Security Checks
AWS Security Checks
Each of the 432 checks, across 62 AWS services, is evaluated directly against your accounts. GuardKite reports which ones changed and which findings are reachable, and every check's page says how to fix what it finds.
ACM
Imported and ACM-issued certificates should be renewed after a specified time period
Flags ACM certificates, both imported and AWS-managed, that are within 30 days of expiration and require renewal.
RSA certificates managed by ACM should use a key length of at least 2,048 bits
Verifies that RSA certificates managed by ACM use a key length of at least 2,048 bits, as shorter keys are considered cryptographically weak.
APIGateway
API Gateway REST and WebSocket API execution logging should be enabled
Ensures all stages of an API Gateway REST or WebSocket API have logging enabled at the ERROR or INFO level for all methods.
API Gateway REST API stages should be configured to use SSL certificates for backend authentication
Confirms that API Gateway REST API stages have SSL certificates configured for backend authentication.
API Gateway REST API stages should have AWS X-Ray tracing enabled
Verifies that AWS X-Ray active tracing is enabled for API Gateway REST API stages.
API Gateway should be associated with a WAF Web ACL
Verifies that API Gateway stages are protected by an AWS WAF web ACL.
API Gateway REST API cache data should be encrypted at rest
Verifies that API Gateway REST API stages with caching enabled store cached data encrypted at rest.
API Gateway routes should specify an authorization type
Confirms that API Gateway routes have an authorization type specified.
Access logging should be configured for API Gateway V2 Stages
Confirms that API Gateway V2 stages have access logging configured.
API Gateway V2 integrations should use HTTPS for private connections
Flags API Gateway V2 (HTTP and WebSocket) integrations whose private VPC link connections do not have a TLS configuration. Without TLS, traffic betwee...
API Gateway domain names should use recommended security policies
Flags API Gateway custom domain names that are configured with the legacy TLS_1_0 security policy. TLS_1_0 is deprecated and exposes client traffic to...
Account
Security contact information should be provided for an AWS account
Verifies that the AWS account has security contact information configured.
AWS account should be part of an AWS Organizations organization
Confirms that the AWS account is a member of an organization managed through AWS Organizations.
AppSync
AWS AppSync API caches should be encrypted at rest
Flags AWS AppSync API caches that are not configured for encryption at rest. Encrypting cached query results protects any sensitive data the cache may...
AWS AppSync should have field-level logging enabled
Verifies that AWS AppSync APIs have both request-level and field-level logging enabled.
AWS AppSync GraphQL APIs should not be authenticated with API keys
Flags AppSync GraphQL APIs that use API key authentication. API keys are hard-coded values that, if compromised, expose the endpoint to unauthorized a...
AWS AppSync API caches should be encrypted in transit
Flags AWS AppSync API caches that are not configured for encryption in transit. Without transit encryption, traffic between AppSync and its cache inst...
Athena
Athena workgroups should have logging enabled
Verifies that Amazon Athena workgroups have logging enabled.
AutoScaling
Auto scaling groups associated with a load balancer should use ELB health checks
Confirms that Auto Scaling groups associated with Classic Load Balancers or target groups use ELB health checks. Groups without load balancer associat...
Amazon EC2 Auto Scaling group should cover multiple Availability Zones
Ensures Auto Scaling groups span multiple Availability Zones for fault tolerance.
Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)
Verifies that Auto Scaling group launch configurations require EC2 instances to use IMDSv2.
Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses
Flags Auto Scaling group launch configurations that assign public IP addresses to EC2 instances.
Auto Scaling groups should use multiple instance types in multiple Availability Zones
Ensures Auto Scaling groups are configured to use multiple instance types across multiple Availability Zones.
EC2 Auto Scaling groups should use EC2 launch templates
Verifies that Auto Scaling groups use EC2 launch templates instead of launch configurations.
Backup
AWS Backup recovery points should be encrypted at rest
Verifies that AWS Backup recovery points are encrypted at rest.
Bedrock
Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys
Flags Amazon Bedrock knowledge-base data sources not encrypted at rest with a customer-managed KMS key. Without a serverSideEncryptionConfiguration.km...
BedrockAgentCore
Bedrock AgentCore runtimes should be configured with VPC network mode
Flags Amazon Bedrock AgentCore runtimes whose network mode is set to PUBLIC. PUBLIC runtimes communicate over the internet and bypass VPC controls; pr...
Bedrock AgentCore Gateways should require authorization for inbound requests
Flags Amazon Bedrock AgentCore gateways that do not require authorization for inbound requests. Without inbound authorization the gateway is reachable...
Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys
Flags Amazon Bedrock AgentCore Memory resources that are not encrypted at rest with a KMS key you manage. Without an encryptionKeyArn the memory relie...
Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys
Flags Amazon Bedrock AgentCore Gateways not encrypted at rest with a KMS key you manage. Without a kmsKeyArn the gateway relies on the default AWS-own...
Bedrock AgentCore custom browsers should not use public network mode
Flags Amazon Bedrock AgentCore custom browsers configured with PUBLIC network mode. Public browsers reach the internet directly and bypass VPC control...
Bedrock AgentCore custom browsers should have session recording enabled
Flags Amazon Bedrock AgentCore custom browsers without session recording to an S3 destination. Recording provides an audit trail of browser-tool activ...
Bedrock AgentCore custom code interpreters should use a private network configuration
Flags Amazon Bedrock AgentCore custom code interpreters that use PUBLIC or SANDBOX network mode instead of a private VPC configuration. Only VPC mode ...
CloudFormation
CloudFormation stacks should have termination protection enabled
Flags AWS CloudFormation stacks that do not have termination protection enabled. Without termination protection, a stack can be deleted by anyone with...
CloudFormation stacks should have associated service roles
Flags AWS CloudFormation stacks that do not have a service role associated. Without an explicit service role, the stack uses the calling principal...
CloudFront
CloudFront distributions should have a default root object configured
Confirms that CloudFront distributions are configured to return a specific default root object.
CloudFront distributions should require encryption in transit
Ensures CloudFront distributions require viewers to use HTTPS for all connections.
CloudFront distributions should have origin failover configured
Confirms that CloudFront distributions have an origin group with two or more origins configured for failover.
CloudFront distributions should have logging enabled
Verifies that server access logging is enabled for CloudFront distributions.
CloudFront distributions should have WAF enabled
Confirms that CloudFront distributions are associated with an AWS WAF Classic or WAF web ACL.
CloudFront distributions should use custom SSL/TLS certificates
Verifies that CloudFront distributions use custom SSL/TLS certificates rather than the default CloudFront certificate.
CloudFront distributions should use SNI to serve HTTPS requests
Flags CloudFront distributions that use a dedicated IP address for SSL/TLS instead of SNI, which is the recommended and more cost-efficient approach.
CloudFront distributions should encrypt traffic to custom origins
Flags CloudFront distributions that do not encrypt traffic to custom origins: specifically those with an http-only origin protocol policy, or match-vi...
CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins
Flags CloudFront distributions that use deprecated SSL protocols for HTTPS communication with custom origins.
CloudFront distributions should not point to non-existent S3 origins
Detects CloudFront distributions pointing to S3 origins that no longer exist.
CloudFront distributions should use origin access control
Verifies that CloudFront distributions with S3 origins use origin access control (OAC) to restrict direct S3 access.
CloudFront distributions should use the recommended TLS security policy
Ensures CloudFront distributions use the recommended TLS security policy for secure viewer connections.
CloudFront distributions should use origin access control for Lambda function URL origins
Flags Amazon CloudFront distributions that use AWS Lambda function URLs as origins without origin access control (OAC) enabled. Without OAC, the Lambd...
CloudFront distributions should use trusted key groups for signed URLs and cookies
Flags Amazon CloudFront distributions that authenticate signed URLs or signed cookies using legacy trusted signers, and those with no signed URL or si...
CloudTrail
CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events
Ensures at least one multi-Region trail is configured to record both read and write management events; one such trail covers the whole account. A find...
CloudTrail should have encryption at-rest enabled
Verifies that CloudTrail trails use server-side encryption with an AWS KMS key.
At least one CloudTrail trail should be enabled
Verifies that each Region has at least one CloudTrail trail, which delivers a lasting record of API calls to S3 beyond the 90 days of event history Cl...
CloudTrail log file validation should be enabled
Ensures CloudTrail log file integrity validation is enabled, allowing detection of tampering with delivered log files.
