SecureSpect AWS Coverage at a Glance

SecureSpect connects to your AWS account using a read-only cross-account IAM role — no access keys, no write permissions, no changes to your infrastructure. Across 29 services it runs 65+ automated control checks that map directly to the SOC 2 Trust Services Criteria (Common Criteria series).

This post documents every service, what SecureSpect checks, and the SOC 2 controls each check satisfies.

---

Identity and Access Management (IAM)

What SecureSpect checks:

• All IAM users with console access have MFA enabled
• The root account has MFA enabled
• No active access keys exist for the root account
• User access keys are rotated within 90 days
• IAM users with no activity in 90 days (inactive accounts)
• Password policy meets minimum complexity requirements

SOC 2 controls: CC6.1 (authentication, credential management), CC6.2 (access provisioning and deprovisioning)

IAM is the foundation of every other AWS security check. A weak IAM configuration undermines all downstream controls.

---

Amazon S3

What SecureSpect checks:

• Public access block settings are enabled at the account and bucket level
• Buckets enforce SSL-only access (bucket policy denies HTTP)
• Server-side encryption is enabled on all buckets
• Versioning is enabled (for backup and recovery evidence)

SOC 2 controls: CC6.6 (boundary protection), CC6.7 (encryption at rest and in transit), CC9.1 (backup and recovery)

---

Amazon EC2

What SecureSpect checks:

• Security groups do not allow unrestricted inbound access (0.0.0.0/0) on sensitive ports
• Default security group has no ingress or egress rules

SOC 2 controls: CC6.6 (boundary protection from external threats)

---

Amazon RDS

What SecureSpect checks:

• RDS instances are not publicly accessible
• Storage encryption is enabled on all instances
• Automated backups are enabled with a retention period of at least 7 days

SOC 2 controls: CC6.6, CC6.7, CC9.1

---

AWS CloudTrail

What SecureSpect checks:

• At least one multi-region trail is enabled and logging
• Log file validation is enabled (tamper detection via SHA-256 digest files)

SOC 2 controls: CC7.1 (detection of configuration changes)

CloudTrail is typically the first check auditors ask about. A missing or non-validating trail is an immediate finding.

---

AWS KMS

What SecureSpect checks:

• Customer-managed keys (CMKs) have automatic key rotation enabled

SOC 2 controls: CC6.7 (protection of data at rest)

---

AWS Secrets Manager

What SecureSpect checks:

• Secrets have automatic rotation configured
• No secrets are unused (last accessed >90 days ago)

SOC 2 controls: CC6.1, CC6.2

---

AWS Config

What SecureSpect checks:

• At least one Config recorder is active and recording all resource types
• Config rules show no non-compliant resources

SOC 2 controls: CC7.1

---

Amazon EKS

What SecureSpect checks:

• Secrets encryption is enabled for the cluster (envelope encryption via KMS)
• Audit logging is enabled in the cluster logging configuration
• Cluster is running a supported Kubernetes version (not end-of-life)
• Endpoint access is not fully public (private or restricted public)

SOC 2 controls: CC6.6, CC6.7, CC7.1

---

Amazon ECS

What SecureSpect checks:

• Tasks are not running in host network mode
• Container Insights is enabled on clusters

SOC 2 controls: CC6.6, CC7.1

---

Amazon ECR

What SecureSpect checks:

• Scan on push is enabled for all repositories
• Image tag immutability is enabled

SOC 2 controls: CC7.1 (vulnerability detection), CC8.1 (change management)

---

AWS Lambda

What SecureSpect checks:

• Functions do not have a public function URL without authentication
• Functions are not using deprecated runtimes (end-of-life language versions)

SOC 2 controls: CC6.6, CC7.1

---

Amazon VPC

What SecureSpect checks:

• VPC flow logs are enabled for all VPCs
• Default VPC is not being used for production workloads
• Default security group has no rules

SOC 2 controls: CC6.6, CC7.1

---

AWS WAF

What SecureSpect checks:

• At least one Web ACL exists (WAF is deployed)
• WAF logging is enabled on all Web ACLs

SOC 2 controls: CC6.6, CC7.1

---

Amazon GuardDuty

What SecureSpect checks:

• GuardDuty is enabled in the account region
• No active HIGH severity findings exist

SOC 2 controls: CC7.2 (incident identification and escalation)

---

Amazon Inspector

What SecureSpect checks:

• Inspector is enabled for EC2 and ECR scanning
• No CRITICAL severity vulnerabilities are active

SOC 2 controls: CC7.1

---

AWS Auto Scaling

What SecureSpect checks:

• Auto Scaling Groups span multiple Availability Zones (no single-AZ ASGs)

SOC 2 controls: CC9.1 (backup and recovery, business continuity)

Single-AZ Auto Scaling Groups represent a single point of failure — a key risk to availability commitments.

---

Amazon ElastiCache

What SecureSpect checks:

• All cache clusters have encryption at rest enabled

SOC 2 controls: CC6.7

---

Amazon DynamoDB

What SecureSpect checks:

• Point-in-time recovery (PITR) is enabled on all tables
• Deletion protection is enabled on all tables

SOC 2 controls: CC9.1

---

Amazon SNS

What SecureSpect checks:

• All SNS topics have server-side encryption (KMS) enabled

SOC 2 controls: CC6.7

---

Amazon SQS

What SecureSpect checks:

• All SQS queues have server-side encryption enabled

SOC 2 controls: CC6.7

---

Amazon Route 53

What SecureSpect checks:

• Query logging is enabled on all public hosted zones

SOC 2 controls: CC7.1

---

Amazon CloudFront

What SecureSpect checks:

• All distributions enforce HTTPS-only viewer protocol (no HTTP allowed)
• Access logging is enabled on all distributions

SOC 2 controls: CC6.7 (HTTPS enforcement), CC7.1 (access logging)

---

Elastic Load Balancing (ALB / NLB)

What SecureSpect checks:

• No load balancers have HTTP-only listeners (all traffic should use HTTPS)
• Deletion protection is enabled on all load balancers

SOC 2 controls: CC6.7, CC9.1

---

Amazon CloudWatch Logs

What SecureSpect checks:

• All log groups have a KMS key for encryption at rest

SOC 2 controls: CC6.7

---

Amazon EventBridge

What SecureSpect checks:

• No event buses have a resource policy granting access to all principals ("Principal": "*")

SOC 2 controls: CC6.6 (boundary protection)

---

AWS Systems Manager

What SecureSpect checks:

• All managed EC2 instances are patch-compliant (SSM Patch Manager reports)

SOC 2 controls: CC7.1

---

Amazon API Gateway

What SecureSpect checks:

• Access logging is enabled on all REST API stages

SOC 2 controls: CC7.1

---

AWS Organizations

What SecureSpect checks:

• AWS Organizations is enabled
• At least one custom Service Control Policy (SCP) is attached at the root level (beyond the default FullAWSAccess)

SOC 2 controls: CC6.3 (least privilege and segregation of duties)

This check is only applicable if you're connecting a management account. Member-account connections return NOT_APPLICABLE.

---

How the Checks Map to SOC 2

|---|---|---|

---

Getting Started

Connect your AWS account to SecureSpect in under five minutes using a read-only cross-account IAM role. The first scan runs automatically and produces results across all 29 services.

See the [setup guide](/blog/aws-integration-setup-guide) for step-by-step instructions.