1. Infra security
2. IAM
3. Data Protection
4. S3 Bucket Protection
5. Logging & Monitoring
Asking Clients
https://d1.awsstatic.com/whitepapers/compliance/CIS_Amazon_Web_Services_Three-tier_Web_Architecture_Benchmark.pdf