This Op will identify IAM Roles and users/groups with excessive IAM permissions for data access.

 
Create policies to restrict IAM role usage by restricting access from specified locations.

 
Identify and manage IAM users and AWS cross-account roles without MFA.

 
Identify and remove default VPCs.

 
Identify and manage a collection of IAM privileges in policies that potentially increase security risk.

 
Identify and manage any access keys over a certain age.

 
Identify and manage IAM users and AWS cross-account roles without MFA.

 
Provision baseline IAM scheme for the account based on the project, environment, and organization’s policies. Then optionally enforce the roles don't change over time.

 
This Op will assess and ensure that the IAM on a particular account matches a scheme approved by the organization, without deviation. It is best for locked-down production environments.

 
After excessive privileges are assessed, revoke them by adjusting the policies.

 
Look for users and roles outside of expected admin groups that have excessive privileges. Especially with IAM rights but other restrictions on them.

 
Identify cross account roles and when they were last used. Determine which of those accounts are in the same organization. For ones not in the organization, ensure an External ID is used.

 
Remove access for users and roles not used within a certain time frame.

 
Remove access keys over a certain age.

 
Assess when users and roles were last used and disable accounts no used over a defined time period.

 
Add an MFA clause to policies associated with users or roles that have MFA required for console access.

 
Determine if MFA is enable on all users, or just a subset based on policy.

 
Create the baseline roles for the account based on our best practices or organization-specific policy. Maintain those roles over time.

 
Assess the roles in the account and which policies map to the roles, then compare to best practices or an organization-specific policy.

 
Assess if the account uses federated identity. If not, attempt to add.

 
Assess if there is a local AWS user account with super admin privileges and MFA enabled. Offer to create if not.

 
Determine if MFA is enabled, access keys are disabled, and other recommended settings are in place. Recommend hardware MFA if virtual is detected.

 
Create an alert for any IAM change in designated accounts.