AWS
Cloud
Monitor your AWS accounts for the configuration controls auditors ask about.
AWS checks in Varman
Monitor security configurations and compliance across your AWS infrastructure. Varman runs 9 checks against AWS on a schedule and records each result as evidence.
IAM: password policy and root protections
Verify a strong IAM password policy, root MFA enabled, and no root access keys.
S3: default encryption enabled
Verify all S3 buckets have default server-side encryption enabled.
S3: public access blocked
Verify all S3 buckets have S3 Block Public Access fully enabled (account or bucket level).
EC2: no security groups open to the internet
Flags security group inbound rules that allow SSH, RDP, or all traffic from 0.0.0.0/0.
RDS: storage encryption enabled
Verify all RDS instances have storage encryption at rest enabled.
RDS: automated backups enabled
Verify all RDS instances have automated backups enabled.
KMS: customer key rotation enabled
Verify rotation-eligible customer-managed KMS keys have automatic rotation enabled.
CloudTrail: multi-region trail logging with validation
Verify a multi-region CloudTrail trail is actively logging with log file validation.
Separation of environments: production isolated from non-production
Verify production and non-production workloads run in distinct VPCs within the AWS account.
Connecting AWS
AWS IAM Role Assumption: secure cross-account access. An admin adds the details below in Varman under Integrations. Secret values are encrypted before they are stored.
- AWS Environment
- Choose the AWS partition where this account runs.
- Connection Name
- A friendly name to identify this AWS account
- Role ARN
- Paste the Role ARN from the script output above
- External ID
- A unique identifier you choose. Use the same value here AND in your IAM trust policy. Your organization ID works well for this.
- Remediation Role ARN
- Optional: A separate IAM role with write permissions for auto-remediation. The audit role stays read-only.
- Regions to scan
- Choose which AWS regions to scan for security findings