CloudTrail trails should be integrated with Amazon CloudWatch Logs
Confirms that CloudTrail trails deliver logs to CloudWatch Logs for centralized monitoring and alerting.
Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible
Flags S3 buckets used to store CloudTrail logs that are publicly accessible.
Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
Verifies that the S3 bucket storing CloudTrail logs has server access logging enabled to capture all requests made to the bucket.
CloudTrail Lake event data stores should be encrypted with customer managed AWS KMS keys
Confirms that CloudTrail Lake event data stores are encrypted at rest with a customer managed KMS key.
CloudWatch
CloudWatch alarms should have specified actions configured
Verifies that CloudWatch metric alarms have at least one action for the ALARM state, so a breached threshold notifies someone or triggers a response. ...
CloudWatch log groups should be retained for a specified time period
Confirms that CloudWatch log groups have a retention policy set to at least 365 days.
CloudWatch alarm actions should be enabled
Ensures CloudWatch alarms have actions enabled so they trigger the configured response when a state change occurs.
CodeBuild
CodeBuild Bitbucket source repository URLs should not contain sensitive credentials
Flags CodeBuild projects whose source repository URL carries credentials in it, for example https://user:token@host/repo. The check reads the URL only...
CodeBuild project environment variables should not contain clear text credentials
Detects clear-text credentials (such as AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, PASSWORD, or TOKEN) stored in CodeBuild project environment variable...
CodeBuild S3 logs should be encrypted
Flags CodeBuild projects that write build logs to S3 with encryption turned off, so the logs are written with the bucket's own default rather tha...
CodeBuild project environments should have a logging configuration
Verifies that CodeBuild project environments have at least one log destination enabled: either S3 or CloudWatch Logs.
CodeBuild report group exports should be encrypted at rest
Confirms that CodeBuild report group test results exported to S3 are encrypted at rest.
Cognito
Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication
Verifies that Cognito user pools have advanced security enabled and set to full enforcement mode, not audit mode.
Cognito identity pools should not allow unauthenticated identities
Flags Cognito identity pools that allow unauthenticated (guest) identities by having AllowUnauthenticatedIdentities set to true.
Password policies for Cognito user pools should have strong configurations
Flags Amazon Cognito user pools whose password policy does not meet the recommended baseline (8+ chars, requires upper/lower case, number, symbol, and...
Cognito user pools should have threat protection activated with full function enforcement mode for custom authentication
Flags Amazon Cognito user pools whose threat protection is not activated in full function (ENFORCED) mode for custom authentication. Audit-only mode l...
MFA should be enabled for Cognito user pools
Flags Amazon Cognito user pools that authenticate users with passwords but do not require multi-factor authentication. The control is in scope when th...
Cognito user pools should have deletion protection enabled
Flags Amazon Cognito user pools that do not have deletion protection enabled. Without deletion protection, a single DeleteUserPool call removes the po...
Connect
Amazon Connect instances should have CloudWatch logging enabled
Confirms that Amazon Connect instances store flow logs in a CloudWatch log group. Flow logs provide real-time details about events in Connect flows, a...
DMS
Database Migration Service replication instances should not be public
Flags DMS replication instances that are publicly accessible. Replication instances should have private IP addresses and not be reachable outside the ...
DMS replication instances should have automatic minor version upgrade enabled
Ensures automatic minor version upgrade is enabled for DMS replication instances, keeping them current with bug fixes, security patches, and performan...
DMS replication tasks for the target database should have logging enabled
Confirms that DMS replication tasks have logging enabled at LOGGER_SEVERITY_DEFAULT or higher for TARGET_APPLY and TARGET_LOAD operations.
DMS replication tasks for the source database should have logging enabled
Verifies that DMS replication tasks have logging enabled at LOGGER_SEVERITY_DEFAULT or higher for SOURCE_CAPTURE and SOURCE_UNLOAD components.
DMS endpoints should use SSL
Confirms that AWS DMS endpoints use SSL connections, encrypting data in transit and validating the target database's server certificate during mi...
DMS endpoints for Neptune databases should have IAM authorization enabled
Verifies that AWS DMS endpoints for Neptune databases use IAM authorization, enabling fine-grained access control through a service access role.
DMS endpoints for MongoDB should have an authentication mechanism enabled
Confirms that AWS DMS endpoints for MongoDB have an authentication mechanism enabled. Without authentication, unauthorized users could access data dur...
DMS endpoints for Redis OSS should have TLS enabled
Ensures AWS DMS endpoints for Redis OSS use TLS connections, encrypting data in transit to prevent eavesdropping during migration.
DMS replication instances should be configured to use multiple Availability Zones
Flags AWS DMS replication instances that are not deployed in a Multi-AZ configuration. Single-AZ replication instances interrupt migrations during AZ-...
DataSync
DataSync tasks should have logging enabled
Verifies that AWS DataSync tasks have logging enabled. Audit logs record system activity, support incident investigation, and help meet regulatory com...
DocumentDB
Amazon DocumentDB clusters should be encrypted at rest
Verifies that DocumentDB clusters are encrypted at rest using AES-256 with encryption keys managed by AWS KMS.
Amazon DocumentDB clusters should have an adequate backup retention period
Ensures DocumentDB clusters have a backup retention period of at least 7 days, supporting recovery from accidental deletion, corruption, and other dat...
Amazon DocumentDB manual cluster snapshots should not be public
Flags DocumentDB manual cluster snapshots that are publicly accessible, which exposes data to all AWS accounts.
Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs
Verifies that DocumentDB clusters publish audit logs to CloudWatch Logs. Audit logging captures authentication attempts, collection drops, index creat...
Amazon DocumentDB clusters should have deletion protection enabled
Confirms that DocumentDB clusters have deletion protection enabled, preventing accidental or unauthorized deletion.
Amazon DocumentDB clusters should be encrypted in transit
Ensures DocumentDB clusters require TLS for all client connections. Non-TLS connections are not permitted, protecting data in transit from interceptio...
DynamoDB
DynamoDB tables should automatically scale capacity with demand
Verifies that DynamoDB tables can scale read and write capacity automatically, either through on-demand mode or provisioned mode with auto scaling con...
DynamoDB tables should have point-in-time recovery enabled
Confirms that point-in-time recovery (PITR) is enabled for DynamoDB tables, providing automated backups and the ability to recover from accidental wri...
DynamoDB Accelerator (DAX) clusters should be encrypted at rest
Verifies that DAX clusters are encrypted at rest, reducing the risk of unauthorized access to data stored on disk.
DynamoDB tables should be present in a backup plan
Confirms that each DynamoDB table is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery point...
DynamoDB tables should have deletion protection enabled
Ensures DynamoDB tables have deletion protection enabled to prevent accidental removal during regular table management operations.
DynamoDB Accelerator clusters should be encrypted in transit
Confirms that DynamoDB Accelerator (DAX) clusters use TLS endpoint encryption, protecting data in transit against interception.
EC2
EBS snapshots should not be configured to be publicly restorable
Flags EBS snapshots that are configured to be publicly restorable.
VPC default security groups should not allow inbound or outbound traffic
Confirms that each VPC's default security group has no inbound or outbound rules. AWS attaches this group to resources launched without one and i...
Attached EBS volumes should be encrypted at-rest
Confirms that EBS volumes attached to an instance are encrypted at rest, which also protects their snapshots and the data moving between volume and in...
Stopped EC2 instances should be removed after a specified time period
Flags EC2 instances stopped for more than 30 days. A stopped instance gets no patches, so it rejoins the network carrying every vulnerability fixed wh...
VPC flow logging should be enabled in all VPCs
Verifies that each VPC has a flow log, which records the traffic crossing it for detecting anomalies and investigating incidents. Only a flow log on t...
EBS default encryption should be enabled
Verifies that EBS encryption by default is on for the account in this Region, so every new EBS volume and snapshot copy is encrypted at rest with no c...
EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)
Verifies that EC2 instances require IMDSv2 (HttpTokens set to required). Its session tokens protect instance metadata, including the role credentials ...
EC2 instances should not have a public IPv4 address
Flags EC2 instances that have a public IPv4 address, whether auto-assigned or an Elastic IP. With a route to an internet gateway, that address makes t...
Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
Confirms that each VPC with EC2 instances has an interface endpoint for the EC2 service, so the instances' EC2 API calls stay on the AWS network....
Unused EC2 EIPs should be removed
Flags Elastic IP addresses that are unassociated and no longer in use.
Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22
Flags security groups that allow ingress from 0.0.0.0/0 or ::/0 to port 22 (SSH), letting anyone on the internet try to log in to what the group prote...
Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389
Flags security groups that allow ingress from 0.0.0.0/0 or ::/0 to port 3389 (RDP), letting anyone on the internet try to log in to what the group pro...
EC2 subnets should not automatically assign public IP addresses
Flags EC2 subnets configured to automatically assign public IPv4 addresses or IPv6 addresses to instances at launch, which gives new instances there a...
Unused Network Access Control Lists should be removed
Flags Network ACLs that are not associated with any subnet.
EC2 instances should not use multiple ENIs
Flags EC2 instances using multiple Elastic Network Interfaces, which can create complex network configurations and unintended routing.
Security groups should only allow unrestricted incoming traffic for authorized ports
Verifies that security groups allow ingress from 0.0.0.0/0 or ::/0, or from a managed prefix list holding either, only on TCP 80 and TCP 443 as single...
Security groups should not allow unrestricted access to ports with high risk
Flags security groups that allow ingress from 0.0.0.0/0 or ::/0 to a high-risk port (20, 21, 22, 23, 25, 110, 135, 143, 445, 1433, 1434, 3000, 3306, 3...
Both VPN tunnels for an AWS Site-to-Site VPN connection should be up
Verifies that both tunnels for AWS Site-to-Site VPN connections are up.
Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389
Flags network ACLs with an inbound rule allowing 0.0.0.0/0 or ::/0 to SSH (port 22) or RDP (port 3389), opening remote administration to the internet....
Unused EC2 security groups should be removed
Flags security groups attached to no network interface, counting those of EC2 instances and the ones load balancers, RDS, Lambda and VPC endpoints cre...
EC2 Transit Gateways should not automatically accept VPC attachment requests
Confirms that EC2 Transit Gateways do not automatically accept VPC attachment requests.
EC2 paravirtual instance types should not be used
Detects EC2 instances using paravirtual (PV) virtualization, a legacy type with fewer features and security controls than HVM.
EC2 launch templates should not assign public IPs to network interfaces
Flags EC2 launch templates configured to assign public IP addresses to network interfaces.
EBS volumes should be in a backup plan
Confirms that EBS volumes are covered by an AWS Backup plan.
EC2 Client VPN endpoints should have client connection logging enabled
Ensures Client VPN endpoints have client connection logging enabled.
EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports
Flags security groups that allow ingress from 0.0.0.0/0 to the remote administration ports 22 (SSH) or 3389 (RDP), letting anyone on the internet try ...
EC2 security groups should not allow ingress from ::/0 to remote server administration ports
Flags EC2 security groups that allow inbound traffic from ::/0 to the SSH (22) or RDP (3389) remote-administration ports. Public IPv6 exposure of thes...
VPCs should be configured with an interface endpoint for ECR API
Verifies that VPC interface endpoints are available for the Amazon ECR API.
VPCs should be configured with an interface endpoint for Docker Registry
Confirms that VPC interface endpoints are available for the Amazon ECR Docker registry.
VPCs should be configured with an interface endpoint for Systems Manager
Verifies that VPC interface endpoints are available for AWS Systems Manager.
VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts
Confirms that VPC interface endpoints are available for SSM Incident Manager Contacts.
VPCs should be configured with an interface endpoint for Systems Manager Incident Manager
Verifies that VPC interface endpoints are available for SSM Incident Manager.
EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)
Confirms that the default version of EC2 launch templates requires IMDSv2 for instance metadata access.
EC2 VPN connections should have logging enabled
Ensures EC2 VPN connections have logging configured.
EC2 VPC Block Public Access settings should block internet gateway traffic
Verifies that VPC Block Public Access is on in this Region in Bidirectional or Ingress-only mode. It is one switch per account and Region that blocks ...
EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes
Confirms that EC2 Spot Fleet requests with launch parameters have encryption enabled on all attached EBS volumes.
EC2 network interfaces should have source/destination checking enabled
Verifies that source/destination checking is enabled on user-managed EC2 network interfaces, so each handles only traffic it sends or receives itself....
EC2 launch templates should enable encryption for attached EBS volumes
Flags EC2 launch templates whose default version explicitly sets EBS encryption to false on a block device mapping. Templates that launch unencrypted ...
Block public access settings should be enabled for Amazon EBS snapshots
Flags Regions where block public access for EBS snapshots is off. Without it, any snapshot can be shared publicly, by intent or by mistake, and its da...
EC2 VPN connections should use IKEv2 protocol
Flags AWS Site-to-Site VPN connections whose tunnels do not restrict key exchange to IKEv2. A tunnel that still permits the legacy IKEv1 protocol will...
ECR
ECR private repositories should have image scanning configured
Verifies that private ECR repositories are covered by a scan on push or continuous scanning rule (manual scanning does not count), so images are check...
ECR private repositories should have tag immutability configured
Confirms that private ECR repositories have tag immutability enabled, preventing image tags from being overwritten.
ECR repositories should have at least one lifecycle policy configured
Ensures ECR repositories have at least one lifecycle policy configured to manage image retention.
ECR repositories should be encrypted with customer managed AWS KMS keys
Flags ECR repositories not encrypted at rest with a customer managed KMS key. The baseline is one of two materially different positions, and the repos...
ECS
ECS services should not have public IP addresses assigned to them automatically
Flags ECS services configured to automatically assign public IP addresses (AssignPublicIP set to ENABLED).
ECS task definitions should not share the host's process namespace
Flags ECS task definitions configured to share the host's process namespace with their containers.
ECS containers should run as non-privileged
Flags ECS task definitions with containers that have the privileged parameter set to true.
ECS task definitions should configure containers to be limited to read-only access to root filesystems
Verifies that ECS task definitions configure containers with read-only access to their root filesystems. Task definitions targeting Windows containers...
Secrets should not be passed as container environment variables
Detects ECS containers that pass secrets (such as AWS_ACCESS_KEY_ID, PASSWORD, or TOKEN) as plain-text environment variables.
ECS task definitions should have a logging configuration
Confirms that the latest active ECS task definition has a logging configuration with a valid logDriver specified for all container definitions.
ECS Fargate services should run on the latest Fargate platform version
Verifies that ECS Fargate services are running the latest Fargate platform version.
ECS clusters should use Container Insights
Confirms that ECS clusters have Container Insights enabled for performance and operational monitoring.
ECS task sets should not automatically assign public IP addresses
Flags ECS task sets configured to automatically assign public IP addresses (AssignPublicIP set to ENABLED).
ECS task definitions should not use host network mode
Flags the latest active revision of ECS task definitions that use host network mode, which shares the host's network namespace with the container
ECS Task Definitions should use in-transit encryption for EFS volumes
Flags Amazon ECS task definitions whose EFS volume configurations do not enable in-transit encryption. Without TLS, EFS traffic between the task and t...
ECS capacity providers should have managed termination protection enabled
Flags ECS capacity providers backed by Auto Scaling groups that do not have managed termination protection enabled. Without it, the ASG can terminate ...
ECS task definitions should configure non-root users in Linux container definitions
Flags Amazon ECS Linux task definitions whose container definitions do not set an explicit non-root user. Running containers as root grants the worklo...
ECS task definitions should configure non-administrator users in Windows container definitions
Flags Amazon ECS Windows task definitions whose container definitions do not set an explicit non-administrator user. Running as the default administra...
EFS
Elastic File System should be configured to encrypt file data at-rest using AWS KMS
Verifies that Amazon EFS file systems are configured to encrypt data at rest using AWS KMS.
Amazon EFS volumes should be in backup plans
Verifies that EFS file systems are included in an AWS Backup plan.
EFS access points should enforce a root directory
Verifies that EFS access points enforce a non-root directory path, preventing clients from accessing the entire file system root.
EFS access points should enforce a user identity
Confirms that EFS access points enforce a POSIX user identity, ensuring consistent user-level permissions for all file system operations.
EFS mount targets should not be associated with subnets that assign public IP addresses on launch
Flags EFS mount targets associated with subnets that automatically assign public IP addresses on instance launch.
EFS file systems should have automatic backups enabled
Ensures EFS file systems have automatic backups enabled.
EFS file systems should be encrypted at rest
Confirms that EFS file systems encrypt stored data at rest with AWS KMS.
EKS
EKS cluster endpoints should not be publicly accessible
Flags EKS cluster API server endpoints that are publicly accessible.
