AWS Security Checklist: Weighted Score and Gaps
Tick what is true for your AWS environment and get a weighted score, a score for each of eight domains and the gaps that matter most, each tied to AWS documentation. For the configuration controls of the CIS benchmark, use the CIS AWS Benchmark Checklist; this one covers the design and operating decisions around them. The reasoning is in the Secure AWS architecture guide.
- Production, development and test run in separate AWS accounts, grouped in organizational units by function and shared controls.
- Service control policies guard the dangerous actions (stopping logging, leaving the organization, unapproved Regions) and were tested on a non-production OU before wide rollout.
- The root user has MFA, no access keys and a business-managed group email address; member accounts have root credentials removed or centrally managed.
Tick a control when it is true for your organisation. Ticks stay in this browser only; nothing is sent to us.
Accounts and governance
Multi-account structure, central guardrails and the management account.
- High impact
- High impact
Identity and access
Root user, workforce access, workload credentials and least privilege.
- High impact
- High impact
- High impact
Logging and detection
Central logs you can trust and alerts that reach a person.
- High impact
- High impact
Network and compute
Reachability, instance access and metadata service settings.
- High impact
- High impact
Data protection
Public access, encryption and key policy.
- High impact
- High impact
Incident response
Preparation, evidence and practice.
- High impact
Application security
Edge filtering and building security into delivery.
Posture and drift
Benchmarks, configuration checks and external sharing review.
TL;DRWhat this checklist is
5 points
- An interactive AWS security checklist with 34 controls in eight domains: accounts and governance, identity, logging and detection, network and compute, data protection, incident response, application security, and posture and drift.
- Controls are weighted by impact. You get an exposure band, a weighted percentage, a score for each domain and the highest-impact gaps first.
- Each control says why it matters and links the AWS documentation page it comes from, read on 4 November 2026. The domains follow the areas of the Well-Architected Security Pillar.
- Free to use. Your ticks stay in this browser and nothing is sent to us. Markdown and PDF exports go through the download gate.
- It differs from the CIS AWS Benchmark Checklist: that one follows the CIS control list, this one is an architecture and operations self-assessment.
Frequently asked questions
How is the score calculated?
Each control has a weight of 1, 2 or 3 by impact. Your percentage is the weight of controls you ticked divided by the total weight. The band is Critical when three or more highest-impact controls are open, High under 50%, Moderate under 80% and Low otherwise.
How is this different from the CIS AWS Benchmark Checklist?
The CIS AWS Benchmark Checklist walks through the benchmark's configuration controls. This checklist covers the wider set of decisions around them: account structure, guardrails, identity, logging design, incident readiness and drift, mapped to the Well-Architected Security Pillar. Use both: this one to find architectural gaps, the CIS one to check settings.
Which AWS sources does it use?
AWS documentation for IAM, Organizations (SCPs and RCPs), Control Tower, IAM Identity Center, CloudTrail, GuardDuty, S3, KMS, EC2 metadata, Systems Manager, Config, Security Hub and the Well-Architected Security Pillar and Security Reference Architecture. Each control links its page.
Does it store my answers?
Only in your own browser (local storage), so you can return to it. Nothing is sent to PlayCISO servers. Clearing site data removes it.
Does ticking everything mean I am secure?
No. It means the listed controls are in place. It is a self-assessment, not an audit, and it does not test whether the controls work. Pair it with the AWS Hardening Lab and the Account Compromise Lab to rehearse decisions.
Can I download the results?
Yes, as Markdown or PDF, through the download gate. Using the checklist on the page is free.
Sources
AWS documentation pages read on 4 November 2026.
- Security Pillar: AWS account management and separation
- AWS Security Reference Architecture (AWS SRA): core architecture, introduction
- AWS SRA: The AWS Security Reference Architecture (OUs and accounts)
- AWS SRA: Security OU, Security Tooling account
- AWS SRA: Security OU, Log Archive account
- AWS Organizations: Service control policies (SCPs)
- AWS Organizations: Service control policy examples
- AWS Organizations: Resource control policies (RCPs)
- AWS Control Tower: What is AWS Control Tower?
- AWS IAM: Root user best practices for your AWS account
- AWS SRA: Org Management account
- AWS IAM: Security best practices in IAM
- AWS IAM Identity Center: What is IAM Identity Center?
- AWS IAM: Temporary security credentials in IAM
- Security Pillar: Identity and access management
- AWS IAM: Revoke IAM role temporary security credentials
- AWS CloudTrail: Creating a trail for an organization
- Amazon S3: Locking objects with Object Lock
- AWS CloudTrail: Validating CloudTrail log file integrity
- AWS CloudTrail: Logging data events
- Amazon GuardDuty: What is Amazon GuardDuty?
- Security Pillar: Detection
- Amazon GuardDuty: IAM finding types
- AWS Systems Manager: Session Manager
- Amazon EC2: Use instance metadata to manage your EC2 instance (IMDSv1 and IMDSv2)
- Amazon EC2: Configure instance metadata options for new instances
- Amazon VPC: Control traffic to your AWS resources using security groups
- Security Pillar: Infrastructure protection
- AWS SRA: Workloads OU, Application account
- Amazon S3: Blocking public access to your Amazon S3 storage
- Security Pillar: Data protection
- Amazon S3: Default encryption FAQ
- AWS KMS: Key policies in AWS KMS
- AWS KMS: Deleting AWS KMS keys
- Security Pillar: Incident response
- Amazon GuardDuty: Remediating potentially compromised AWS credentials
- AWS Well-Architected Framework, Security Pillar: Security foundations (design principles, seven areas)
- AWS WAF: What is AWS WAF?
- Security Pillar: Application security
- AWS Security Hub: CIS AWS Foundations Benchmark in Security Hub CSPM
- AWS Config: What is AWS Config?
- AWS IAM: What is IAM Access Analyzer?
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.