Security Checks
AWS Security Checks
Each of the 426 checks, across 62 AWS services, is evaluated directly against your accounts. GuardKite reports which ones changed and which findings are reachable, and every check's page says how to fix what it finds.
ACM
Imported and ACM-issued certificates should be renewed after a specified time period
Checks that an ACM certificate, imported or issued by ACM, does not expire within 30 days, AWS's default period; an expired one fails too. ACM ne...
RSA certificates managed by ACM should use a key length of at least 2,048 bits
Verifies that RSA certificates managed by ACM use a key length of at least 2,048 bits, as shorter keys are considered cryptographically weak. Certific...
APIGateway
API Gateway REST and WebSocket API execution logging should be enabled
Checks that execution logging is on at the ERROR or INFO level for all methods of the REST or WebSocket API stage, recording how API Gateway handled e...
API Gateway REST API stages should be configured to use SSL certificates for backend authentication
Checks that the REST API stage has a client certificate, which API Gateway presents on calls to HTTP integrations so the backend can verify they come ...
API Gateway REST API stages should have AWS X-Ray tracing enabled
Checks that AWS X-Ray active tracing is on for the REST API stage. Active tracing samples requests and follows them through the API and the services i...
API Gateway should be associated with a WAF Web ACL
Checks that the REST API stage is associated with an AWS WAF web ACL, whose rules allow, block or count requests to protect the API from attacks such ...
API Gateway REST API cache data should be encrypted at rest
Checks that every method in the REST API stage that caches responses has its cache data encrypted at rest; a stage where no method caches passes. Encr...
API Gateway routes should specify an authorization type
Checks that the HTTP or WebSocket API route has an authorization type, so only authorized users or processes can call it. Only the field's presen...
Access logging should be configured for API Gateway V2 Stages
Checks that the HTTP or WebSocket API stage has access logging set up with a destination log group. Access logs record who called the API and how, for...
API Gateway V2 integrations should use HTTPS for private connections
Checks that the API's private integration over a VPC link has a TLS configuration, so traffic to the private backend uses HTTPS. A VPC link is pr...
API Gateway domain names should use recommended security policies
Checks that the API Gateway custom domain name does not use the legacy TLS_1_0 security policy, which accepts TLS 1.0 with its known weaknesses. TLS_1...
Account
Security contact information should be provided for an AWS account
Checks that the AWS account has a security alternate contact with a name, email address and phone number, so AWS can reach someone besides the root us...
AWS account should be part of an AWS Organizations organization
Checks that the AWS account is a member of an AWS Organizations organization, so it can be managed with your other accounts as a single unit, with cen...
AppSync
AWS AppSync should have field-level logging enabled
Checks that an AWS AppSync GraphQL API sends field-level resolver logs to CloudWatch Logs at the Error or All level; None, Info and Debug fail. Field-...
AWS AppSync GraphQL APIs should not be authenticated with API keys
Flags AppSync GraphQL APIs whose default authorization mode is API key. A key is a hard-coded value that, if compromised, exposes the endpoint to unau...
Athena
Athena workgroups should have logging enabled
Checks that the Athena workgroup publishes query metrics to CloudWatch, which is what AWS's control counts as logging for a workgroup; one with t...
AutoScaling
Auto scaling groups associated with a load balancer should use ELB health checks
Checks that an Auto Scaling group attached to a Classic Load Balancer or a target group uses ELB health checks, so instances the load balancer reports...
Amazon EC2 Auto Scaling group should cover multiple Availability Zones
Checks that the Auto Scaling group spans at least two Availability Zones, so it can launch instances in another zone when one becomes unavailable. A s...
Auto Scaling group launch configurations should configure EC2 instances to require Instance Metadata Service Version 2 (IMDSv2)
Checks that the launch configuration requires IMDSv2 (MetadataOptions HttpTokens set to required), whose session tokens protect instance metadata, inc...
Amazon EC2 instances launched using Auto Scaling group launch configurations should not have Public IP addresses
Checks that the launch configuration does not assign public IP addresses to its instances (AssociatePublicIpAddress true); they should be reached thro...