EKS clusters should run on a supported Kubernetes version
Confirms that EKS clusters run a supported Kubernetes version.
EKS clusters should use encrypted Kubernetes secrets
Verifies that EKS clusters use AWS KMS to encrypt Kubernetes secrets stored in etcd.
EKS clusters should have audit logging enabled
Ensures EKS clusters have audit logging enabled to record API server activity.
EKS node groups should run on a supported Kubernetes version
Flags Amazon EKS node groups that run on a Kubernetes version older than the current AWS EKS standard support window. Extended-support versions miss b...
ELB
Application Load Balancer should be configured to redirect all HTTP requests to HTTPS
Ensures every HTTP listener on an Application Load Balancer redirects requests to HTTPS, so no client is served over an unencrypted connection.
Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager
Verifies that every HTTPS or SSL listener on a Classic Load Balancer presents a certificate issued by AWS Certificate Manager rather than one uploaded...
Classic Load Balancer listeners should be configured with HTTPS or TLS termination
Verifies that every Classic Load Balancer listener uses HTTPS or SSL for front-end connections, so client traffic to the load balancer is encrypted.
Application load balancer should be configured to drop invalid http headers
Verifies that Application Load Balancers remove HTTP headers whose names are not valid instead of forwarding them to targets, reducing the risk of hea...
Application and Classic Load Balancers logging should be enabled
Confirms that Application and Classic Load Balancers write access logs to S3, recording each request's time, client IP address, path and response...
Application, Gateway, and Network Load Balancers should have deletion protection enabled
Confirms that deletion protection is enabled on Application, Gateway and Network Load Balancers, so the load balancer cannot be deleted, by mistake or...
Classic Load Balancers should have connection draining enabled
Verifies that connection draining is enabled on Classic Load Balancers, so requests already in flight finish when an instance is deregistered instead ...
Classic Load Balancers with SSL listeners should use a predefined security policy that has strong configuration
Confirms that every HTTPS or SSL listener on a Classic Load Balancer uses the ELBSecurityPolicy-TLS-1-2-2017-01 predefined security policy, which enab...
Classic Load Balancers should have cross-zone load balancing enabled
Confirms that cross-zone load balancing is enabled for Classic Load Balancers, distributing traffic evenly across all registered instances in all enab...
Classic Load Balancer should span multiple Availability Zones
Ensures Classic Load Balancers span multiple Availability Zones for increased fault tolerance.
Application Load Balancer should be configured with defensive or strictest desync mitigation mode
Ensures Application Load Balancers use defensive or strictest desync mitigation mode to protect against HTTP desync attacks.
Application, Network and Gateway Load Balancers should span multiple Availability Zones
Ensures Application, Network, and Gateway Load Balancers span multiple Availability Zones for fault tolerance.
Classic Load Balancer should be configured with defensive or strictest desync mitigation mode
Ensures Classic Load Balancers use defensive or strictest desync mitigation mode to protect against HTTP desync attacks.
Application Load Balancers should be associated with an AWS WAF web ACL
Confirms that Application Load Balancers are associated with an AWS WAF web ACL to protect against web exploits that could affect availability or cons...
Application and Network Load Balancers with listeners should use recommended security policies
Verifies that every HTTPS listener on an Application Load Balancer and every TLS listener on a Network Load Balancer uses one of the eight security po...
Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit
Confirms that each Application Load Balancer listener uses HTTPS and each Network Load Balancer listener uses an encrypted protocol, so client traffic...
Application and Network Load Balancer target groups should use encrypted health check protocols
Flags Elastic Load Balancing target groups, Gateway Load Balancer ones included, whose health check protocol is not HTTPS. Health-check traffic sent o...
ELB target groups should use encrypted transport protocols
Flags Elastic Load Balancing target groups whose protocol is not HTTPS, TLS or QUIC, which leaves traffic between the load balancer and its targets un...
EMR
Amazon EMR cluster primary nodes should not have public IP addresses
Flags EMR cluster master nodes that have public IP addresses assigned.
Amazon EMR block public access setting should be enabled
Confirms that Amazon EMR Block Public Access is enabled for the account, and that no ports other than 22 are open to the public.
Amazon EMR security configurations should have encryption at rest enabled
Verifies that EMR security configurations have encryption at rest enabled.
Amazon EMR security configurations should have encryption in transit enabled
Ensures EMR security configurations have encryption in transit enabled.
ElastiCache
ElastiCache (Redis OSS) clusters should have automatic backups enabled
Verifies that ElastiCache (Redis OSS) cache clusters and ElastiCache (Redis OSS or Valkey) replication groups have automatic backups scheduled with a ...
ElastiCache clusters should have automatic minor version upgrades enabled
Confirms that ElastiCache for Redis clusters automatically apply minor version upgrades.
ElastiCache replication groups should have automatic failover enabled
Ensures ElastiCache Redis replication groups have automatic failover enabled.
ElastiCache replication groups should be encrypted at rest
Verifies that ElastiCache Redis replication groups are encrypted at rest.
ElastiCache replication groups should be encrypted in transit
Verifies that ElastiCache Redis replication groups are encrypted in transit.
ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled
Confirms that ElastiCache Redis replication groups running versions below 6.0 have Redis AUTH enabled.
ElastiCache clusters should not use the default subnet group
Flags ElastiCache clusters using the default subnet group instead of a custom one.
ElasticBeanstalk
Elastic Beanstalk environments should have enhanced health reporting enabled
Verifies that enhanced health reporting is enabled for Elastic Beanstalk environments.
Elastic Beanstalk managed platform updates should be enabled
Ensures managed platform updates are enabled for Elastic Beanstalk environments, so AWS applies platform updates in a weekly maintenance window.
Elastic Beanstalk should stream logs to CloudWatch
Confirms that Elastic Beanstalk environments stream logs to CloudWatch Logs.
Elasticsearch
Elasticsearch domains should have encryption at-rest enabled
Verifies that Elasticsearch domains have encryption at rest enabled on persistent volumes.
Elasticsearch domains should not be publicly accessible
Confirms that Elasticsearch domains are deployed within a VPC rather than publicly accessible.
Elasticsearch domains should encrypt data sent between nodes
Ensures Elasticsearch domains have node-to-node encryption enabled, securing data in transit within the cluster.
Elasticsearch domain error logging to CloudWatch Logs should be enabled
Verifies that Elasticsearch domains have error logging to CloudWatch Logs enabled.
Elasticsearch domains should have audit logging enabled
Confirms that Elasticsearch domains have audit logging enabled for security and compliance purposes.
Elasticsearch domains should have at least three data nodes
Ensures Elasticsearch domains are configured with at least three data nodes for high availability.
Elasticsearch domains should be configured with at least three dedicated master nodes
Verifies that Elasticsearch domains have at least three dedicated master nodes configured for cluster stability.
Connections to Elasticsearch domains should be encrypted using the latest TLS security policy
Ensures connections to Elasticsearch domains use the latest TLS protocol for secure data transmission.
EventBridge
EventBridge custom event buses should have a resource-based policy attached
Confirms that custom EventBridge event buses have a resource-based policy attached to control access.
EventBridge global endpoints should have event replication enabled
Verifies that event replication is enabled for EventBridge global endpoints.
FSx
FSx for OpenZFS file systems should be configured to copy tags to backups and volumes
Confirms that FSx for OpenZFS file systems copy tags to backups and volumes, supporting resource categorization and governance.
FSx for Lustre file systems should be configured to copy tags to backups
Confirms that FSx for Lustre file systems copy tags to backups and volumes, supporting resource identification and governance.
FSx for OpenZFS file systems should be configured for Multi-AZ deployment
Verifies that FSx for OpenZFS file systems use the Multi-AZ deployment type for high availability across Availability Zones.
FSx for NetApp ONTAP file systems should be configured for Multi-AZ deployment
Ensures FSx for NetApp ONTAP file systems use a Multi-AZ deployment type for continuous availability even when an Availability Zone is unavailable.
FSx for Windows File Server file systems should be configured for Multi-AZ deployment
Ensures FSx for Windows File Server file systems use Multi-AZ deployment, distributing file servers across two Availability Zones for high availabilit...
Glue
AWS Glue machine learning transforms should be encrypted at rest
Verifies that AWS Glue machine learning transforms are encrypted at rest.
AWS Glue Spark jobs should run on supported versions of AWS Glue
Confirms that AWS Glue for Spark jobs run on a supported version of AWS Glue.
