[Presentation Report] I presented with the title "Health Checkup for Account Governance" #devio2026

"ID","Perspective","Target Service","Feature","Priority","Setting Item","Description","How to Verify"
"GOV-01","Governance","AWS Billing and Cost Management","Cost Allocation Tags","1","Enable cost allocation tags","Cost allocation tags are a setting that allows tags to be used as aggregation axes in billing reports and cost allocation. User-defined tags are inactive by default, so even if you attach tags, they will not appear in billing reports. Activation is required in the management account, and it can take up to 24 hours each for display and reflection, so enable them early. It is also recommended to use tag policies to standardize tags and unify the tag keys used for cost allocation tags.","In the management account, go to Billing and Cost Management console > Cost allocation tags and check the Status column"
"GOV-02","Governance","AWS Control Tower","Controls","3","Configure Control Tower region deny controls","Control Tower region deny has a setting that applies uniformly across the entire landing zone (AWS-GR_REGION_DENY) and a control that can be enabled per OU (CT.MULTISERVICE.PV.1). Both are disabled by default, and the 17 default regions cannot be disabled on the account side and are always available. Region restriction is recommended to prevent unauthorized resources such as cryptocurrency mining from being created in unmanaged regions, or to prevent violations of data residency requirements. The landing zone-wide setting does not allow flexible exclusion settings, but the per-OU setting allows excluding some operations, so per-OU configuration is recommended. For example, you can add certain API executions as excluded actions to use Amazon Bedrock global inference.","In the management account, go to Control Tower console > Controls > Control Catalog, find CT.MULTISERVICE.PV.1 and open it, then verify that the target OU is enabled in the 'OU is enabled' tab"
"GOV-03","Governance","AWS Control Tower","Controls","2","Enable Control Tower controls with 'Strongly recommended' guidance","Only mandatory controls are enabled by default in Control Tower; controls with 'Strongly recommended' guidance are not applied unless manually enabled. It is recommended to consider enabling them, especially controls with a 'Preventive' behavior. Preventive controls are implemented as SCP restrictions, so they can be expected to have a direct effect of preventing the operations themselves.","In the management account, go to Control Tower console > Controls > Control Catalog and search with the filter Guidance = Strongly recommended"
"GOV-04","Governance","AWS Control Tower","Landing Zone","2","Update Control Tower landing zone to the latest version","The landing zone is not updated automatically. Leaving it outdated means new features cannot be used and the latest control settings are not applied, so updating to the latest version is recommended. However, once updated, you cannot revert to a previous version, so investigate the impact in advance and update incrementally. If there are multiple OUs, it is recommended to re-register them starting from the lowest-risk OU.","In the management account, go to Control Tower console > Landing zone settings and check the current version and available updates"
"GOV-05","Governance","AWS Control Tower","Landing Zone","1","Verify that no errors are displayed in the Control Tower status","Check whether OUs and policies managed by Control Tower have been changed outside of Control Tower and are in a state that deviates from the expected configuration. For example, we occasionally see situations where resources conflict and re-registration cannot be completed normally after moving a specific account to a different OU after initial setup.","In the management account, go to Control Tower console > Organization and check the status"
"GOV-06","Governance","AWS Control Tower","Automatic Account Registration","1","Enable Control Tower automatic account registration","Automatic registration is a feature that automatically applies the controls of the destination OU to accounts moved between OUs. It is off by default, and the controls of the destination are not applied.","In the management account, go to Control Tower console > Landing zone settings and check the state of the automatic account registration setting"
"GOV-07","Governance","AWS IAM","Root Access Management","3","Delete root user credentials for member accounts","Root access management is a feature that deletes and manages root user credentials of member accounts from the management account or delegated administrator. It is disabled by default, so if the root user's email address is hijacked, the password could be reset and someone could sign in as the root user. It is recommended to enable both 'Manage root credentials' and 'Privileged root actions in member accounts', and delete root user credentials for existing members.","In the management account, go to IAM console > Root access management, switch to 'List' view, and verify that 'Root user credentials' for all member accounts shows 'Does not exist'"
"GOV-08","Governance","AWS Organizations","Management Account","3","Minimize the use and access of the management account","The management account is the account with the highest authority in the organization, and policies such as SCPs are not applied to it. Since compromise or accidental operations can cause damage throughout the organization, limit its use to tasks that can only be done in the management account, and regularly review the people who have access and the managers of root credentials.","(Example) Check the usage charges for the management account, check access permissions to the management account in IAM Identity Center"
