AWS Security

General AWS Requirements

These apply to all AWS services (e.g., ElastiCache, RDS, MSK).

Logging and Auditing

• Enable AWS CloudTrail to log all API and user activity
• Ensure CloudTrail logs are stored in a protected S3 bucket with versioning and encryption

Network Security

• Deploy services in a VPC with security groups and network ACLs that restrict traffic to only required ports and sources
• Restrict security group rules to the minimum required ports and source IPs
• Use private subnets for services that do not need Internet-facing access

IAM