AWS Security Analyzer

Analyze AWS resource configurations and CloudFormation templates against security best practices. Produces a per-resource security assessment report with severity ratings and actionable recommendations.

When to Use

• During CloudFormation template creation — analyze before deployment
• To audit an existing template for security gaps
• When user asks "is this secure?" or "check security" for an AWS deployment
• Post-deployment security review of resource configurations

Verification Integrity Rules (CRITICAL)

Every claim in the security report MUST be verifiable against the CloudFormation template or resource configuration. Never fabricate, assume, or misrepresent security status.

Rule 1: Cite Exact Evidence

Every "✅ Applied" status MUST cite the exact CloudFormation property path and its value that proves the control is in place. If you cannot point to a specific property in the template, you cannot mark it as applied.

# ✅ CORRECT — cites exact property
| Encryption at rest | 🔴 Critical | ✅ Applied | `Properties.StorageEncrypted: true` | Explicitly set in template |

# ❌ WRONG — no evidence from template
| Encryption at rest | 🔴 Critical | ✅ Applied | N/A | AWS encrypts RDS by default |

Rule 2: Distinguish Explicit Config vs AWS Defaults

AWS provides some security controls by default. These are NOT the same as explicitly configured controls.

Rule 3: Never Use Misleading Framing

Describe security status accurately and literally. Do not soften or reframe risks.

Rule 4: Verify Before Reporting

Before generating the security report:

1. Re-read the CloudFormation template or configuration
2. For each "✅ Applied" entry: search the template for the cited property
3. For network exposure: check if any resource has a public IP or is publicly accessible
4. For encryption claims: distinguish between AWS default encryption and explicitly configured encryption
5. Cross-check property paths — use correct CloudFormation property names

Rule 5: When Uncertain, Mark as Unknown

| {check} | {severity} | ❓ Unknown | {property} | Unable to verify — property path unclear |

Never guess. Never fabricate. When in doubt, flag it.

Security Checklists by Service

S3 Buckets

IAM Roles and Policies

Lambda Functions

EC2 Instances

RDS Instances

ECS/EKS

Procedure

1. Extract Resources from Template

Parse the CloudFormation template to identify all resources and their types:

• AWS::S3::Bucket
• AWS::IAM::Role / AWS::IAM::Policy
• AWS::Lambda::Function
• AWS::EC2::Instance / AWS::EC2::SecurityGroup
• AWS::RDS::DBInstance
• AWS::ECS::TaskDefinition / AWS::EKS::Cluster
• etc.

2. Run Security Checks

For each resource, apply the relevant service checklist above. For each check:

1. Search the template JSON/YAML for the exact property path
2. Determine status: ✅ Applied, 🔄 AWS Default, ⚠️ Not applied, ❌ Misconfigured
3. Record the actual property value found (or "absent" if not in template)

3. Format Report

For each resource, produce a security table:

### 🪣 S3: my-data-bucket (AWS::S3::Bucket)

| Check | Severity | Status | Evidence | Notes |
|-------|----------|--------|----------|-------|
| Block public access | 🔴 Critical | ✅ Applied | `PublicAccessBlockConfiguration.BlockPublicAcls: true` (all 4 flags set) | |
| Encryption at rest | 🔴 Critical | ✅ Applied | `BucketEncryption.Rules[0].ApplyServerSideEncryptionByDefault.SSEAlgorithm: aws:kms` | |
| Versioning | 🟠 High | ✅ Applied | `VersioningConfiguration.Status: Enabled` | |
| Access logging | 🟡 Medium | ⚠️ Not applied | `LoggingConfiguration` absent | Consider enabling for audit trail |
| HTTPS-only policy | 🟠 High | ⚠️ Not applied | No bucket policy found | Add deny for aws:SecureTransport: false |

4. Evaluate Security Gate

After analyzing all resources:

Count critical and high severity issues that are ⚠️ Not applied or ❌ Misconfigured.

## 🔒 Security Gate

| Severity | Total Checks | ✅ Passed | ⚠️ Issues |
|----------|-------------|---------|---------|
| 🔴 Critical | X | Y | Z |
| 🟠 High | X | Y | Z |
| 🟡 Medium | X | Y | Z |
| 🔵 Low | X | Y | Z |

If Z (Critical + High issues) = 0:

## 🟢 SECURITY GATE: PASSED

All Critical and High severity checks pass. Deployment may proceed.

If Z (Critical + High issues) > 0:

## 🔴 SECURITY GATE: BLOCKED

{N} Critical/High severity issue(s) must be resolved before deployment.

### Required Fixes:
1. [Resource Name] — [Check]: [Recommended fix with exact CloudFormation property]
2. ...

**Options:**
A. Accept proposed fixes → I will update the template and re-run security analysis
B. Provide alternative security settings → I will incorporate and re-run
C. Override: type "I accept the security risk" (will be logged as OVERRIDDEN)

The gate loops until PASSED or explicitly overridden — no shortcutting allowed.

5. Propose Fixes

For each issue, provide the exact CloudFormation YAML or JSON change needed:

# Fix: Enable S3 encryption
Properties:
  BucketEncryption:
    ServerSideEncryptionConfiguration:
      - ServerSideEncryptionByDefault:
          SSEAlgorithm: aws:kms
          KMSMasterKeyID: !Ref MyKMSKey

# Fix: Require IMDSv2 on EC2
Properties:
  MetadataOptions:
    HttpTokens: required
    HttpEndpoint: enabled

Severity Classification

References

• AWS Security Best Practices
• CIS AWS Foundations Benchmark
• AWS Well-Architected Framework - Security Pillar
• CloudFormation Security