> For the complete documentation index, see [llms.txt](https://docs.duplocloud.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplocloud.com/docs/automation-platform/overview/security-configuration-settings/aws-account-security-settings.md).

# AWS Account Security settings

## Configuring Account Security Settings

To configure AWS Account Security settings, navigate to **Administrator** -> **System Settings** in the DuploCloud Portal and click the **AWS Account Security** tab.

Enable the settings listed in the table below by clicking the setting switch.

<figure><img src="/files/N5LvVjhmHLHFJfqLAIvT" alt=""><figcaption><p><strong>AWS Security Settings</strong> page with <strong>Enable Security Hub</strong> setting switch enabled</p></figcaption></figure>

### AWS Account Security Settings

| Settings Name                             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Enable Security Hub**                   | Enables AWS Security Hub in all AWS regions managed by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| **Enable Guard Duty**                     | Enables AWS Guard Duty in all AWS regions managed by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| **Enable IAM Password Policy**            | <p>Enables an account-level IAM User password policy, according to these password requirements:</p><ul><li>Minimum password length is 14 characters</li><li>At least one uppercase letter from the Latin alphabet (<strong>A</strong>-<strong>Z</strong>)</li><li>At least one lowercase letter from the Latin alphabet (<strong>a</strong>-<strong>z</strong>)</li><li>At least one number (<strong>0</strong>-<strong>9</strong>)</li><li>At least one non-alphanumeric character (<strong>! @ # $ % ^ & \* ( ) \_ + - = \[ ] { }</strong></li></ul> |
| **Enable CloudTrail**                     | <p>Enables a multi-region CloudTrail for an AWS account. Enabling this feature:</p><ul><li>Creates and manages a multi-region CloudTrail for the AWS account in DuploCloud.</li><li>Creates a CloudWatch log group named <code>/cloudtrail/duplo</code> that receives CloudTrail events.</li><li>Creates and manages an S3 bucket that receives CloudTrail log files.</li></ul>                                                                                                                                                                        |
| **Enable Inspector**                      | Enables AWS Inspector in any region where there is a public cloud infrastructure managed by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| **Ignore Default EBS Encryption**         | <p>By default, DuploCloud enables EBS Default Encryption for all regions in which you deploy infrastructure.</p><p>Enabling this setting allows DuploCloud to override the EBS Default Encryption settings when creating new Infrastructures. Note that you can still edit the <code>EBS Encryption by Default</code> setting to enable EBS encryption by default for your Infrastructure, for the entire AWS region, if needed.</p>                                                                                                                   |
| **Enable VPC Flow Logs**                  | Enables VPC flow logs for all VPCs created by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| **Delete Default NACL Rule(s)**           | Deletes default NACL rules for all VPCs created by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| **Delete Default VPC(s)**                 | Deletes default VPCs in all AWS regions managed by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| **Revoke Default Security Group Rule(s)** | Revokes default Security Group rules for all VPCs created by DuploCloud                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| **Globally Block Public Access to S3**    | Restricts Public access to S3 buckets                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **Configure SSL Policy to LBs**           | Contact a DuploCloud Administrator to configure this setting at the AWS system level.                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.duplocloud.com/docs/automation-platform/overview/security-configuration-settings/aws-account-security-settings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.