GuardDuty
GuardDuty should be enabled
Confirms that Amazon GuardDuty is enabled in each Region, so unusual or unauthorized activity is detected even in Regions you do not use. A finding on...
GuardDuty EKS Audit Log Monitoring should be enabled
Confirms that GuardDuty EKS Audit Log Monitoring is enabled across all accounts. This feature analyzes Kubernetes audit logs to detect suspicious acti...
GuardDuty Lambda Protection should be enabled
Verifies that GuardDuty Lambda Protection is enabled across all accounts. Lambda Protection monitors network activity logs for Lambda invocations to i...
GuardDuty EKS Runtime Monitoring should be enabled
Ensures GuardDuty EKS Runtime Monitoring with automated agent management is enabled across all accounts, providing threat detection coverage for EKS w...
GuardDuty Malware Protection for EC2 should be enabled
Ensures GuardDuty Malware Protection is enabled across all accounts to detect malware on EBS volumes attached to EC2 instances and container workloads...
GuardDuty RDS Protection should be enabled
Confirms that GuardDuty RDS Protection is enabled across all accounts to analyze and profile RDS login activity for access threats to Aurora databases...
GuardDuty S3 Protection should be enabled
Ensures GuardDuty S3 Protection is enabled across all accounts to monitor object-level API operations and identify potential security risks in S3 buck...
GuardDuty Runtime Monitoring should be enabled
Verifies that GuardDuty Runtime Monitoring is enabled across all accounts, providing OS-level, network, and file event analysis to detect threats in A...
GuardDuty ECS Runtime Monitoring should be enabled
Verifies that the GuardDuty automated security agent is enabled for runtime monitoring of ECS clusters on AWS Fargate in all accounts.
GuardDuty EC2 Runtime Monitoring should be enabled
Ensures the GuardDuty automated security agent is enabled for EC2 runtime monitoring in all accounts. GuardDuty Runtime Monitoring observes OS-level, ...
IAM
IAM policies should not allow full "*" administrative privileges
Flags IAM policies that grant full administrative privileges by allowing all actions (Action: *) on all resources (Resource: *) with Effect: Allow.
IAM users should not have IAM policies attached
Flags IAM users with policies attached directly rather than through groups or roles.
IAM users' access keys should be rotated every 90 days or less
Checks that each active IAM user access key is no more than 90 days old, counted from its creation because IAM records no rotation date. Rotation limi...
IAM root user access key should not exist
Confirms that no access keys exist for the IAM root user.
MFA should be enabled for all IAM users that have a console password
Checks that every IAM user with a console password has an MFA device assigned, so a stolen or guessed password alone cannot sign in. A user without a ...
Hardware MFA should be enabled for the root user
Verifies that the root user's MFA is a hardware device (a passkey or security key, or a hardware TOTP token), since an authenticator app may not ...
Password policies for IAM users should have strong configurations
Checks that the account password policy requires long, complex IAM user passwords that expire and cannot be reused, at the strictest value IAM.7 and I...
Unused IAM user credentials should be removed
Flags IAM users with a console password or active access key unused for 90 days or more; removing them narrows what an abandoned or compromised accoun...
MFA should be enabled for the root user
Confirms that MFA is enabled for the root user. Any device type clears this control; IAM.6 is the one that requires a hardware device.
Ensure IAM password policy expires passwords within 90 days or less
Verifies that the IAM account password policy expires passwords within 90 days or fewer, so a leaked password stops working on its own. Expiry switche...
Ensure a support role has been created to manage incidents with AWS Support
Ensures the AWSSupportAccess managed policy is attached to an IAM user, group or role so that incidents can be managed with AWS Support.
MFA should be enabled for all IAM users
Checks that every IAM user has an MFA device assigned, so a stolen password alone cannot sign in. Users with only access keys are in scope too: for th...
IAM customer managed policies that you create should not allow wildcard actions for services
Flags IAM customer managed policies containing statements that allow Service:* or use NotAction: Service:* with Effect: Allow.
IAM user credentials unused for 45 days should be removed
Flags IAM users with a console password or active access key unused for 45 days or more; removing them narrows what an abandoned or compromised accoun...
Expired SSL/TLS certificates managed in IAM should be removed
Flags expired SSL/TLS server certificates still present and active in IAM.
IAM identities should not have the AWSCloudShellFullAccess policy attached
Flags IAM identities (users, roles, or groups) that have the AWSCloudShellFullAccess managed policy attached.
IAM Access Analyzer external access analyzer should be enabled
Confirms that each Region has an active IAM Access Analyzer external access analyzer, which flags resources such as S3 buckets and IAM roles shared ou...
Inspector
Amazon Inspector EC2 scanning should be enabled
Confirms that Amazon Inspector EC2 scanning is enabled in each Region where the account has EC2 instances, so Inspector checks their installed package...
Amazon Inspector ECR scanning should be enabled
Verifies that Amazon Inspector ECR scanning is enabled in the account to detect software vulnerabilities in container images stored in ECR.
Amazon Inspector Lambda code scanning should be enabled
Ensures Amazon Inspector Lambda code scanning is enabled in each Region where the account has Lambda functions, so function code is checked for flaws ...
Amazon Inspector Lambda standard scanning should be enabled
Confirms that Amazon Inspector Lambda standard scanning is enabled in each Region where the account has Lambda functions, so the packages in each func...
KMS
IAM customer managed policies should not allow decryption actions on all KMS keys
Flags IAM customer managed policies that allow decrypt actions on all KMS keys, which could permit unauthorized decryption of sensitive data.
IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys
Detects IAM customer managed policies that allow decryption on all KMS keys without restriction, which can lead to unauthorized access to encrypted da...
AWS KMS keys should not be deleted unintentionally
Flags AWS KMS keys scheduled for deletion, which may be unintentional.
AWS KMS key rotation should be enabled
Verifies that AWS KMS keys have automatic key rotation enabled.
Kinesis
Firehose delivery streams should be encrypted at rest
Ensures Firehose delivery streams are encrypted at rest using AWS KMS. Data is encrypted before being written to the stream's storage layer and d...
Kinesis streams should be encrypted at rest
Confirms that Kinesis Data Streams are encrypted at rest with server-side encryption.
Kinesis streams should have an adequate data retention period
Verifies that Kinesis data streams have a data retention period of at least 168 hours (7 days).
Lambda
Lambda function policies should prohibit public access
Verifies that Lambda function resource-based policies do not grant public access from outside the account.
Lambda functions should use supported runtimes
Ensures Lambda functions use supported runtime versions for each language.
Lambda functions should be in a VPC
Confirms that Lambda functions are deployed within a VPC. Note: this check verifies VPC attachment only and does not evaluate subnet routing or public...
VPC Lambda functions should operate in multiple Availability Zones
Verifies that Lambda functions connected to a VPC are associated with subnets in more than one Availability Zone.
Lambda functions should have AWS X-Ray active tracing enabled
Ensures active AWS X-Ray tracing is enabled for Lambda functions.
MQ
ActiveMQ brokers should stream audit logs to CloudWatch
Verifies that Amazon MQ ActiveMQ brokers stream audit logs to CloudWatch Logs, enabling alarm creation and increased visibility into security-related ...
ActiveMQ brokers should use active/standby deployment mode
Ensures Amazon MQ ActiveMQ brokers use active/standby deployment mode for high availability. This configuration places two broker instances across two...
RabbitMQ brokers should use cluster deployment mode
Verifies that Amazon MQ RabbitMQ brokers use cluster deployment mode rather than single-instance deployment.
MSK
MSK clusters should be encrypted in transit among broker nodes
Confirms that Amazon MSK clusters encrypt data in transit between broker nodes using TLS, with no plain-text connections permitted.
MSK clusters should have enhanced monitoring configured
Verifies that Amazon MSK clusters have enhanced monitoring enabled at PER_TOPIC_PER_BROKER level or higher.
MSK Connect connectors should be encrypted in transit
Verifies that Amazon MSK Connect connectors encrypt data in transit.
Amazon MSK clusters should have public access disabled
Flags Amazon MSK clusters with public access enabled.
MSK connectors should have logging enabled
Ensures logging is enabled for Amazon MSK connectors via at least one of CloudWatch Logs, S3, or Firehose.
MSK clusters should disable unauthenticated access
Confirms that unauthenticated access is disabled for Amazon MSK clusters.
Macie
Macie automated sensitive data discovery should be enabled
Verifies that automated sensitive data discovery is enabled for the Amazon Macie administrator account.