"GOV-09","Governance","AWS Organizations","Policies","3","Configure SCPs","SCPs are policies that restrict the permissions available to member accounts as an organization. By default, there are no settings and all operations are allowed. Consider settings such as denying the use of expensive EC2 instance types. Designing with a Deny approach is easier to manage. Note that SCPs do not apply to the management account.","In the management account, go to AWS Organizations console > Policies > Service control policies, open each policy, and verify in the 'Targets' tab that it is attached to Root or an OU"
"GOV-10","Governance","AWS Organizations","Policies","2","Configure EC2 policies","EC2 policies are declarative policies that collectively configure VPC BPA, public blocking for AMIs and snapshots, IMDS defaults, and more from the organization. They are not attached by default and left to individual account and region settings, so settings may be missed in new accounts or regions. Check the current state with the account status report before applying.","In the management account, go to AWS Organizations console > Policies > EC2 policies, open each policy, and verify in the 'Targets' tab that it is attached to Root or an OU"
"GOV-11","Governance","AWS Organizations","Policies","2","Configure S3 policies","S3 policies are declarative policies that collectively configure account-level S3 Block Public Access as an organization. By default, there are no settings, and account administrators can disable Block Public Access and create public buckets. Consider enabling Block Public Access in bulk at the Root or OU level. Note that once set via policy, it cannot be changed at the account level.","In the management account, go to AWS Organizations console > Policies > S3 policies, open each policy, verify in the 'Targets' tab that it is attached to Root or an OU, and in the 'Content' tab that public_access_block_configuration is set to all"
"GOV-12","Governance","AWS Organizations","Policies","2","Configure backup policies","Backup policies are policies that distribute AWS Backup backup plans from the organization to each account. By default, there are no settings, and whether backups exist is left up to each account, resulting in missed backups per account and inconsistent recovery methods. Consider distributing them to OUs that hold important data. As a related setting, you can also consider opting in to AWS Backup in the Control Tower settings.","In the management account, go to AWS Organizations console > Policies > Backup policies and verify that the target backup policy exists"
"GOV-13","Governance","AWS Organizations","Policies","2","Configure GuardDuty policies","GuardDuty policies are policies that collectively enable Amazon GuardDuty and each protection plan (S3 Protection, Runtime Monitoring, etc.) from the organization at the Root, OU, or account level. By default, there are no settings and it is left to per-region auto-enable settings or manual work per account, so enablement may be missed in new accounts or regions. Consider configuring it per OU, specifying the target regions.","In the management account, go to AWS Organizations console > Policies > GuardDuty policies and verify that the target GuardDuty policy exists"
"GOV-14","Governance","AWS Organizations","Policies","2","Configure Inspector policies","Inspector policies are policies that collectively enable Amazon Inspector and scan types (EC2, ECR, Lambda, code scanning, etc.) from the organization at the Root, OU, or account level. By default, there are no settings and enablement is left to each account, so vulnerability scanning may be missed in new accounts.","In the management account, go to AWS Organizations console > Policies > Inspector policies and verify that the target Inspector policy exists"
"GOV-15","Governance","AWS Organizations","Policies","1","Configure RCPs","RCPs are policies that restrict access to resources within the organization as an organization. While SCPs restrict operations by identities within the organization, RCPs restrict access to resources including identities outside the organization. By default, there are no settings and all access is allowed. Consider settings such as denying access to S3 or KMS from identities outside the organization. Note that RCPs do not apply to resources in the management account.","In the management account, go to AWS Organizations console > Policies > Resource control policies, open each policy, and verify in the 'Targets' tab that it is attached to Root or an OU"
"GOV-16","Governance","AWS Organizations","Policies","1","Configure tag policies","Tag policies are policies that standardize tag key notation and allowed values as an organization. By default, there are no settings, and inconsistent tag notation or resources without tags will prevent cost allocation, ABAC, and automation from functioning. Consider checking compliance status with reports before enforcing. Note that tag policies cannot enforce the act of tagging itself. Also note that non-compliant tagging is not blocked unless enforced_for is specified.","In the management account, go to AWS Organizations console > Policies > Tag policies and verify that the target tag policy exists"
"GOV-17","Governance","AWS Organizations","Policies","1","Configure AI services opt-out policies","AI services opt-out policies are policies that, as an organization, deny AWS AI services from using customer content to improve services. By default, there are no settings and it is treated as opt-in, so customer content may be used for service improvement and stored outside the region of use. Consider opting out at the Root level to avoid violating data residency or contractual requirements.","In the management account, go to AWS Organizations console > Policies > AI services opt-out policies and verify that the target AI services opt-out policy exists"
