Encrypt buckets based on filters/tags and provided criteria for an S3 key.

 
Find public facing S3 buckets.

 
Analyze S3 bucket usage and optimize to the right storage tier to reduce costs (if possible).

 
Use tags to shut down development and other instances outside of business hours to save costs. Override with tag changes as needed.

 
Create an alert that triggers if someone uses the root account in designated accounts.

 
Create an alert that triggers instantly whenever and S3 bucket is made public.

 
Create an alert for any changes to the designated security groups in designated accounts or VPCs.

 
Create an alert for any IAM change in designated accounts.

 
Link an account into a centralized alerting infrastructure using CloudWatch Logs synchronization to a Kinesis stream. Create everything needed that isn’t there.

 
Set lifecycle policies to migrate logs to Glacier after a designated time period.

 
Ensure monitoring and alerting are properly configured, including CloudTrail, Config, CloudWatch and any configured alerts.

 
Determine if recommended settings for CloudTrail, Config, CloudWatch, and alerting are enabled.

 
Add alerts, remove alerts, or configure existing security alerts.