AWS Compliance Checks: CloudTrail, MFA, Public Access, IMDSv2

The AWS compliance rules run in the same discovery pass that inventories and prices your accounts, so a public RDS instance shows up next to its rightsizing finding rather than in a separate tool. Each rule reads a specific field that AWS reports and abstains when that field is missing. None of them carries a dollar figure.

Account-level guardrails

These findings attach to the account rather than to a resource:

• CloudTrail Not Enabled checks for a multi-region trail with logging on. Discovery includes shadow trails, so a multi-region trail homed outside us-east-1 or an organization trail still counts.
• Root Account MFA Not Enabled reads the root MFA flag from the account summary.
• IAM Password Policy Non-Compliant, AWS Config Recorder Not Enabled, GuardDuty Not Enabled and Inspector Not Enabled cover the rest of the baseline.

Identity

• IAM User Without MFA Enabled fires only for users who can sign in to the console, so programmatic users do not flood the list.
• IAM User Access Key Older Than 90 Days flags keys overdue for rotation.
• IAM Role With AdministratorAccess Policy and IAM Role With Wildcard Principal flag roles that grant more than they should.

Network exposure

• Security Group With Unrestricted Inbound Access reads the group’s open port ranges, including the all-ports case.
• EC2 IMDSv2 Not Required reads the instance’s metadata options on running instances.
• EC2 Instance Has a Public IP, Review If Needed is deliberately worded as a review rather than a violation.
• RDS Instance Publicly Accessible reads the instance’s publicly-accessible setting.

Data protection

• EBS Volume Not Encrypted and Resource Not Encrypted At Rest cover encryption.
• S3 Bucket With Public Access Enabled reads the bucket’s four Block Public Access settings. It proves the guardrail is incomplete, not that any object is exposed.
• S3 Bucket Not Requiring HTTPS and S3 Bucket Access Logging Not Enabled cover transport and audit.
• RDS Instance Not Using Multi-AZ applies to standard engines on production instances and stays quiet on dev/test.

Operational expiry

ACM Certificate Expiring Soon fires within 30 days of expiry, and EKS Control Plane Logging Disabled flags clusters with no control-plane audit trail.

Working the list

Each finding has numbered fix steps and a console link, and can be sent to Jira from the drawer. When you fix it, ZopNight re-reads the same field to confirm. For the security posture of workloads inside EKS clusters, see security findings. Fact sheets: security groups, IAM users, CloudTrail, S3. All AWS rules: AWS recommendations. Cross-cloud view: compliance findings.