Assess AWS Account Baseline

Your AWS account starts secure by default, but over time human decisions — open security groups, long-lived access keys, unused roles — quietly erode that baseline. Most breaches don't come from sophisticated attacks; they come from basic misconfigurations that were never assessed. This lesson gives you a repeatable method to assess your AWS account baseline so you can see your real attack surface before an attacker does.

The problem this lesson solves

When you spin up a new AWS account, the defaults are reassuringly locked down. But then you add users, open ports, create buckets, and attach policies — and suddenly you have no idea what's exposed. The core problem is visibility: without a systematic baseline assessment, you can't answer simple questions like:

• Which security groups allow SSH from anywhere (0.0.0.0/0)?
• How many IAM users have active access keys older than 90 days?
• Are any S3 buckets publicly readable?
• Does the root account have MFA enabled?

These questions matter because attackers scan the entire public IPv4 address space in minutes. An open port or a public bucket is an invitation. Manual checks are tedious and error-prone — you need a baseline process you can repeat, automate, and act on.

Core concept / mental model

Think of your AWS account baseline as a snapshot of your security posture at a point in time. It's like taking a photograph of your house before you leave on vacation: you check the doors are locked, the windows are shut, and no valuables are visible. The baseline is your list of checks — a set of measurable criteria that tell you whether your account is safe enough.

A baseline assessment answers three fundamental questions:

1. What is exposed? — Open network ports, public S3 buckets, overly permissive IAM policies.
2. What is stale? — Old access keys, unused IAM roles, abandoned resources.
3. What is missing? — MFA on root, CloudTrail logging, S3 versioning, encryption.

Pro tip: The baseline is not a one-time audit. It's a living artifact — you should re-run it after every significant change and on a regular schedule (ideally monthly).

Key definitions

• Baseline: A documented set of security checks and their expected values.
• Assessment: The process of comparing your actual account state against the baseline.
• Drift: When your account state no longer matches the baseline (e.g., a developer opens a port and forgets to document it).

How it works step by step

Assessing your AWS account baseline is a structured, repeatable process. Here's the logical flow:

Step 1: Define your baseline criteria

Before you check anything, write down what "secure" means for your account. For example:

• No security group allows ingress from 0.0.0.0/0 on SSH (port 22) or RDP (port 3389).
• All S3 buckets are private unless explicitly marked public for a specific use case.
• Root account has MFA enabled and no access keys.
• CloudTrail is enabled in all regions and logs are protected.
• No IAM user has both console access and an active access key older than 90 days.

Step 2: Gather data from AWS APIs

Use the AWS CLI or SDKs (like boto3) to query your account. You'll pull data on IAM users, groups, roles, S3 buckets, security groups, and more.

Step 3: Compare against the baseline

For each check, compare the actual data to your criterion. Flag anything that deviates.

Step 4: Remediate findings

Fix the issues you find — remove open ports, rotate keys, enable MFA, etc.

Step 5: Schedule re-assessment

Automate the checks so you get notified when drift occurs.

Hands-on walkthrough

Let's put theory into practice with a simple baseline assessment using the AWS CLI and Python. We'll check three things: open security groups, public S3 buckets, and root MFA status.

Prerequisites

• AWS CLI installed and configured with credentials that have read access to IAM, EC2, and S3.
• Python 3.10+ with boto3 installed (pip install boto3).

Example 1: Check for open security groups

# List all security groups with their inbound rules
aws ec2 describe-security-groups --query 'SecurityGroups[*].{ID:GroupId, Ports:IpPermissions[*].FromPort, IPs:IpPermissions[*].IpRanges[*].CidrIp}' --output json

Expected output snippet:

[
  {
    "ID": "sg-12345678",
    "Ports": [22],
    "IPs": [["0.0.0.0/0"]]
  }
]

If you see "0.0.0.0/0" for port 22, that's a finding.

Example 2: Find public S3 buckets

import boto3

def find_public_buckets():
    s3 = boto3.client('s3')
    public_buckets = []
    try:
        buckets = s3.list_buckets()['Buckets']
        for bucket in buckets:
            name = bucket['Name']
            try:
                acl = s3.get_bucket_acl(Bucket=name)
                for grant in acl['Grants']:
                    if grant['Grantee'].get('URI') == 'http://acs.amazonaws.com/groups/global/AllUsers':
                        public_buckets.append(name)
                        break
            except Exception as e:
                print(f"Error checking {name}: {e}")
    except Exception as e:
        print(f"Error listing buckets: {e}")
    return public_buckets

if __name__ == '__main__':
    print("Public S3 buckets:", find_public_buckets())

Sample output:

Public S3 buckets: ['my-company-public-assets']

Example 3: Verify root MFA status

# Check if the root account has MFA enabled
aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled' --output text

Expected output: 1 (enabled) or 0 (disabled). A 0 is a critical finding.

Compare options / when to choose what

There are several tools for assessing your AWS baseline. Here's a comparison to help you choose:

Pro tip: Start with manual checks to understand your account, then automate with Prowler or Security Hub as you grow.

Troubleshooting & edge cases

Here are common issues you'll face when assessing your baseline:

• Missing permissions: Your IAM user may not have permission to run describe-security-groups or list-buckets. You'll see AccessDenied errors. Fix: add the required policies (e.g., ReadOnlyAccess).
• Region issues: Security groups are region-specific. If you only check us-east-1, you'll miss open ports in eu-west-1. Always iterate over all regions.
• S3 ACL vs. bucket policy: A bucket might be public via a bucket policy, not just an ACL. My example only checks ACLs; you should also check get_bucket_policy_status for a complete picture.
• False positives: Public S3 buckets might be intentional (e.g., static website). Your baseline should document exceptions.
• Stale data: If you run the assessment infrequently, you might miss new expose. Set up a schedule or use CloudWatch Events.

Example error:

An error occurred (AccessDenied) when calling the ListBuckets operation: User: arn:aws:iam::123456789:user/bob is not authorized to perform: s3:ListBucket

Fix: Attach the AmazonS3ReadOnlyAccess policy to your user.

What you learned & what's next

You now understand the core idea behind assessing your AWS account baseline: it's a repeatable, data-driven way to check your account for common exposure. You've completed a practical exercise using the AWS CLI and boto3 to check for open security groups, public S3 buckets, and root MFA status. You also learned how to compare different assessment tools and troubleshoot common issues.

This baseline is your foundation. Next, you'll learn how to harden your IAM by reducing blast radius — making sure that even if a credential leaks, the damage is contained. That's the logical next step in your Cloud security essentials track.