S3 buckets with public-read or public-read-write ACLs expose your data to unauthenticated internet access. Attackers actively scan for open buckets — this is one of the most exploited misconfigurations in AWS. Block Public Access must be enabled at both account and bucket level.

Security groups with 0.0.0.0/0 inbound on SSH (22), RDP (3389), or database ports (5432, 3306, 6379) expose your instances and data to brute-force attacks from anywhere on the internet. Replace with VPN-restricted CIDR rules and tiered SG model.

IAM roles with Action: "*" or AdministratorAccess violate the principle of least privilege. Compromised credentials give attackers complete control of your AWS account. Use service-specific scoped policies and enable MFA enforcement.

IAM users without MFA can be compromised via credential stuffing or phishing. Any leaked password is an immediate account takeover. The IAM Least-Privilege Blueprint includes a deny policy that blocks all API calls when MFA is not active.

Your RDS instance stores data on unencrypted EBS volumes. If the underlying storage is physically compromised, your database is exposed. Enable KMS-based encryption via a snapshot restore (encryption cannot be toggled on a running instance).

Without CloudTrail, you have no audit log of API calls — including unauthorized access attempts or privilege escalation. SOC 2, PCI-DSS, and HIPAA all require comprehensive audit logging. The IAM blueprint enables multi-region CloudTrail with log file validation.

New EBS volumes are created unencrypted by default. Enabling account-level default encryption ensures all new volumes, snapshots, and AMI copies are automatically encrypted with KMS — zero-friction compliance for new infrastructure.

Without versioning, accidentally deleted or overwritten objects are unrecoverable. Enable versioning with a lifecycle rule to expire old versions after 90 days — included in the S3 Lockdown Blueprint.

Your IAM password policy doesn't meet CIS Benchmark standards. The IAM blueprint sets minimum 14-char passwords, requires uppercase/lowercase/numbers/symbols, 90-day rotation, and 24-password reuse prevention.