Check VPC peering route tables and restrict access to the minimum.

 
Based on assessment results, guide the user through tightening permissions.

 
Look for security groups that appear to have excessive permissions, such as excessive number of /32 rules.

 
Assess and recommend accounts to enable VPC flow logs.

 
Determine what VPCs are peered, which accounts are associated, and identify accounts that aren’t controlled by the enterprise.

 
Change a flat security group to remove the self referential rule.

 
Find security groups that allow all local traffic via a self referential rule.

 
Insert a load balancer in front of a web server.

 
Find anything with port 80 or 443 that is internet facing but not behind an ELB.

 
Lock a security group to prevent changes.

 
Restrict all traffic in the default security group in every VPC.

 
Adjust security group settings to only allow access to pre-defined locations.

 
Find any instances or TCP ELBs with port 22 or RDP open.

 
Identify all instances and load balancers with Internet access.