MSR

At AWS, security is our top priority. Partner Migration Security Requirements (MSR) is an APJ Core team initiative to help our partners migrate their custom's workloads securely to AWS.

MSR details security requirements that partners should implement controls for, in line with 5 core security themes of identity and access management, 61 logging and monitoring, infrastructure security, data protection, and incident response. clubbed with additional best practices. MSR will be used by both internal stakeholders like Migration PSA's, relevant account teams and external stakeholders like consulting, migration, and GSI partners to elevate the security posture of workloads being migrated to cloud and ensure ongoing elevated security posture.
Read more

Category	Rule ID	Compliance Status	Description	Reference
CW.	1	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
CW.	2	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
CW.	3	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
CW.	4	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
CD.	1	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IAM.	1	Need Attention	[ManagedPolicyFullAccessOneServ] - Limit permissions. [GLOBAL]Role::AWSReservedSSO_AWSOrganizationsFullAccess_159dbe7c34ff4f78, Role::AWSReservedSSO_AWSPowerUserAccess_7a9fc77c08f63f11, Role::AWSReservedSSO_YoPayment-AWS-Developer-Pgw-Dev_c207ab9d1e5199f5, Role::PyraCloudRole, Role::YoPayment-AWS-Terraform-Pgw-Dev [FullAdminAccess] - Limit permissions. [GLOBAL]Role::aws-controltower-AdministratorExecutionRole, Role::AWSControlTowerExecution, Role::AWSReservedSSO_AWSAdministratorAccess_6ad2f92126b0c1d0, Role::AWSReservedSSO_YoPayment-AWS-Admin-Pgw-Dev_999b53209cafbc21, Role::stacksets-exec-bb8cf4473e8495ef76fab8d8a00a5618 [InlinePolicyFullAccessOneServ] - Limit access in policy [GLOBAL]Role::AWSReservedSSO_YoPayment-AWS-Data-Pgw-Dev_5af8cd0c694d6669, Role::AWSReservedSSO_YoPayment-AWS-Developer-Pgw-Dev_c207ab9d1e5199f5, Role::AWSReservedSSO_YoPayment-AWS-Platform-Pgw-Dev_c9b162f22c1c139b, Role::YoPayment-AWS-Terraform-Pgw-Dev [InlinePolicyFullAdminAccess]	AWS Docs AWS Docs Organization GuardRail Blog AWS Docs
IAM.	2	Compliant	[rootConsoleLogin30days] [rootConsoleLoginFail3x]
IAM.	3	Compliant	[rootHasAccessKey]
IAM.	4	Need Attention	[rootMfaActive] - Enable MFA on root user [GLOBAL]User::root_id	AWS MFA IAM Best Practices
IAM.	5	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IAM.	6	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
DP.	1	Need Attention	[MacieToEnable] - Enable Macie [ap-southeast-1]Macie [us-east-1]Macie [GLOBAL]Macie	Getting started with Amazon Macie
DP.	2	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
DP.	3	Compliant	[PublicAccessBlock]
DP.	4	Need Attention	[BucketVersioning] - Enable Versioning [ap-southeast-1]Bucket::archiver-system.dev.sg.pgw, Bucket::images-upload.dev.sgp-pay1-wallet, Bucket::logs.dev.sg.pgw	AWS Docs Manage Versioning Example
DP.	5	Need Attention	[MFADelete] - Enable MFA Delete [ap-southeast-1]Bucket::262130478988-pgw-dev-tf-state, Bucket::archiver-system.dev.sg.pgw, Bucket::images-upload.dev.sg.pgw, Bucket::images-upload.dev.sgp-pay1-wallet, Bucket::logs.dev.sg.pgw, Bucket::payment-gateway-dev-tf-state, Bucket::pgw-config.dev.sg.pgw	Prevention for Accidental Deletions on S3 AWS Docs
DP.	6	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
DP.	7	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
DP.	8	Compliant	[DBwithoutSecretManager] [DBwithSomeSecretsManagerOnly] [Secret__NoRotation] [Secret__NotUsed7days]
DP.	9	Compliant	[ServerSideEncrypted]
DP.	10	Compliant	[lambdaPublicAccess]
DP.	11	Compliant	[KeyRotationEnabled]
