modifications, choose when to apply modifications. The options are Apply during the next scheduled maintenance window or Apply immediately.

8. For clusters, choose Modify DB Instance.

To enable IAM authentication for an existing DB cluster

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Choose Databases.

3. Choose the DB cluster to modify.

4. Choose Modify.

5. Under Database options, select Enable IAM DB authentication.

6. Choose Continue.

7. Under Scheduling of modifications, choose when to apply modifications: Apply during the next scheduled maintenance window or Apply immediately.

8. Choose Modify cluster.

To enable automatic minor version upgrades for an existing DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Choose Databases.

3. Choose the DB instance to modify.

4. Choose Modify.

5. Under Maintenance, select Yes for Auto minor version upgrade.

6. Choose Continue.

7. Under Scheduling of modifications, choose when to apply modifications: Apply during the next scheduled maintenance window or Apply immediately.

8. Choose Modify DB Instance.

To enable multi-AZ for a DB cluster

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Databases, and then choose the DB instance to modify.

3. Choose Modify. The Modify DB Instance page appears.

4. Under Instance Specifications, set Multi-AZ deployment to Yes.

5. Choose Continue and check the summary of modifications.

6. (Optional) Choose Apply immediately to apply the changes immediately. Choosing this option can cause an outage in some cases. For more information, see Using the Apply Immediately setting in the Amazon RDS User Guide.

   On the confirmation page, review your changes. If they are correct, choose Modify DB Instance.

To enable automatic tag copying to snapshots for a DB cluster

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Choose Databases.

3. Select the DB cluster to modify.

4. Choose Modify.

5. Under Backup, select Copy tags to snapshots.

6. Choose Continue.

7. Under Scheduling of modifications, choose when to apply modifications. You can choose either Apply during the next scheduled maintenance window or Apply immediately.

To enable automatic tag copying to snapshots for a DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Choose Databases.

3. Select the DB instance to modify.

4. Choose Modify.

5. Under Backup, select Copy tags to snapshots.

6. Choose Continue.

7. Under Scheduling of modifications, choose when to apply modifications. You can choose either Apply during the next scheduled maintenance window or Apply immediately.

To subscribe to RDS cluster event notifications

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Event subscriptions.

3. Under Event subscriptions, choose Create event subscription.

4. In the Create event subscription dialog, do the following:

   1. For Name, enter a name for the event notification subscription.

   2. For Send notifications to, choose an existing Amazon SNS ARN for an SNS topic. To use a new topic, choose create topic to enter the name of a topic and a list of recipients.

   3. For Source type, choose Clusters.

   4. Under Instances to include, select All clusters.

   5. Under Event categories to include, select Specific event categories. The control also passes if you select All event categories.

   6. Select maintenance and failure.

   7. Choose Create.

To subscribe to RDS instance event notifications

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Event subscriptions.

3. Under Event subscriptions, choose Create event subscription.

4. In the Create event subscription dialog, do the following:

   1. For Name, enter a name for the event notification subscription.

   2. For Send notifications to, choose an existing Amazon SNS ARN for an SNS topic. To use a new topic, choose create topic to enter the name of a topic and a list of recipients.

   3. For Source type, choose Instances.

   4. Under Instances to include, select All instances.

   5. Under Event categories to include, select Specific event categories. The control also passes if you select All event categories.

   6. Select maintenance, configuration change, and failure.

   7. Choose Create.

To subscribe to RDS database parameter group event notifications

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Event subscriptions.

3. Under Event subscriptions, choose Create event subscription.

4. In the Create event subscription dialog, do the following:

   1. For Name, enter a name for the event notification subscription.

   2. For Send notifications to, choose an existing Amazon SNS ARN for an SNS topic. To use a new topic, choose create topic to enter the name of a topic and a list of recipients.

   3. For Source type, choose Parameter groups.

   4. Under Instances to include, select All parameter groups.

   5. Under Event categories to include, select Specific event categories. The control also passes if you select All event categories.

   6. Select configuration change.

   7. Choose Create.

To subscribe to RDS database security group event notifications

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. In the navigation pane, choose Event subscriptions.

3. Under Event subscriptions, choose Create event subscription.

4. In the Create event subscription dialog, do the following:

   1. For Name, enter a name for the event notification subscription.

   2. For Send notifications to, choose an existing Amazon SNS ARN for an SNS topic. To use a new topic, choose create topic to enter the name of a topic and a list of recipients.

   3. For Source type, choose Security groups.

   4. Under Instances to include, select All security groups.

   5. Under Event categories to include, select Specific event categories. The control also passes if you select All event categories.

   6. Select configuration change and failure.

   7. Choose Create.

To modify the default port of an existing DB instance

1. Open the Amazon RDS console at https://console.aws.amazon.com/rds/.

2. Choose Databases.

3. Select the DB instance to modify

4. Choose Modify.

5. Under Database options, change Database port to a non-default value.

6. Choose Continue.

7. Under Scheduling of modifications, choose when to apply modifications. You can choose either Apply during the next scheduled maintenance window or Apply immediately.

