Security & ComplianceWell-ArchitectedCloudAgent White-LabelPricingDocsAbout UsWhat's NewTrust CenterDocsLibraryCFN Validation
Security Controls
Service Control PoliciesResource Control PoliciesDeclarative PoliciesTag, Backup & AI Opt-Out PoliciesConfig RulesCloudWatch Alarms and Event RulesCloudFormation Guard RulesLogging & Monitoring ConfigurationsBackups & DRAuto Remediation RulesConformance PacksBilling and Cost ManagementS3 Bucket PoliciesSecurity Groups & NACLsIAM PoliciesVPC Endpoint Policies
AWS Services
VPC Security ControlsEC2 Security ControlsIAM Security ControlsS3 Security ControlsRDS Security ControlsOpenSearch/Elasticsearch Security ControlsEFS Security ControlsRoute53 Security ControlsAmazon DynamoDB & DAXECR Security ControlsEMR SecurityLambda SecurityCloudFormation SecurityCodeX Security ControlsCloudFront SecurityAWS Certificate Manager (ACM) SecurityAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallRoute53 Resolver SecurityAmazon MacieAWS WAF & ShieldAWS Secrets ManagerAWS Systems ManagerAWS KMSAWS SSOLoad Balancers & Auto ScalingRDS Event SubscriptionsAWS Resource Access Manager (RAM)Amazon ECSAmazon EKSAmazon API GatewayAWS AppConfigAmazon AppFlowAWS App MeshAWS App RunnerAWS AppSyncApplication Auto ScalingAmazon AthenaAWS BatchAWS Billing ConductorAWS Clean RoomsAWS SNSAWS SQSAWS Service DiscoveryAWS Step FunctionsAWS CloudTrailAWS ConfigAmazon EventBridgeAWS CloudWatchAWS CognitoAmazon ConnectAWS GlueAWS Data Pipeline & Data SyncAmazon DetectiveAWS DevOps GuruAmazon DocumentDBAmazon ElastiCacheAWS Elastic BeanstalkAmazon FSxAmazon MQAmazon PrometheusAmazon CassandraAmazon FinSpaceAWS Fault Injection SimulatorAmazon GameLiftAWS Global AcceleratorAmazon GrafanaAWS IoT GreenGrassAWS IoT ServicesAWS Ground StationAmazon IVS (Interactive Live Streams)Amazon KinesisAWS LakeFormationAmazon LookoutAmazon Managed BlockchainAWS Media ServicesAWS Managed Apache AirflowAWS OpsWorksAWS OrganizationsAmazon PersonalizeAmazon QLDBAmazon RedshiftAmazon RekognitionAWS Resource ExplorerAWS Resource GroupsAmazon Lex & AlexaAWS RoboMakerAmazon SageMakerAWS Service CatalogAmazon SESAWS SimSpace WeaverAWS Support AppAWS TransferAWS X-RayAWS AmplifyAWS AppstreamAWS Audit ManagerAmazon BedrockAWS Cloud9AWS CloudHSMAmazon NeptuneAmazon Quicksight
Reference Guides
AWS Account Setup GuideEC2 Security StrategyS3 Security StrategyLogging & Monitoring Strategy Guide
Configuration Packages

Declarative Policies

A repository of AWS Organizations declarative policy templates to enforce baseline configuration of AWS services across an organization, such as IMDSv2 defaults, VPC Block Public Access, Allowed AMIs, and snapshot public-access blocking. Templates can be deployed using CloudFormation, Terraform, or AWS CLI scripts.

Amazon EC2 / VPC / EBS
Block Public Internet Access to VPCs Org-Wide (VPC Block Public Access)

Centrally blocks internet-gateway ingress (or full bidirectional internet traffic) for all VPCs and subnets in scope, with an org-level switch controlling whether individual accounts may create per-VPC exclusions.

CloudFormationTerraformAWS CLI
Enforce VPC Encryption Controls for In-Transit Traffic

Moves VPCs into monitor or enforce mode for in-transit encryption, with per-resource-type exclusions (internet gateway, NAT gateway, VPC Lattice, peering, Lambda, EFS, VGW) for traffic types that cannot be encrypted.

CloudFormationTerraformAWS CLI
Enforce Allowed AMIs Org-Wide (Allowed Images Settings)

Restricts which AMIs can be discovered or launched across the organization, by owner account, marketplace product code, name pattern, age, deprecation status, or golden-AMI watermark.

CloudFormationTerraformAWS CLI
Enforce IMDSv2 Defaults for New EC2 Instances Org-Wide

Sets org-wide defaults for new EC2 instance launches: requires IMDSv2 tokens, caps the metadata hop limit, and optionally hard-enforces IMDSv2 by blocking IMDSv1 launches outright.

CloudFormationTerraformAWS CLI
Disable the EC2 Serial Console Org-Wide

Centrally disables (or enables) EC2 serial console access across the organization, removing an out-of-band access path some hardening baselines require closed.

CloudFormationTerraformAWS CLI
Block Public Sharing of AMIs and EBS Snapshots Org-Wide

The declarative-policy equivalent of blocking public AMI sharing, plus its EBS snapshot counterpart, applied as durable service-level configuration rather than an IAM deny.

CloudFormationTerraformAWS CLI

© 2026 asecurecloud. All rights reserved.