"SEC-01","Security","AWS CloudTrail","Trails","3","Create an organization trail in CloudTrail","By default, there are no trails, and only 90 days of management events per region remain in the event history. Since investigations older than 90 days and cross-organization analysis are not possible, create an organization trail and aggregate logs to S3 in the log archive account. If using Control Tower, it is recommended to opt in to AWS CloudTrail logging in the landing zone settings. When opted in, the organization trail and aggregation to the log archive account are automatically configured. Note that after enabling the organization trail, if trails created per account remain, consider deleting them. This is because the first trail recording management events is free, but charges apply for the second and subsequent trails.","In the management account (or delegated administrator), go to CloudTrail console > Trails and verify that there is a trail with 'Organization trail' set to 'Yes'"
"SEC-02","Security","AWS Config","Settings","3","Enable AWS Config","AWS Config is a feature that records resource configurations and change history. By default, nothing is recorded and it needs to be enabled per region. Since configuration change history will not be retained and most Security Hub CSPM controls will also not be evaluated, enable it. If using Control Tower, it is recommended to opt in to AWS Config in the landing zone settings to enable it.","In each account, go to Config console > Settings and verify that the recorder shows 'Recording is on'"
"SEC-03","Security","AWS Control Tower","Account Factory","1","Configure Account Factory to not create VPCs in new accounts","Account Factory is a feature that creates new accounts in Control Tower. With the default network settings, every time an account is created, a VPC is created in all available regions. The CIDR is also the same for all accounts by default. If unused VPCs remain in all regions, unmanaged networks increase, and when connecting networks later, CIDRs may overlap. It is recommended to design and create VPCs separately according to workload requirements and configure Account Factory to not create VPCs. Note that this setting only applies to accounts created going forward and the VPCs of already created accounts will remain.","In the management account, go to Control Tower console > Account Factory > Network configuration and verify that 'Internet-accessible subnets' is 'Not allowed' and 'Maximum number of private subnets' is 0, or that no regions are selected for VPC creation"
"SEC-04","Security","Amazon Detective","Graph","1","Enable Amazon Detective","Amazon Detective is an investigation platform that supports root cause analysis of incidents based on logs. It is disabled by default, and root cause analysis after detection takes time, so enable it with the same delegated administrator as GuardDuty. Note that only data collected after enabling can be analyzed; periods before enabling cannot be retroactively analyzed.","Open the Detective console and verify that the Overview page is displayed"
"SEC-05","Security","Amazon EBS","Default Encryption","2","Enable EBS default encryption","EBS default encryption is disabled by default (setting per region).","In each account, go to EC2 console > Dashboard > Account attributes > Data protection and security > EBS encryption and check"
"SEC-06","Security","AWS IAM","Root User","3","Set up MFA for the root user","Registration of an MFA device for the root user is left to the user's own action. In older accounts, it may remain unregistered. If the root is hijacked, the entire account can be taken over. Register MFA for the root user. For member accounts, it is recommended to delete root user credentials themselves using root access management.","In the management account, go to IAM console > Credential report > Download credential report → verify that mfa_active for the <root_account> row is true"
"SEC-07","Security","AWS IAM","IAM Users","3","Eliminate IAM users and long-term access keys","IAM users do not exist by default, but users and keys created in the past tend to be left behind. Since access key leakage is one of the top causes of intrusions, move people to Identity Center and workloads to IAM roles to eliminate long-term credentials. If you currently have operations using access keys, check whether there are alternative methods such as OIDC connections, and configure systems to avoid using access keys as much as possible.","In each account, go to IAM console > Users to check for IAM users → download the credential report from Credential report to check the last rotation date and last used date of access keys"
"SEC-08","Security","IAM Access Analyzer","External Access Analyzer","2","Create an external access analyzer","The external access analyzer is a feature that detects whether S3, KMS, IAM roles, snapshots, etc. are being shared externally. It is not created by default, and the analysis target is limited to resources in the region where it was created, so create it in all regions.","Go to IAM console > Access Analyzer > Analyzer settings and verify that there is an analyzer with a finding type of 'External access'. If a delegated administrator is configured, verify from that account"
"SEC-09","Security","AWS IAM Identity Center","Organization Instance","2","Enable IAM Identity Center organization instance","IAM Identity Center is a feature that centrally manages human access to multiple accounts within an organization using permission sets. It is not introduced by default, and without it, IAM users proliferate and long-term credentials or accounts of former employees remain, so introduce it.","In the management account, go to IAM Identity Center console > Settings > Details and verify that the instance type is 'Organization instance'"