8. For clusters, choose Modify cluster. For instances, choose Modify DB Instance.

To disable public access to an Amazon Redshift cluster

1. Open the Amazon Redshift console at https://console.aws.amazon.com/redshift/.

2. In the navigation menu, choose Clusters, then choose the name of the cluster with the security group to modify.

3. Choose Actions, then choose Modify publicly accessible setting.

4. Under Allow instances and devices outside the VPC to connect to your database through the cluster endpoint, choose No.

5. Choose Confirm.

To modify a parameter group

1. Open the Amazon Redshift console at https://console.aws.amazon.com/redshift/.

2. In the navigation menu, choose Config, then choose Workload management to display the Workload management page.

3. Choose the parameter group that you want to modify.

4. Choose Parameters.

5. Choose Edit parameters then set require_ssl to 1.

6. Enter your changes and then choose Save.

To modify the snapshot retention period

1. Open the Amazon Redshift console at https://console.aws.amazon.com/redshift/.

2. In the navigation menu, choose Clusters, then choose the name of the cluster to modify.

3. Choose Edit.

4. Under Backup, set Snapshot retention to a value of 7 or greater.

5. Choose Modify Cluster.

To enable cluster audit logging

1. Open the Amazon Redshift console at https://console.aws.amazon.com/redshift/.

2. In the navigation menu, choose Clusters, then choose the name of the cluster to modify.

3. Choose Maintenance and monitoring.

4. Under Audit logging, choose Edit.

5. Set Enable audit logging to yes, then enter the log destination bucket details.

6. Choose Confirm.

To enable Amazon S3 Block Public Access

1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. Choose Block public access (account settings).

3. Choose Edit.

4. Select Block all public access.

5. Choose Save changes.

To remove public access from an S3 bucket

1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. In the left navigation pane, choose Buckets.

3. Choose the name of the S3 bucket to update.

4. Choose Permissions and then choose Block public access.

5. Choose Edit.

6. Select Block all public access. Then choose Save.

7. If prompted, enter confirm and then choose Confirm.

To remove public access for an S3 bucket

1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. In the left navigation pane, choose Buckets.

3. Choose the name of the S3 bucket to update.

4. Choose Permissions and then choose Block public access.

5. Choose Edit.

6. Select Block all public access. Then choose Save.

7. If prompted, enter confirm and then choose Confirm.

To enable default encryption on an S3 bucket

1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. In the left navigation pane, choose Buckets.

3. Choose the S3 bucket from the list.

4. Choose Properties.

5. Choose Default encryption.

6. For the encryption, choose either AES-256 or AWS-KMS.

   • Choose AES-256 to use keys that are managed by Amazon S3 for default encryption. For more information about using Amazon S3 server-side encryption to encrypt your data, see the Amazon Simple Storage Service User Guide.

   • Choose AWS-KMS to use keys that are managed by AWS KMS for default encryption. Then choose a master key from the list of the AWS KMS master keys that you have created.

     Type the Amazon Resource Name (ARN) of the AWS KMS key to use. You can find the ARN for your AWS KMS key in the IAM console, under Encryption keys. Or, you can choose a key name from the drop-down list.

     Important

     If you use the AWS KMS option for your default encryption configuration, you are subject to the RPS (requests per second) quotas of AWS KMS. For more information about AWS KMS quotas and how to request a quota increase, see the AWS Key Management Service Developer Guide.

     For more information about creating an AWS KMS key, see the AWS Key Management Service Developer Guide.

     For more information about using AWS KMS with Amazon S3, see the Amazon Simple Storage Service User Guide.

   When enabling default encryption, you might need to update your bucket policy. For more information about moving from bucket policies to default encryption, see the Amazon Simple Storage Service User Guide.

7. Choose Save.

To configure an S3 bucket to deny nonsecure transport

1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. Navigate to the noncompliant bucket, then choose the bucket name.

3. Choose Permissions, and then choose Bucket Policy.

4. Add a similar policy statement to that in the policy below. Replace awsexamplebucket with the name of the bucket you are modifying.

   {
       "Id": "ExamplePolicy",
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "AllowSSLRequestsOnly",
               "Action": "s3:*",
               "Effect": "Deny",
               "Resource": [
                   "arn:aws:s3:::awsexamplebucket",
                   "arn:aws:s3:::awsexamplebucket/*"
               ],
               "Condition": {
                   "Bool": {
                        "aws:SecureTransport": "false"
                   }
               },
              "Principal": "*"
           }
       ]
   }

5. Choose Save.

To edit an S3 bucket policy

1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

2. In the Bucket name list, choose the name of the S3 bucket for which you want to edit the policy.

3. Choose Permissions, and then choose Bucket Policy.

4. In the Bucket policy editor text box, do one of the following:

   • Remove the statements that grant access to denied actions to other AWS accounts

   • Remove the permitted denied actions from the statements

5. Choose Save.

To configure an SageMaker notebook instance to deny direct internet access

1. Open the SageMaker console at https://console.aws.amazon.com/sagemaker/

2. Navigate to Notebook instances.

3. Delete the instance that has direct internet access enabled. Choose the instance, choose Actions, then choose stop.

   After the instance is stopped, choose Actions, then choose delete.