Neptune
Neptune DB clusters should be encrypted at rest
Confirms that Neptune DB clusters are encrypted at rest.
Neptune DB clusters should publish audit logs to CloudWatch Logs
Verifies that Neptune DB clusters publish audit logs to CloudWatch Logs.
Neptune DB cluster snapshots should not be public
Flags Neptune DB cluster snapshots that are publicly accessible.
Neptune DB clusters should have deletion protection enabled
Verifies that Neptune DB clusters have deletion protection enabled.
Neptune DB clusters should have automated backups enabled
Confirms that Neptune DB clusters have automated backups enabled with a retention period of at least 7 days.
Neptune DB cluster snapshots should be encrypted at rest
Confirms that Neptune DB cluster snapshots are encrypted at rest.
Neptune DB clusters should have IAM database authentication enabled
Verifies that Neptune DB clusters have IAM database authentication enabled.
Neptune DB clusters should be configured to copy tags to snapshots
Ensures Neptune DB clusters are configured to copy tags to snapshots.
Neptune DB clusters should be deployed across multiple Availability Zones
Ensures Neptune DB clusters are deployed across multiple Availability Zones.
NetworkFirewall
Network Firewall firewalls should be deployed across multiple Availability Zones
Ensures AWS Network Firewall firewalls are deployed across multiple Availability Zones.
Network Firewall logging should be enabled
Confirms that logging is enabled for AWS Network Firewall with at least one log destination configured.
Network Firewall policies should have at least one rule group associated
Verifies that Network Firewall policies have at least one stateful or stateless rule group associated.
The default stateless action for Network Firewall policies should be drop or forward for full packets
Confirms that the default stateless action for full packets in Network Firewall policies is drop or forward, not pass.
The default stateless action for Network Firewall policies should be drop or forward for fragmented packets
Verifies that the default stateless action for fragmented packets in Network Firewall policies is drop or forward, not pass.
Stateless network firewall rule group should not be empty
Flags Network Firewall stateless rule groups that contain no rules.
Network Firewall firewalls should have deletion protection enabled
Verifies that AWS Network Firewall firewalls have deletion protection enabled.
Network Firewall firewalls should have subnet change protection enabled
Confirms that AWS Network Firewall firewalls have subnet change protection enabled.
Opensearch
OpenSearch domains should have encryption at rest enabled
Verifies that OpenSearch domains have encryption at rest enabled.
OpenSearch domains should not be publicly accessible
Confirms that OpenSearch domains are deployed within a VPC rather than exposed to the public internet, so only clients inside your network can reach t...
OpenSearch domains should encrypt data sent between nodes
Confirms that OpenSearch domains have node-to-node encryption enabled to protect data in transit within the cluster.
OpenSearch domain error logging to CloudWatch Logs should be enabled
Verifies that OpenSearch domains have error logging to CloudWatch Logs enabled.
OpenSearch domains should have audit logging enabled
Ensures OpenSearch domains have audit logging enabled to record and track changes for security and compliance.
OpenSearch domains should have at least three data nodes
Verifies that OpenSearch domains are configured with at least three data nodes for high availability and resilience.
OpenSearch domains should have fine-grained access control enabled
Ensures OpenSearch domains have fine-grained access control enabled to restrict access to domain data and configurations.
Connections to OpenSearch domains should be encrypted using the latest TLS security policy
Ensures connections to OpenSearch domains use TLS for secure data transmission.
OpenSearch domains should have the latest software update installed
Confirms that OpenSearch Service domains have the latest available software update installed.
OpenSearch domains should have at least three dedicated primary nodes
Verifies that OpenSearch Service domains have at least three dedicated primary nodes configured for cluster stability.
PrivateCA
AWS Private CA root certificate authority should be disabled
Flags enabled root certificate authorities in AWS Private CA. Root CAs should remain disabled except when issuing certificates to subordinate CAs, to ...
RDS
RDS snapshot should be private
Confirms that RDS DB snapshots and DB cluster snapshots are not public. Any AWS account can copy or restore a public snapshot, and making it private d...
RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration
Flags RDS DB instances with PubliclyAccessible set, which gives the instance a public IP address and an endpoint that resolves to it from outside the ...
RDS DB instances should have encryption at-rest enabled
Verifies that RDS DB instances have storage encryption enabled, which also covers their logs, automated backups, read replicas and snapshots. For an i...
RDS cluster snapshots and database snapshots should be encrypted at rest
Verifies that RDS DB snapshots and DB cluster snapshots are encrypted at rest, so the data in them stays protected wherever they are copied or restore...
RDS DB instances should be configured with multiple Availability Zones
Confirms that RDS DB instances use a Multi-AZ deployment, which keeps a synchronous standby in a second Availability Zone and fails over to it automat...
Enhanced monitoring should be configured for RDS DB instances
Confirms that RDS DB instances have Enhanced Monitoring turned on, which reads per-process CPU, memory and I/O from the operating system the database ...
RDS clusters should have deletion protection enabled
Confirms that RDS DB clusters have deletion protection enabled, so a stray delete of the cluster fails; it does not stop the data inside it being drop...
RDS DB instances should have deletion protection enabled
Confirms that RDS DB instances have deletion protection enabled, so a stray delete of the instance fails; it does not stop the data inside it being dr...
RDS DB instances should publish logs to CloudWatch Logs
Verifies that RDS DB instances publish database logs to CloudWatch Logs, where they are kept for security audits and for diagnosing availability issue...
IAM authentication should be configured for RDS instances
Checks that RDS for MySQL, MariaDB and PostgreSQL DB instances, and Aurora DB instances, have IAM database authentication enabled, so clients can sign...
RDS instances should have automatic backups enabled
Ensures RDS DB instances keep automated backups for at least 7 days, so a point-in-time restore can reach back that far; a retention period of 0 turns...
IAM authentication should be configured for RDS clusters
Checks that RDS DB clusters have IAM database authentication enabled, so clients can sign in with short-lived IAM tokens instead of stored passwords. ...
RDS automatic minor version upgrades should be enabled
Confirms that RDS DB instances have automatic minor version upgrades enabled, so engine patches and security fixes are applied in the maintenance wind...
Amazon Aurora clusters should have backtracking enabled
Confirms that Aurora MySQL clusters have backtracking enabled, so the cluster can be rewound to an earlier point in minutes to undo a destructive chan...
RDS DB clusters should be configured for multiple Availability Zones
Confirms that RDS DB clusters have instances in more than one Availability Zone, so a failover has a running instance elsewhere to move to. The cluste...
Aurora DB clusters should be configured to copy tags to DB snapshots
Checks that Aurora DB clusters copy their tags to DB snapshots when the snapshots are created, so each snapshot inherits the tags that drive cost allo...
RDS DB instances should be configured to copy tags to snapshots
Checks that RDS DB instances copy their tags to snapshots when the snapshots are created, so each snapshot inherits the tags that drive cost allocatio...
Existing RDS event notification subscriptions should be configured for critical cluster events
Checks that each RDS event subscription for DB clusters covers the maintenance and failure event categories, so a pending cluster maintenance action o...
Existing RDS event notification subscriptions should be configured for critical database instance events
Checks that each RDS event subscription for DB instances covers the maintenance, configuration change and failure event categories, so a pending maint...
An RDS event notifications subscription should be configured for critical database parameter group events
Checks that a Region with RDS event subscriptions has an active one for DB parameter groups covering configuration change, so an edit that can change ...
An RDS event notifications subscription should be configured for critical database security group events
Checks that a Region with RDS event subscriptions has an active one for DB security groups covering configuration change and failure. A Region with no...
RDS instances should not use a database engine default port
Flags RDS DB instances listening on their engine's default port, the one untargeted scans try first. This is one thin layer, never a substitute f...
RDS Database Clusters should use a custom administrator username
Flags RDS database clusters whose master username is admin, root, sa, oracle or postgres, in any letter case. These are the names tried first, so a cl...
RDS database instances should use a custom administrator username
Flags RDS database instances whose master username is admin, root, sa, oracle or postgres, in any letter case. These are the names tried first, so an ...
RDS DB instances should be protected by a backup plan
Confirms that each RDS DB instance is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery poin...
RDS DB clusters should be encrypted at rest
Verifies that RDS DB clusters are encrypted at rest, which also covers the cluster's automated backups, logs and snapshots. DocumentDB and Neptun...
Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs
Verifies that Aurora MySQL DB clusters publish audit logs to CloudWatch Logs, so the record of logins, data changes and schema changes is kept outside...
RDS DB clusters should have automatic minor version upgrade enabled
Ensures automatic minor version upgrade is enabled on RDS DB clusters, including Aurora, so the cluster and its instances receive minor version patche...
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
Verifies that RDS for PostgreSQL DB instances publish the postgresql log to CloudWatch Logs, where it is kept durably and can be searched and alarmed ...
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs
Verifies that Aurora PostgreSQL DB clusters publish the postgresql log to CloudWatch Logs, where it is kept durably and can be searched and alarmed on...
RDS for PostgreSQL DB instances should be encrypted in transit
Checks that RDS for PostgreSQL DB instances set rds.force_ssl to 1 in their DB parameter group. With it on, the database rejects any connection that d...
RDS for MySQL DB instances should be encrypted in transit
Checks that RDS for MySQL DB instances set require_secure_transport to 1 in their DB parameter group. With it on, the database refuses any connection ...
RDS for SQL Server DB instances should publish logs to CloudWatch Logs
Verifies that RDS for SQL Server DB instances publish the error log to CloudWatch Logs. RDS keeps at most 30 error logs on the instance and may delete...
RDS for SQL Server DB instances should be encrypted in transit
Checks that RDS for SQL Server DB instances set rds.force_ssl to 1 in their DB parameter group, which makes SQL Server encrypt every connection. Witho...
RDS for MariaDB DB instances should publish logs to CloudWatch Logs
Verifies that RDS for MariaDB DB instances publish the error log to CloudWatch Logs, where it is kept durably for audits and for diagnosing availabili...
RDS DB proxies should require TLS encryption for connections
Flags RDS DB proxies that do not require TLS, so a client can connect to the proxy unencrypted. The setting covers only the client-to-proxy leg: wheth...
RDS for MariaDB DB instances should be encrypted in transit
Checks that RDS for MariaDB DB instances set require_secure_transport to 1 in their DB parameter group, so the database refuses any connection that do...
Aurora MySQL DB clusters should have audit logging enabled
Confirms that Aurora MySQL DB clusters have audit logging enabled through the server_audit_logging cluster parameter, so the engine can record logins,...
RDS DB instances should not be deployed in public subnets with routes to internet gateways
Flags RDS DB instances whose DB subnet group includes any subnet with an active route to an internet gateway, whatever its destination; a subnet with ...
RDS for PostgreSQL DB clusters should be configured to copy tags to DB snapshots
Checks that RDS for PostgreSQL DB clusters copy their tags to DB snapshots when the snapshots are created, so each snapshot inherits the tags that dri...
RDS for MySQL DB clusters should be configured to copy tags to DB snapshots
Checks that RDS for MySQL DB clusters copy their tags to DB snapshots when the snapshots are created, so each snapshot inherits the tags that drive co...
RDS DB clusters should have enough backup retention period set
Flags Amazon RDS DB clusters whose backup retention period is shorter than 7 days, which limits how far back a point-in-time restore can reach and so ...
RDS global clusters should run on a supported Aurora MySQL version
Flags Aurora MySQL global clusters on an engine version below the minimum AWS publishes for this control, unless it is a long-term support release; su...
Redshift
Amazon Redshift clusters should prohibit public access
Flags Redshift clusters that are publicly accessible.
Connections to Amazon Redshift clusters should be encrypted in transit
Ensures connections to Redshift clusters require encryption in transit.
Amazon Redshift clusters should have automatic snapshots enabled
Confirms that Redshift clusters have automated snapshots enabled and retained for at least seven days.
Amazon Redshift clusters should have audit logging enabled
Verifies that Redshift clusters have audit logging enabled.
Amazon Redshift should have automatic upgrades to major versions enabled
Ensures automatic major version upgrades are enabled for Redshift clusters.
Redshift clusters should use enhanced VPC routing
Confirms that Redshift clusters have Enhanced VPC Routing enabled to route COPY and UNLOAD traffic through the VPC.
Amazon Redshift clusters should not use the default Admin username
Flags Redshift clusters whose admin username is a default or easily guessed name such as awsuser, admin, root, sa, oracle or postgres.
Redshift clusters should be encrypted at rest
Verifies that Redshift clusters are encrypted at rest.
Redshift security groups should allow ingress on the cluster port only from restricted origins
Flags Redshift cluster security groups that allow unrestricted ingress (0.0.0.0/0 or ::/0) to the cluster port. A port range containing it or an All t...
Redshift cluster subnet groups should have subnets from multiple Availability Zones
Verifies that Redshift cluster subnet groups contain subnets from at least two Availability Zones.
Redshift clusters should have Multi-AZ deployments enabled
Confirms that Multi-AZ deployment is enabled for Redshift clusters.
RedshiftServerless
Amazon Redshift Serverless workgroups should use enhanced VPC routing
Flags Amazon Redshift Serverless workgroups that do not have enhanced VPC routing enabled. Without it, COPY/UNLOAD traffic between the workgroup and o...
Connections to Redshift Serverless workgroups should be required to use SSL
Verifies that Redshift Serverless workgroups require SSL for all connections.
Redshift Serverless workgroups should prohibit public access
Flags Amazon Redshift Serverless workgroups whose publiclyAccessible setting is true. Public workgroups receive a public IP address and are reachable ...
Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys
Flags Amazon Redshift Serverless namespaces that are not encrypted with a customer-managed KMS key. AWS-owned and AWS-managed keys cannot be audited v...
Redshift Serverless namespaces should not use the default admin username
Flags Amazon Redshift Serverless namespaces whose admin username is a default or easily guessed name such as admin, awsuser, root, sa, oracle or postg...
Redshift Serverless namespaces should export logs to CloudWatch Logs
Flags Amazon Redshift Serverless namespaces that do not export connection and user logs to CloudWatch Logs. Without these exports, failed sign-ins and...
Route53
Route 53 public hosted zones should log DNS queries
Confirms that DNS query logging is enabled for Route 53 public hosted zones.
S3
S3 general purpose buckets should have block public access settings enabled
Checks that all four S3 Block Public Access settings are on for the account. Account-level settings apply to every bucket and a bucket cannot loosen t...
S3 general purpose buckets should block public read access
Checks whether an S3 general purpose bucket's policy or ACL grants public read access that Block Public Access, on the bucket or the account, doe...
S3 general purpose buckets should block public write access
Confirms that S3 buckets block public write access through both ACLs and bucket policies.
S3 general purpose buckets should require requests to use SSL
Checks that the S3 general purpose bucket's policy denies every request made without TLS, so data sent to or from the bucket cannot be read or al...
S3 general purpose bucket policies should restrict access to other AWS accounts
Flags S3 bucket policies that grant overly permissive access to other AWS accounts.
S3 general purpose buckets should use cross-Region replication
Verifies that S3 buckets have cross-Region replication enabled.
S3 general purpose buckets should block public access
Checks that all four Block Public Access settings are on for the S3 general purpose bucket itself; the account-level settings do not count here. With ...
S3 general purpose buckets should have server access logging enabled
Checks that server access logging is on for the S3 general purpose bucket, recording each request for security and access audits. The bucket that rece...
S3 general purpose buckets with versioning enabled should have Lifecycle configurations
Checks that a versioned S3 general purpose bucket has at least one enabled lifecycle rule. With versioning on, every overwrite and delete keeps the pr...
S3 general purpose buckets should have event notifications enabled
Checks that the S3 general purpose bucket sends event notifications to Amazon EventBridge, an SNS topic, an SQS queue or a Lambda function, so changes...
ACLs should not be used to manage user access to S3 general purpose buckets
Checks that the S3 general purpose bucket has ACLs disabled, with Object Ownership set to Bucket owner enforced. An ACL grants access outside the buck...
S3 general purpose buckets should have Lifecycle configurations
Confirms that S3 buckets have at least one enabled lifecycle rule for object management. A lifecycle configuration whose rules are all disabled acts o...
S3 general purpose buckets should have versioning enabled
Verifies that S3 buckets have versioning enabled.
S3 general purpose buckets should have Object Lock enabled
Checks that the S3 general purpose bucket has Object Lock enabled. Object Lock stores objects write-once-read-many, so a locked object version cannot ...
S3 general purpose buckets should be encrypted at rest with AWS KMS keys
Confirms that S3 buckets are encrypted at rest using AWS KMS keys.