"SEC-10","Security","AWS IAM Identity Center","Identity Source","2","Enforce MFA on the external IdP side","When using an external IdP, the Identity Center side does not show an MFA configuration field, and whether MFA is required is left to the IdP side settings. If MFA is not enforced on the IdP side, users can sign in to AWS with just a password, so enforce it on the IdP side.","-"
"SEC-11","Security","AWS IAM Identity Center","Permission Sets","2","Set short session durations in IAM Identity Center","Session duration is the time you can use the service after signing in once without re-authentication. The longer it is when a device is stolen or a token is leaked, the more time it can be misused, so keep it as short as necessary for business needs.","In the Identity Center management account (or delegated administrator), go to IAM Identity Center console > Settings > Authentication tab > Session duration to check the user interactive session → go to Permission sets > each permission set details to check the session duration"
"SEC-12","Security","AWS Organizations","Management Account","2","Enable security services in all active regions, including the management account","Security services such as GuardDuty and Security Hub CSPM need to be enabled per region. When SCPs restrict regions, central configuration or Organizations integration often specifies the allowed regions for enablement. However, since SCPs do not apply to the management account, even though regions other than the allowed regions can be used in the management account, there may be regions where security services are not enabled. Therefore, when designing security service enablement, it is recommended to design the management account and other member accounts separately, and configure them so that there are no gaps in enablement in the management account.","-"
"SEC-13","Security","AWS Security Hub CSPM","Security Standards","2","Enable Security Hub CSPM","Security Hub CSPM is a feature that continuously evaluates misconfigurations against security standards (formerly known as AWS Security Hub). It is disabled by default. Start by enabling FSBP. Centralized management with central configuration is desirable.","In the home region of the delegated administrator, go to Security Hub CSPM console > Settings > Configuration, and verify that there is a policy in Central configuration. In the Organization tab, verify that the policy status for each OU is 'Applied'"
"SEC-14","Security","AWS Security Hub CSPM","Controls","1","Turn on consolidated control findings in Security Hub CSPM","Consolidated control findings is a setting that generates only one finding per check even when the same control is included in multiple security standards. If left off, findings are generated per standard, so if you use multiple standards, alerts for the same misconfiguration are split by the number of standards. When enabling Security Hub CSPM from the console, it is generally on by default, but depending on the enablement method, it may not be on by default. In particular, when enabled with central configuration, it remains off by default, so it is recommended to turn it on. Note that turning it on changes some fields in findings, so verify that your notification mechanisms are not affected before changing the setting.","In the delegated administrator, go to Security Hub CSPM console > Settings > General > Controls and verify that 'Consolidated control findings' is 'On'"
"SEC-15","Security","AWS Systems Manager","Documents","1","Block public sharing of SSM documents","SSM documents are definitions of procedures and scripts executed in Systems Manager. Blocking public sharing is disabled by default, and documents can be published to all AWS accounts. Block public sharing to prevent credentials or internal information in scripts from being exposed. Note that enabling the block does not change the sharing status of already published documents, so also check whether there are any already published documents.","In each account, go to Systems Manager console > Documents > Preferences > Block public sharing (with all AWS accounts) and verify that 'Block public sharing setting' is 'On'"
"OPS-01","Operations","AWS Account Management","Alternate Contacts","2","Register alternate contacts for all accounts","Alternate contacts are a setting that delivers AWS notifications to recipients other than the root user. By default, they are not registered and communications only reach the root user's email address. Register a team mailing list to prevent delayed initial responses when fraud, security notifications, or billing communications do not reach the responsible person.","In the management account, go to Organizations console > AWS accounts > target account > Contact information tab > Alternate contacts and verify that Billing contact, Operations contact, and Security contact are registered and not 'None'"
"OPS-02","Operations","AWS Backup","Copy","2","Copy backups to a different account and different region","By default, cross-account backup is disabled and only the management account can enable it. If backups only exist in the same account and region, they will be lost along with the account if the account is compromised or if there is a regional outage. Copy to a central backup account or a different region as a precaution. If using Control Tower, also consider opting in to AWS Backup in the landing zone settings.","In each account, go to AWS Backup console > Backup plans > target plan and check the copy destination in the backup rule"