DP.	12	Compliant	[AdminIsGrantor]
DP.	13	Compliant	[SnapshotRDSIsPublic] [snapshotEBSIsPublic]
DP.	14	Need Attention	[ELBSGRulesMatch] - ALB SG Rules Config [ap-southeast-1]ELB::pgw-dev-alb, ELB::pay1-wallet-dev-alb	Security groups for Applicatoin Load Balancers
DP.	15	Compliant	[SQLServerEOL]
DP.	16	Compliant	[PubliclyAccessible] [SecurityGroupIPRangeNotPrivateCidr]
LM.	1	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
LM.	2	Compliant	[NeedToEnableCloudTrail]
LM.	3	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
LM.	4	Need Attention	[CloudWatchLogsLogGroupArn] - CloudWatch for CloudTrail [ap-southeast-1]Cloudtrail::SWOCloudTrail-Organizational	Using CloudWatch Logs with CloudTrail
LM.	5	Compliant	[HasOneMultiRegionTrail]
LM.	6	Need Attention	[MacieToEnable] - Enable Macie [ap-southeast-1]Macie [us-east-1]Macie [GLOBAL]Macie	Getting started with Amazon Macie
LM.	7	Compliant	[EnableTrailS3BucketLogging]
LM.	8	Compliant	[EnableTrailS3BucketMFADelete]
LM.	9	Compliant	[ServerSideEncrypted]
LM.	10	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
LM.	11	Need Attention	[supportPlanLowTier] - Subscribe to the AWS Business Support tier (or higher) [GLOBAL]Account::Config	AWS Support Plan Guide
LM.	12	Need Attention	[BucketLogging] - Enable Server Access Logging [ap-southeast-1]Bucket::262130478988-pgw-dev-tf-state, Bucket::archiver-system.dev.sg.pgw, Bucket::images-upload.dev.sgp-pay1-wallet, Bucket::logs.dev.sg.pgw, Bucket::payment-gateway-dev-tf-state, Bucket::pgw-config.dev.sg.pgw	AWS Docs
LM.	13	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
LM.	14	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
LM.	15	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	1	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	2	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	3	Compliant	[enableGuardDuty]
IP.	4	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	5	Compliant	[EC2InstanceAutoPublicIP]
IP.	6	Compliant	[EC2SubnetAutoPublicIP]
IP.	7	Need Attention	[WAFAssociation] [ELBEnableWAF] - ALB Web Application Firewall [ap-southeast-1]ELB::pgw-dev-alb, ELB::pay1-wallet-dev-alb	AWS WAF for Applicatoin Load Balancers
IP.	8	Compliant	[EnableTrailS3BucketMFADelete]
IP.	9	Compliant	[DBwithoutSecretManager] [DBwithSomeSecretsManagerOnly] [Secret__NoRotation] [Secret__NotUsed7days]
IP.	10	Need Attention	[SGDefaultDisallowTraffic] - Default Security Group with Rules [us-east-1]SG::sg-03ec10c6bdf83dac6 [SecurityGroupDefault]	VPC default security group rules
IP.	11	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	12	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	13	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	14	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IP.	15	Compliant	[ASGIMDSv2]
IP.	16	Compliant	[lambdaRuntimeUpdate]
IR.	1	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	2	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	3	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	4	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	5	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	6	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	7	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	8	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	9	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	10	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.
IR.	11	Not available	Please refer to the Partner Security Requirement (PSR) ID section for further details in the main sheet in the Partner Migration Security Requirements (MSR) sheet. Kindly upload the artefacts in the Artefacts tabs in the MSR sheet corresponding to the respective PSR ID.