S3 access points should have block public access settings enabled
Checks that an S3 access point has all four Block Public Access settings on. S3 combines them with the bucket's and the account's settings a...
S3 general purpose buckets should have MFA delete enabled
Verifies that MFA delete is enabled for S3 general purpose buckets, requiring multi-factor authentication for object deletion.
S3 general purpose buckets should log object-level write events
Checks that at least one CloudTrail multi-Region trail logs S3 object-level write events for every bucket, recording who wrote or deleted each object....
S3 general purpose buckets should log object-level read events
Checks that at least one CloudTrail multi-Region trail logs S3 object-level read events for every bucket, recording who read each object. One trail co...
S3 Multi-Region Access Points should have block public access settings enabled
Checks that an S3 Multi-Region Access Point has all four Block Public Access settings on. S3 combines them with the account's and each bucket...
S3 directory buckets should have lifecycle configurations
Ensures S3 directory buckets have at least one enabled lifecycle rule. A lifecycle configuration whose rules are all disabled acts on no object, so it...
SES
SES configuration sets should have TLS enabled for sending emails
Flags Amazon SES configuration sets whose delivery options do not require TLS. When TLS is optional, SES falls back to unencrypted SMTP whenever the r...
SNS
SNS topics should be encrypted at-rest using AWS KMS
Verifies that SNS topics are encrypted at rest using a KMS key.
SNS topic access policies should not allow public access
Flags SNS topic access policies that allow public access.
SQS
Amazon SQS queues should be encrypted at rest
Confirms that SQS queues are encrypted at rest using SSE-SQS or an AWS KMS key.
SQS queue access policies should not allow public access
Flags SQS queue access policies that allow public access.
SSM
EC2 instances should be managed by AWS Systems Manager
Confirms that EC2 instances are managed by AWS Systems Manager.
EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation
Verifies that Systems Manager patch compliance on EC2 instances shows a compliant status.
EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT
Verifies that Systems Manager associations on EC2 instances are in a compliant state.
SSM documents should not be public
Flags account-owned SSM documents that are publicly shared, which may expose sensitive configuration information.
SSM Automation should have CloudWatch logging enabled
Verifies that CloudWatch logging is enabled for AWS Systems Manager Automation.
SSM documents should have the block public sharing setting enabled
Ensures the block public sharing setting for SSM documents, which is set per Region, is on in this Region. A public document can expose information ab...
SageMaker
Amazon SageMaker notebook instances should not have direct internet access
Confirms that direct internet access is disabled for SageMaker notebook instances.
SageMaker notebook instances should be launched in a custom VPC
Ensures SageMaker notebook instances are launched within a custom VPC.
Users should not have root access to SageMaker notebook instances
Flags SageMaker notebook instances that have root access enabled.
SageMaker endpoint production variants should have an initial instance count greater than 1
Confirms that SageMaker endpoint production variants are configured with more than one initial instance to avoid single points of failure. Serverless ...
SageMaker models should have network isolation enabled
Verifies that SageMaker hosted models have network isolation enabled, preventing the model container from making outbound network calls.
SageMaker notebook instances should run on supported platforms
Verifies that SageMaker notebook instances are configured to run on a supported platform version.
SageMaker data quality job definitions should have inter-container traffic encryption enabled
Flags Amazon SageMaker data quality monitoring job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled. Without it, traf...
SageMaker model explainability job definitions should have inter-container traffic encryption enabled
Flags Amazon SageMaker model explainability monitoring job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled.
SageMaker data quality job definitions should have network isolation enabled
Flags Amazon SageMaker data quality monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the container...
SageMaker model bias job definitions should have network isolation enabled
Flags Amazon SageMaker model bias monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containers ...
SageMaker model quality job definitions should have inter-container traffic encryption enabled
Flags Amazon SageMaker model quality monitoring job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled.
SageMaker monitoring schedules should have network isolation enabled
Flags Amazon SageMaker monitoring schedules whose underlying job definition has NetworkConfig.EnableNetworkIsolation disabled. The schedule inherits t...
SageMaker model bias job definitions should have inter-container traffic encryption enabled
Flags SageMaker model bias job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled, leaving traffic between the job'...
SageMaker models should use private registry in VPC for primary containers
Flags SageMaker models whose PrimaryContainer pulls images via the public ECR endpoint rather than a private-VPC registry. Setting ImageConfig.Reposit...
SageMaker feature group offline stores should be encrypted with AWS KMS keys
Flags Amazon SageMaker feature groups whose offline store does not specify a KMS key. Without an explicit KmsKeyId, the underlying S3 storage relies o...
SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys
Flags Amazon SageMaker feature groups whose online store uses standard storage without a KMS key. Without an explicit KmsKeyId the online store relies...
SageMaker models should use private registry in VPC for multi-container inference pipelines
Flags SageMaker inference-pipeline models whose Containers[] pull images via the public ECR endpoint. Every container in the pipeline must set ImageCo...
SageMaker model explainability job definitions should have network isolation enabled
Flags Amazon SageMaker model explainability monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the c...
SageMaker notebook instances should be encrypted with customer managed AWS KMS keys
Flags Amazon SageMaker notebook instances that have no KMS key configured for storage-volume encryption. Without a KmsKeyId the volume is encrypted wi...
SageMaker monitoring schedules should have inter-container traffic encryption enabled
Flags Amazon SageMaker monitoring schedules whose underlying job definition does not enable inter-container traffic encryption. Traffic between distri...
SageMaker inference experiments should have instance storage volume encrypted with customer managed AWS KMS keys
Flags Amazon SageMaker inference experiments with no KMS key for instance-storage-volume encryption. Without a key the ML storage volume relies on the...
SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys
Flags Amazon SageMaker inference experiments that capture data but specify no KMS key for the captured data at rest. Applies only when data storage ca...
SageMaker model quality job definitions should have network isolation enabled
Flags Amazon SageMaker model quality monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containe...
SecretsManager
Secrets Manager secrets should have automatic rotation enabled
Verifies that secrets stored in Secrets Manager are configured for automatic rotation.
Secrets Manager secrets configured with automatic rotation should rotate successfully
Confirms that Secrets Manager secrets have rotated successfully according to their rotation schedule.
Remove unused Secrets Manager secrets
Flags secrets that have not been accessed within 90 days, indicating they may be stale or unused.
Secrets Manager secrets should be rotated within a specified number of days
Flags secrets that have not been rotated within the last 90 days.
ServiceCatalog
Service Catalog portfolios should be shared within an AWS organization only
Confirms that Service Catalog portfolios are shared only within the AWS organization when Organizations integration is enabled.
StepFunctions
Step Functions state machines should have logging turned on
Confirms that Step Functions state machines have logging enabled.
Transfer
Transfer Family servers should not use FTP protocol for endpoint connection
Flags Transfer Family servers that use FTP for endpoint connections. FTP transmits data in plaintext and should be replaced with SFTP or FTPS.
Transfer Family connectors should have logging enabled
Verifies that CloudWatch logging is enabled for AWS Transfer Family connectors.
WAF
AWS WAF Classic Global Web ACL logging should be enabled
Verifies that logging is enabled for AWS WAF global web ACLs.
AWS WAF Classic Regional rules should have at least one condition
Verifies that AWS WAF Regional rules contain at least one condition.
AWS WAF Classic Regional rule groups should have at least one rule
Confirms that AWS WAF Regional rule groups contain at least one rule.
AWS WAF Classic Regional web ACLs should have at least one rule or rule group
Confirms that AWS WAF Regional web ACLs contain at least one rule or rule group.
AWS WAF Classic global rules should have at least one condition
Confirms that AWS WAF global rules contain at least one condition.
AWS WAF Classic global rule groups should have at least one rule
Verifies that AWS WAF global rule groups contain at least one rule.
AWS WAF Classic global web ACLs should have at least one rule or rule group
Confirms that AWS WAF global web ACLs contain at least one rule or rule group.
AWS WAF web ACLs should have at least one rule or rule group
Confirms that WAFv2 web ACLs contain at least one rule or rule group.
AWS WAF rules should have CloudWatch metrics enabled
Ensures CloudWatch metrics are enabled for AWS WAF rules and rule groups.
WorkSpaces
WorkSpaces user volumes should be encrypted at rest
Verifies that WorkSpaces user volumes are encrypted at rest.
WorkSpaces root volumes should be encrypted at rest
Confirms that WorkSpaces root volumes are encrypted at rest.
No check matches that. Try a service name, or clear the filter.