🚀Launch Week 12: March 23rd - 27th, 2026🚀

Changelog

Subscribe to Turbot changelog via RSS or join #changelog on our Slack community to stay updated on everything we ship.

Turbot changelog

What's new?

SCP and RCP objective matching has been redesigned for improved accuracy and consistency. Six multi-statement objectives have been split into single-statement sub-objectives for precise matching. RCP deny examples have been added for 18 objectives and unenforceable SCP examples have been removed. Prevention rules now include an overview field.

Prevention Fact Types

AWS Condition Scope
AWS Deny Scope

Prevention Objectives

Enforce IMDSv2 for AWS EC2 instance launch
Enforce IMDSv2 for running AWS EC2 instances
Prohibit AWS Elastic IP association
Prohibit AWS VPC peering connections
Prohibit AWS cross-region networking services
Prohibit public IP assignment at AWS EC2 instance launch
Safeguard AWS EC2 AMI block public access setting from modification
Safeguard AWS Lambda code signing configuration from modification

Removed

Enforce IMDSv2 for AWS EC2 instances
Prohibit AWS EC2 cross-region networking
Prohibit AWS EC2 instance internet access

Prevention Examples

Allow approved AWS services
Allow resources in approved AWS regions
Block all public sharing of AWS EBS snapshots
Block inbound and outbound internet connections to your VPCs through an internet gateway (IGW) or egress-only internet gateway (EIGW)
Block public sharing of AWS Machine Images (AMIs)
Deny API actions over insecure transport for AWS S3
Deny AWS Virtual Private Network (VPN) connections
Deny EC2 instance launch without IAM instance role
Deny IAM user management actions without MFA
Deny access key creation for AWS IAM users
Deny access key operations for AWS IAM root user
Deny actions as a root user
Deny all AWS IAM root user actions
Deny creation of AWS IAM users
Deny creation of access keys for the root user
Deny cross region replication for S3 buckets
Deny deletion of AWS IAM support access role
Deny deletion of AWS VPC flow logs
Deny direct permissions attachment to AWS IAM users
Deny disablement and deletion of AWS KMS keys
Deny disablement of AWS Security Hub configuration
Deny disablement of amazon inspector configuration
Deny full access policy attachment for AWS CloudShell
Deny insecure transport at resource level for AWS S3
Deny modification of AWS CloudTrail configuration
Deny modification of AWS CloudWatch alarms
Deny modification of AWS Config configuration
Deny modification of AWS DynamoDB table point in time recovery configuration
Deny modification of AWS EBS encryption by default configuration
Deny modification of AWS EBS snapshot block public access configuration
Deny modification of AWS EC2 IMDS default settings
Deny modification of AWS EC2 image block public access configuration
Deny modification of AWS EC2 serial console access configuration
Deny modification of AWS IAM Access Analyzer configuration
Deny modification of AWS IAM role configuration
Deny modification of AWS IAM role trust policy configuration
Deny modification of AWS S3 account public access block configuration
Deny modification of AWS S3 bucket encryption configuration
Deny modification of AWS S3 bucket lifecycle policy configuration
Deny modification of AWS S3 bucket logging configuration
Deny modification of AWS S3 bucket logging configuration
Deny modification of AWS VPC network ACL rules
Deny modification of AWS VPC route tables
Deny modification of AWS VPC security group rules
Deny modification of AWS VPC security group rules
Deny modification of AWS account alternate security contact
Deny modification of AWS account contact information
Deny policy changes to an AWS S3 bucket
Deny public function URLs for AWS Lambda
Deny public resource policies for AWS Lambda functions
Deny publicly accessible creation for AWS RDS DB instances
Deny removal of AWS IAM permission boundaries
Deny removal of AWS IAM root user MFA devices
Deny removal of AWS IAM user MFA devices
