[ENHANCEMENT] Expand AWS cloud security template coverage

Is there an existing issue for this?

• I have searched the existing issues and discussions.

Enhancement Description

I'd like to contribute more actively to the cloud/aws templates and work on a series of AWS security configuration checks.

I plan to cover both missing controls for currently supported services and security baselines for AWS services that are not covered yet. Each contribution would be submitted as a separate, narrowly scoped PR with positive and negative validation using reproducible AWS CLI output.

I would primarily use official AWS Security Hub, CIS, and AWS security guidance as the baseline, with real-world breach cases used only as supporting risk context.

Before I start opening multiple PRs, would this direction be welcome? Are there any AWS services or controls the maintainers would prefer me to prioritize—or avoid—and any conventions I should follow when introducing a new service directory?

Use Case / Problem

The current cloud/aws template collection provides useful coverage, but several AWS services are not covered yet, and some supported services are missing important security configuration checks. As a result, users may receive an incomplete view of their AWS security posture and overlook risky configurations such as public resources, weak access controls, unencrypted data, disabled logging, or overly privileged identities.

This enhancement would expand the AWS template coverage with narrowly scoped checks based primarily on AWS Security Hub controls, CIS benchmarks, and official AWS security guidance. It would cover both missing controls for existing service directories and security baselines for currently unsupported AWS services. Real-world AWS breach cases would be used as supporting context when prioritizing controls, rather than as standalone template requirements.

Proposed Solution

No response

Alternatives Considered

No response

Additional Context

No response