"OPS-03","Operations","AWS Budgets","Budgets","2","Set budgets and alerts with AWS Budgets","No budgets are created by default. Without budgets, you will not notice budget overruns or unexpected charges until the end-of-month invoice, so set up alerts for actuals and forecasts.","In the management account, go to Billing and Cost Management console > Budgets and check the target budgets"
"OPS-04","Operations","Amazon CloudWatch Logs","Log Group Retention Period","2","Set retention periods for log groups","The default retention period is indefinite, and log groups automatically created by Lambda and others are the same. If left as is, storage costs will keep increasing. Be careful when setting a short period on groups that already have data, as old logs will be deleted immediately.","In each account, go to CloudWatch console > Logs > Log management > Log groups tab and verify that there are no log groups with the Retention column showing 'Never expire'"
"OPS-05","Operations","AWS Control Tower","Notifications","1","Instead of using Control Tower default notifications, notify only Config rule non-compliance","Control Tower aggregates AWS Config notifications received by the aws-controltower-SecurityNotifications topic in each region to the aws-controltower-AggregateSecurityNotifications topic in the audit account, and by default sends them to the audit account's email address. These notifications are delivered every time an AWS Config change occurs regardless of compliance or non-compliance, and remain in JSON format, making them voluminous and difficult to read. For detecting security events, it is simplest to use Security Hub CSPM findings in principle. If you want to be notified of Config rule evaluation results, it is recommended to not use default notifications and instead incorporate a mechanism using Lambda functions or similar to extract and format only non-compliant evaluation results for notification.","In the audit account, go to Amazon SNS console > Topics > aws-controltower-AggregateSecurityNotifications > Subscriptions tab and verify that the default subscription to the audit account's email address no longer remains"
"OPS-06","Operations","AWS Cost Anomaly Detection","Cost Monitors","1","Create a cost monitor for the entire organization with Cost Anomaly Detection","Cost Anomaly Detection is a service that detects and notifies of abnormal cost increases.","In the management account, go to Billing and Cost Management console > Cost Anomaly Detection > Cost monitors tab to check monitors → verify in the Alert subscriptions tab that there is a subscription with a monitor attached"
"OPS-07","Operations","Cost Optimization Hub","Organization Opt-in","2","Opt in to Cost Optimization Hub and AWS Compute Optimizer at the organization level","Cost Optimization Hub and AWS Compute Optimizer are services that provide recommendations for resource rightsizing and purchase options. By default, they are not opted in and no recommendations are generated, causing missed savings opportunities. Opting in at the organization level automatically includes accounts added later.","In the management account, go to Billing and Cost Management console > Cost management settings > Cost Optimization Hub tab and verify that 'Enable Cost Optimization Hub' and 'Enable Cost Optimization Hub for all member accounts' are on → go to Compute Optimizer console > Settings > Account management > Organization opt-in by account and verify that all accounts have an opt-in status of 'Active'"
"OPS-08","Operations","AWS Health","Organization View","1","Enable AWS Health organization view","Organization view is a feature that allows viewing Health events (maintenance and deprecation notices) for all accounts in one place. It is disabled by default, and events before enabling cannot be viewed. Enable it early to avoid missing events when checking account by account.","In the management account, go to AWS Health Dashboard > Organizational view > Settings and verify that 'Enable AWS Health organization view' shows 'Successful'"
"OPS-09","Operations","Amazon S3","Lifecycle Configuration","2","Configure lifecycle rules for S3 buckets such as log buckets","By default, no lifecycle is configured and objects are stored permanently in S3 Standard. Since the volume of logs and archives keeps increasing, storage costs will keep rising if left as is. Configure transitions to Glacier and similar, and deletion of expired or non-current versions.","In each account, go to Amazon S3 console > General purpose buckets > target bucket such as log buckets > Management tab > Lifecycle rules and check whether there are rules for transitions, expiration deletion, and non-current version deletion"
"OPS-10","Operations","Amazon SNS","Notification Infrastructure","3","Notify on various findings","Existing services do not have a mechanism to collectively notify findings. Therefore, a notification mechanism needs to be built custom. It is possible to aggregate finding information from GuardDuty, Security Hub CSPM, Inspector, AWS Health, etc., format the text via EventBridge and Step Functions, and then notify from the notification infrastructure.","-"

The attached CSV contains AWS account governance inspection items (42 items).
Please check whether each item is configured, referring to the "How to Verify" field.
When operating the AWS environment, perform only read-only operations and do not make any configuration changes.
For items that cannot be determined, group them by perspective and ask me questions.
Sum the "Priority" of configured items and determine the grade as
A (90% or above) / B (70–89%) / C (50–69%) / D (below 50%) against a perfect score of 80 points.
Finally, list the unconfigured items in order of highest priority.