Deny replication configuration for AWS S3 buckets
Deny resource creation without security classification tags
Deny resources in unapproved AWS regions
Deny resources in unapproved regions
Deny resources in unapproved regions in landing zone
Deny sharing of public AWS EBS snapshots
Deny single-AZ creation for AWS RDS DB instances
Deny the use of AWS EC2 VM import and export
Deny the use of deprecated AWS EC2 RequestSpotFleet and RequestSpotInstances API actions
Deny unapproved AWS EC2 instance types
Deny unapproved AWS services
Deny unencrypted creation for AWS EBS volumes
Deny unencrypted creation for AWS EFS file systems
Deny unencrypted creation for AWS RDS DB instances
Deny unencrypted listeners for AWS Elastic Load Balancing
Deny versioning changes for AWS S3 buckets
Deny virtual MFA operations for AWS IAM root user
Deny weakening of AWS IAM account password policy
Deny weakening of AWS IAM account password policy
Deny weakening of AWS IAM account password policy
Deny wildcard administrative policy attachment for AWS IAM
Disable AWS EC2 Serial Console access
Disable access to the EC2 serial console for all EC2 instances
Enable AWS EBS Snapshot Block Public Access for account
Enable AWS EBS encryption by default for account
Enable AWS EC2 Image Block Public Access
Enable account-level Block Public Access for AWS S3
Enable account-level Block Public Access for AWS S3
Enable account-level Block Public Access for AWS S3
Enable account-level Block Public Access for AWS S3
Enforce AWS GuardDuty enablement
Enforce Access Logging for AWS S3 Buckets
Enforce Block Public Access for AWS S3 accounts
Enforce Block Public Access for AWS S3 accounts
Enforce Block Public Access for AWS S3 accounts
Enforce Block Public Access for AWS S3 accounts
Enforce Block Public Access for AWS S3 buckets
Enforce Block Public Access for AWS S3 buckets
Enforce Block Public Access for AWS S3 buckets
Enforce Block Public Access for AWS S3 buckets
Enforce HTTPS-only access for AWS S3 buckets
Enforce IAM instance roles for AWS EC2 instances
Enforce IMDSv2 defaults for AWS EC2 account attributes
Enforce IMDSv2 for AWS EC2 instances
Enforce IMDSv2 for running AWS EC2 instances
Enforce MFA Delete for AWS S3 buckets
Enforce Multi-AZ deployments for AWS RDS DB instances
Enforce approved AMI sources for AWS EC2 instances
Enforce approved accounts for AWS Lambda functions
Enforce approved images for AWS EC2 AMIs
Enforce approved instance types for AWS EC2 instances
Enforce auto minor version upgrade for AWS RDS DB instances
Enforce block public ACLs for AWS S3 buckets
Enforce block public policy for AWS S3 buckets
Enforce deactivation of unused AWS IAM access keys
Enforce default security groups with no rules to restrict all traffic for AWS VPC security groups
Enforce encryption at rest for AWS CloudTrail logs
Enforce encryption at rest for AWS RDS DB instances
Enforce encryption by default for AWS EC2 accounts
Enforce encryption for AWS EFS file systems
Enforce group-based permissions for AWS IAM users
Enforce ignore public ACLs for AWS S3 buckets
Enforce lifecycle policies for AWS S3 buckets
Enforce lifecycle policies for versioned AWS S3 buckets
Enforce minimum password length for AWS IAM password policy
Enforce non-public accessibility for AWS RDS DB instances
Enforce password reuse prevention for AWS IAM password policy
Enforce removal of AWS IAM AWSCloudShellFullAccess policy
Enforce removal of AWS IAM users
Enforce removal of AdministratorAccess policy for AWS IAM
Enforce removal of expired AWS IAM server certificates
Enforce removal of login profiles for AWS IAM users
Enforce restrict public buckets for AWS S3 buckets
Enforce rotation of AWS IAM access keys every 90 days
Enforce secure Network ACL configurations denying public access to admin ports for AWS VPC Network ACLs
Enforce secure security group configurations denying public access to admin ports for AWS VPC security groups
Enforce single active access key per AWS IAM user
Enforce versioning for AWS S3 buckets