4. Choose Create notebook instance. Provide the configuration details.

5. Expand the network section, then choose a VPC, subnet, and security group. Under Direct internet access, choose Disable — Access the internet through a VPC.

6. Choose Create notebook instance.

To enable automatic rotation for secrets

1. Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

2. To find the secret that requires rotating, enter the secret name in the search field.

3. Choose the secret you want to rotate, which displays the secrets details page.

4. Under Rotation configuration, choose Edit rotation.

5. From Edit rotation configuration, choose Enable automatic rotation.

6. For Select Rotation Interval, choose a rotation interval.

7. Choose a Lambda function for rotation. For information about customizing your Lambda rotation function, see Understanding and customizing your Lambda rotation function in the AWS Secrets Manager User Guide.

8. To configure the secret for rotation, choose Next.

To delete inactive secrets

1. Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

2. To locate the secret, enter the secret name in the search box.

3. Choose the secret to delete.

4. Under Secret details, from Actions, choose Delete secret.

5. Under Schedule secret deletion, enter the number of days to wait before the secret is deleted.

6. Choose Schedule deletion.

To enable secret rotation

1. Open the Secrets Manager console at https://console.aws.amazon.com/secretsmanager/.

2. To locate the secret, enter the secret name in the search box.

3. Choose the secret to display.

4. Under Rotation configuration, choose Edit rotation.

5. From Edit rotation configuration, choose Enable automatic rotation.

6. From Select Rotation Interval, choose the rotation interval.

7. Choose a Lambda function to use for rotation.

8. Choose Next.

9. After you configure the secret for automatic rotation, under Rotation Configuration, choose Rotate secret immediately.

To encrypt an unencrypted SNS topic

1. Open the Amazon SNS console at https://console.aws.amazon.com/sns/v3/home.

2. In the navigation pane, choose Topics.

3. Choose the name of the topic to encrypt.

4. Choose Edit.

5. Under Encryption, choose Enable Encryption.

6. Choose the KMS key to use to encrypt the topic.

7. Choose Save changes.

To ensure that EC2 instances are managed by Systems Manager

1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

2. In the navigation menu, choose Quick setup.

3. Choose Create.

4. Under Configuration type, choose Host Management, then choose Next.

5. On the configuration screen, you can keep the default options.

   You can optionally make the following changes:

   1. If you use CloudWatch to monitor EC2 instances, select Install and configure the CloudWatch agent and Update the CloudWatch agent once every 30 days.

   2. Under Targets, choose the management scope to determine the accounts and Regions where this configuration is applied.

   3. Under Instance profile options, select Add required IAM policies to existing instance profiles attached to your instances.

6. Choose Create.

To remediate noncompliant patches

1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

2. Under Node Management, choose Run Command and then choose Run command.

3. Choose the button next to AWS-RunPatchBaseline.

4. Change the Operation to Install.

5. Choose Choose instances manually and then choose the noncompliant instances.

6. At the bottom of the page, choose Run.

7. After the command is complete, to monitor the new compliance status of your patched instances, in the navigation pane, choose Compliance.

To investigate and update a failed association

1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

2. In the navigation pane, under Node Management, choose Fleet Manager.

3. Choose the instance ID that has an Association status of Failed.

4. Choose View details.

5. Choose Associations.

6. Note the name of the association that has an Association status of Failed. This is the association that you need to investigate. You need to use the association name in the next step.

7. In the navigation pane, under Node Management, choose State Manager. Search for the association name, then select the association.

8. After you determine the issue, edit the failed association to correct the problem. For information on how to edit an association, see Edit an association.

To enable logging for a web ACL

1. Open the Kinesis Data Firehose console at https://console.aws.amazon.com/firehose/.

2. Create a Kinesis Data Firehose delivery stream.

   The name must start with the prefix aws-waf-logs-. For example, aws-waf-logs-us-east-2-analytics.

   Create the Kinesis Data Firehose delivery stream with a PUT source and in the Region where you operate. If you capture logs for Amazon CloudFront, create the delivery stream in US East (N. Virginia). For more information, see Creating an Amazon Kinesis Data Firehose delivery stream in the Amazon Kinesis Data Firehose Developer Guide.

3. From Services, choose WAF & Shield. Then choose Switch to AWS WAF Classic.

4. From Filter, choose Global (CloudFront).

5. Choose the web ACL to enable logging for.

6. Under Logging, choose Enable logging.

7. Choose the Kinesis Data Firehose delivery stream that you created earlier. You must choose a delivery stream that has a name that begins with aws-waf-logs-.

8. Choose Enable logging.