Enforce versioning for AWS S3 buckets
Prevent IAM policies with wildcard actions via Guard
Prevent IAM policies with wildcard actions via Lambda
Prevent IAM policies with wildcard actions via proactive control
Prevent S3 buckets without versioning via Guard
Prevent S3 buckets without versioning via Lambda
Prevent S3 buckets without versioning via proactive control
Prevent creation of AWS EC2 instances with IMDSv1 via Guard
Prevent creation of AWS EC2 instances with IMDSv1 via Lambda
Prevent public S3 bucket creation via Guard
Prevent public S3 bucket creation via Guard
Prevent public S3 bucket creation via Guard
Prevent public S3 bucket creation via Guard
Prohibit AWS EBS direct API calls
Prohibit AWS EBS snapshot public restore
Prohibit AWS EBS snapshot public sharing
Prohibit AWS EC2 VM import and export
Prohibit AWS EC2 deprecated Spot instance APIs
Prohibit AWS Elastic IP association
Prohibit AWS VPC VPN connections
Prohibit AWS VPC internet connections
Prohibit AWS VPC peering connections
Prohibit AWS cross-region networking services
Prohibit IAM Customer Managed Policies with Wildcard Service Actions
Prohibit IAM Inline Policies with Administrative Wildcard Permissions
Prohibit IAM Managed Policies with Administrative Wildcard Permissions
Prohibit Public AWS ECR Repositories
Prohibit public IP assignment at AWS EC2 instance launch
Prohibit public internet access to AWS VPC resources
Require AWS CloudHSM key origin for AWS KMS keys
Require AWS CloudHSM key origin for AWS KMS keys
Require AWS IAM privileged role permission boundaries
Require AWS KMS grants only for AWS services
Require AWS KMS grants only for AWS services
Require Block Public Access for S3 Buckets
Require Block Public Access for S3 Buckets
Require Block Public Access for S3 Buckets
Require Block Public Access for S3 Buckets
Require Encryption for EBS Volumes
Require Encryption for Launch Template EBS Volumes
Require IMDSv2 for AWS EC2 instance launch
Require KMS encryption for AWS S3 buckets
Require MFA for AWS IAM root user actions
Require MFA for AWS S3 bucket versioning configuration changes
Require MFA for AWS SSM Session Manager
Require MFA for delete actions on S3 buckets
Require RSA key length greater than 2048 bits for AWS KMS asymmetric keys
Require RSA key length greater than 2048 bits for AWS KMS asymmetric keys
Require Server Side Encryption for S3 Buckets
Require VPC endpoints for AWS DynamoDB access
Require all object uploads to AWS S3 buckets to use server-side encryption with an AWS KMS key (SSE-KMS)
Require an AWS EBS snapshot to be created from an encrypted EC2 volume
Require approved AWS Marketplace subscriptions
Require approved sources for AWS ECR container registry
Require approved sources for AWS Lambda layers
Require attribute-based access control for AWS IAM sensitive data access
Require bypass policy lockout safety check for AWS KMS keys
Require bypass policy lockout safety check for AWS KMS keys
Require code signing for AWS Lambda functions
Require encryption at rest for AWS EBS snapshots
Require external key store key origin for AWS KMS keys
Require external key store key origin for AWS KMS keys
Require imported key material for AWS KMS keys
Require imported key material for AWS KMS keys
Require organization-only access for AWS KMS resources
Require organization-only access for AWS KMS resources
Require that AWS EBS direct APIs are not called
Require that an AWS EBS snapshot cannot be publicly restorable
Require that an attached AWS EBS volume is configured to encrypt data at rest
Safeguard AWS EC2 AMI block public access setting from modification
Safeguard AWS Lambda code signing configuration from modification
Safeguard AWS S3 bucket encryption configuration from modification
Safeguard AWS S3 bucket policies from modification
Set IMDSv2 defaults for AWS EC2 instances
Set comprehensive password policy for AWS IAM
Set minimum password length for AWS IAM password policy
Set password reuse prevention for AWS IAM password policy

Removed

Allow approved AWS services
Allow resources in approved AWS regions
Block all public sharing of AWS EBS snapshots
Block inbound and outbound internet connections to your VPCs through an internet gateway (IGW) or egress-only internet gateway (EIGW)
Block public sharing of AWS Machine Images (AMIs)
Deny API actions over insecure transport for AWS S3
Deny AWS Virtual Private Network (VPN) connections
Deny EC2 instance launch without IAM instance role
Deny access key creation for AWS IAM users
Deny access key operations for AWS IAM root user
Deny actions as a root user
Deny all AWS IAM root user actions
Deny creation of AWS IAM users
Deny creation of access keys for the root user
Deny credential updates for AWS IAM users
Deny cross region replication for S3 buckets
Deny cross-region networking for AWS EC2, AWS CloudFront, and AWS Global Accelerator
Deny deletion of AWS IAM support access role
Deny deletion of AWS VPC flow logs
Deny direct permissions attachment to AWS IAM users
Deny disablement and deletion of AWS KMS keys
Deny disablement of AWS GuardDuty configuration
Deny disablement of AWS Security Hub configuration
Deny disablement of amazon inspector configuration
Deny full access policy attachment for AWS CloudShell
Deny insecure transport at resource level for AWS S3
Deny internet access for an AWS VPC instance managed by a customer
Deny modification of AWS CloudTrail configuration
Deny modification of AWS CloudWatch alarms
Deny modification of AWS Config configuration
Deny modification of AWS DynamoDB table point in time recovery configuration
Deny modification of AWS EBS encryption by default configuration
Deny modification of AWS EBS snapshot block public access configuration
Deny modification of AWS EC2 IMDS default settings
Deny modification of AWS EC2 image block public access configuration
Deny modification of AWS EC2 instance IMDSv2 configuration
Deny modification of AWS EC2 serial console access configuration
Deny modification of AWS IAM Access Analyzer configuration
Deny modification of AWS IAM role configuration
Deny modification of AWS IAM role trust policy configuration
Deny modification of AWS S3 account public access block configuration
Deny modification of AWS S3 account public access block configuration
Deny modification of AWS S3 bucket encryption configuration
Deny modification of AWS S3 bucket lifecycle policy configuration
Deny modification of AWS S3 bucket logging configuration
Deny modification of AWS S3 bucket logging configuration
Deny modification of AWS S3 bucket object lock configuration
Deny modification of AWS VPC network ACL rules
Deny modification of AWS VPC route tables
Deny modification of AWS VPC security group rules
Deny modification of AWS account alternate security contact
Deny modification of AWS account contact information
Deny password operations for AWS IAM users
Deny policy changes to an AWS S3 bucket
Deny public function URLs for AWS Lambda
Deny public repository creation for AWS ECR
Deny public resource policies for AWS Lambda functions
Deny publicly accessible creation for AWS RDS DB instances
Deny removal of AWS IAM permission boundaries
Deny removal of AWS IAM root user MFA devices
Deny removal of AWS IAM user MFA devices
Deny replication configuration for AWS S3 buckets
Deny resource creation without security classification tags
Deny resources in unapproved AWS regions
Deny resources in unapproved regions
Deny resources in unapproved regions in landing zone
Deny sharing of public AWS EBS snapshots
Deny single-AZ creation for AWS RDS DB instances
Deny the use of AWS EC2 VM import and export
Deny the use of deprecated AWS EC2 RequestSpotFleet and RequestSpotInstances API actions
Deny unapproved AWS EC2 instance types
Deny unapproved AWS services
Deny unencrypted creation for AWS EBS volumes
Deny unencrypted creation for AWS EFS file systems
Deny unencrypted creation for AWS RDS DB instances
Deny unencrypted listeners for AWS Elastic Load Balancing
Deny versioning changes for AWS S3 buckets
Deny virtual MFA operations for AWS IAM root user
Deny weakening of AWS IAM account password policy
Deny wildcard administrative policy attachment for AWS IAM
Disable AWS EC2 Serial Console access
Disable access to the EC2 serial console for all EC2 instances
Enable AWS EBS Snapshot Block Public Access for account
Enable AWS EBS encryption by default for account
Enable AWS EC2 Image Block Public Access
Enable account-level Block Public Access for AWS S3
Enforce Access Logging for AWS S3 Buckets
Enforce Block Public Access for AWS S3 accounts
Enforce Block Public Access for AWS S3 buckets
Enforce HTTPS-only access for AWS S3 buckets
Enforce IAM instance roles for AWS EC2 instances
Enforce IMDSv2 defaults for AWS EC2 account attributes
Enforce IMDSv2 for AWS EC2 instances
Enforce Multi-AZ deployments for AWS RDS DB instances
Enforce approved AMI sources for AWS EC2 instances
Enforce approved accounts for AWS Lambda functions
Enforce approved images for AWS EC2 AMIs
Enforce approved instance types for AWS EC2 instances
Enforce auto minor version upgrade for AWS RDS DB instances
Enforce deactivation of unused AWS IAM access keys
Enforce default security groups with no rules to restrict all traffic for AWS VPC security groups
Enforce encryption at rest for AWS CloudTrail logs
Enforce encryption at rest for AWS RDS DB instances
Enforce encryption by default for AWS EC2 accounts
Enforce encryption for AWS EFS file systems
Enforce group-based permissions for AWS IAM users
Enforce lifecycle policies for AWS S3 buckets
Enforce lifecycle policies for versioned AWS S3 buckets
Enforce minimum password length for AWS IAM password policy
Enforce non-public accessibility for AWS RDS DB instances
Enforce password reuse prevention for AWS IAM password policy
Enforce removal of AWS IAM AWSCloudShellFullAccess policy
Enforce removal of AWS IAM users
Enforce removal of AdministratorAccess policy for AWS IAM
Enforce removal of expired AWS IAM server certificates
Enforce removal of login profiles for AWS IAM users
Enforce rotation of AWS IAM access keys every 90 days
Enforce secure Network ACL configurations denying public access to admin ports for AWS VPC Network ACLs
Enforce secure security group configurations denying public access to admin ports for AWS VPC security groups
Enforce single active access key per AWS IAM user
Enforce versioning for AWS S3 buckets
Prevent IAM policies with wildcard actions via Guard
Prevent IAM policies with wildcard actions via Lambda
Prevent IAM policies with wildcard actions via proactive control
Prevent S3 buckets without versioning via Guard
Prevent S3 buckets without versioning via Lambda
Prevent S3 buckets without versioning via proactive control
Prevent creation of AWS EC2 instances with IMDSv1 via Guard
Prevent creation of AWS EC2 instances with IMDSv1 via Lambda
Prevent public S3 bucket creation via Guard
Prohibit IAM Customer Managed Policies with Wildcard Service Actions
Prohibit IAM Inline Policies with Administrative Wildcard Permissions
Prohibit IAM Managed Policies with Administrative Wildcard Permissions
Require AWS CloudHSM key origin for AWS KMS keys
Require AWS IAM privileged role permission boundaries
Require AWS KMS grants only for AWS services
Require Block Public Access for S3 Buckets
Require Encryption for EBS Volumes
Require Encryption for Launch Template EBS Volumes
Require IMDSv2 for AWS EC2 instances
Require MFA for AWS IAM root user actions
Require MFA for AWS IAM user actions
Require MFA for AWS S3 bucket versioning configuration changes
Require MFA for AWS SSM Session Manager
Require MFA for delete actions on S3 buckets
Require RSA key length greater than 2048 bits for AWS KMS asymmetric keys
Require Server Side Encryption for S3 Buckets
Require VPC endpoints for AWS DynamoDB access
Require VPC endpoints for AWS S3 access
Require all object uploads to AWS S3 buckets to use server-side encryption with an AWS KMS key (SSE-KMS)
Require an AWS EBS snapshot to be created from an encrypted EC2 volume
Require approved AMI sources for AWS EC2 instances
Require approved AWS Marketplace subscriptions
Require approved sources for AWS ECR container registry
Require approved sources for AWS Lambda layers
Require attribute-based access control for AWS IAM sensitive data access
Require bypass policy lockout safety check for AWS KMS keys
Require code signing for AWS Lambda functions
Require external key store key origin for AWS KMS keys
Require imported key material for AWS KMS keys
Require organization accounts for AWS STS assume role
Require organization-only access for AWS KMS resources
Require that AWS EBS direct APIs are not called
Require that an AWS EBS snapshot cannot be publicly restorable
Require that an attached AWS EBS volume is configured to encrypt data at rest
Set IMDSv2 defaults for AWS EC2 instances
Set comprehensive password policy for AWS IAM
Set minimum password length for AWS IAM password policy
Set password reuse prevention for AWS IAM password policy