Auto Scaling groups should use multiple instance types in multiple Availability Zones
Checks that the Auto Scaling group defines more than one instance type in its mixed instances policy, so it can launch another type when one runs shor...
EC2 Auto Scaling groups should use EC2 launch templates
Checks that the Auto Scaling group launches from an EC2 launch template, directly or in a mixed instances policy, rather than a launch configuration. ...
Backup
AWS Backup recovery points should be encrypted at rest
Checks that the latest AWS Backup recovery point of the protected resource is encrypted at rest; older recovery points are not read. Backups of EBS, E...
Bedrock
Amazon Bedrock data sources should be encrypted with customer managed AWS KMS keys
Checks that an Amazon Bedrock knowledge base data source names a customer managed KMS key for the transient data Bedrock stores while ingesting it. Wi...
BedrockAgentCore
Bedrock AgentCore runtimes should be configured with VPC network mode
Checks that an Amazon Bedrock AgentCore runtime uses VPC network mode, and fails one set to PUBLIC. A PUBLIC runtime talks to the internet directly; i...
Bedrock AgentCore Gateways should require authorization for inbound requests
Checks that an Amazon Bedrock AgentCore gateway authorizes inbound requests with AWS_IAM or CUSTOM_JWT. Without it, anyone who can reach the endpoint ...
Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys
Checks that an Amazon Bedrock AgentCore Memory is encrypted at rest with a customer managed KMS key. Without an encryptionKeyArn its data is still enc...
Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys
Checks that an Amazon Bedrock AgentCore gateway is encrypted at rest with a customer managed KMS key. Without a kmsKeyArn it is still encrypted, under...
Bedrock AgentCore custom browsers should not use public network mode
Checks that an Amazon Bedrock AgentCore custom browser does not use PUBLIC network mode. A PUBLIC browser reaches the internet directly; in VPC mode i...
Bedrock AgentCore custom browsers should have session recording enabled
Checks that an Amazon Bedrock AgentCore custom browser records its sessions to an S3 location. A recording keeps each session's page changes, use...
Bedrock AgentCore custom code interpreters should use a private network configuration
Checks that an Amazon Bedrock AgentCore custom code interpreter uses VPC network mode; PUBLIC and SANDBOX both fail. In VPC mode the code runs behind ...
CloudFormation
CloudFormation stacks should have termination protection enabled
Checks that a CloudFormation stack has termination protection enabled, so a request to delete it fails and the stack and every resource it manages sta...
CloudFormation stacks should have associated service roles
Checks that a CloudFormation stack has a service role, so CloudFormation acts with that role's permissions instead of those of whoever runs the o...
CloudFront
CloudFront distributions should have a default root object configured
Checks that a CloudFront distribution with an S3 origin has a default root object, so a request for the root URL returns that object rather than passi...
CloudFront distributions should require encryption in transit
Checks that every cache behavior on the CloudFront distribution, the default one and each path pattern, requires HTTPS or redirects HTTP to HTTPS, so ...
CloudFront distributions should have origin failover configured
Checks that the CloudFront distribution has an origin group of two origins, so CloudFront can send a request the primary origin fails to the secondary...
CloudFront distributions should have logging enabled
Checks that standard logging (legacy) is on for the CloudFront distribution, recording every request for security audits and investigations. As in AWS...
CloudFront distributions should have WAF enabled
Checks that the CloudFront distribution is associated with an AWS WAF or AWS WAF Classic web ACL, which filters malicious requests before they reach t...
CloudFront distributions should use custom SSL/TLS certificates
Checks that the CloudFront distribution uses a custom SSL/TLS certificate rather than the default *.cloudfront.net one, so viewers reach it on your ow...
CloudFront distributions should use SNI to serve HTTPS requests
Checks that the CloudFront distribution serves HTTPS with SNI rather than a dedicated IP address in every edge location, which carries a monthly charg...
CloudFront distributions should encrypt traffic to custom origins
Checks that CloudFront encrypts traffic to each custom origin, so it cannot be read or altered between the edge and the origin. It fails on an origin ...
CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins
Checks that no custom origin on the CloudFront distribution allows SSLv3, which the IETF deprecated in 2015 as insufficiently secure. Only SSLv3 fails...
CloudFront distributions should not point to non-existent S3 origins
Detects CloudFront S3 origins whose bucket no longer exists: anyone can create a bucket with that name and serve their own content through the distrib...
CloudFront distributions should use origin access control
Checks that every S3 origin of a CloudFront distribution uses origin access control (OAC), which lets the bucket refuse direct requests so its content...
CloudFront distributions should use the recommended TLS security policy
Checks that a CloudFront distribution with a custom SSL/TLS certificate uses a recommended security policy for viewer connections. The policy sets the...
CloudFront distributions should use origin access control for Lambda function URL origins
Checks that every Lambda function URL origin of a CloudFront distribution uses origin access control (OAC), so CloudFront signs its requests and the U...
CloudFront distributions should use trusted key groups for signed URLs and cookies
Checks that every cache behavior of a CloudFront distribution restricts viewer access with a trusted key group. A behavior on legacy trusted signers f...
CloudTrail
CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events
Ensures a multi-Region trail, which covers the whole account, records read and write management events. A finding on a trail means its event selectors...
CloudTrail should have encryption at-rest enabled
Checks that the trail encrypts the log and digest files it delivers with an AWS KMS key (SSE-KMS) rather than S3's default SSE-S3, so reading the...
At least one CloudTrail trail should be enabled
Verifies that each Region has at least one CloudTrail trail, which delivers a lasting record of API calls to S3 beyond the 90 days of event history Cl...
CloudTrail log file validation should be enabled
Checks that log file integrity validation is on for the trail, so CloudTrail delivers signed digest files holding a hash of each log file and you can ...
CloudTrail trails should be integrated with Amazon CloudWatch Logs
Checks that the trail sends its events to a CloudWatch Logs log group, where metric filters and alarms can flag account activity as it happens instead...
Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible
Checks whether the S3 bucket a trail delivers its logs to allows public read through its ACL or bucket policy (Principal * or NotPrincipal, and wildca...
Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
Checks that server access logging is on for the S3 bucket the trail delivers its logs to, so every request made to that bucket, including reads and de...
CloudWatch
CloudWatch alarms should have specified actions configured
Verifies that CloudWatch metric alarms have at least one action for the ALARM state, so a breached threshold notifies someone or triggers a response. ...
CloudWatch log groups should be retained for a specified time period
Checks that the CloudWatch Logs log group keeps its log events for at least 365 days, the default of AWS's control, so the logs are still there f...
CloudWatch alarm actions should be enabled
Ensures CloudWatch metric alarms have actions enabled so they trigger the configured response when a state change occurs. With actions disabled, the a...
CodeBuild
CodeBuild Bitbucket source repository URLs should not contain sensitive credentials
Checks that a CodeBuild project's primary source URL has no user name or password before the host, as in https://user:token@host/repo. Anyone who...
CodeBuild project environment variables should not contain clear text credentials
Checks that no CodeBuild project environment variable named exactly AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, PASSWORD or TOKEN has the plain-text typ...
CodeBuild S3 logs should be encrypted
Checks that a CodeBuild project writing build logs to S3 keeps them encrypted; a project with S3 log encryption disabled fails, and one without S3 log...
CodeBuild project environments should have a logging configuration
Checks that a CodeBuild project has at least one log destination enabled, S3 or CloudWatch Logs; a project with both disabled fails. Build logs are th...
CodeBuild report group exports should be encrypted at rest
Checks that the test results a CodeBuild report group exports to S3 are encrypted at rest; a group with artifact encryption disabled fails. A group th...
Cognito
Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication
Checks that a Cognito user pool has threat protection, formerly advanced security features, active in Full function mode for standard authentication; ...
Cognito identity pools should not allow unauthenticated identities
Checks that a Cognito identity pool does not allow unauthenticated identities (guest access). With guest access, the pool gives temporary AWS credenti...
Password policies for Cognito user pools should have strong configurations
Checks that a Cognito user pool's password policy requires at least 8 characters, an uppercase letter, a lowercase letter, a number and a symbol,...
Cognito user pools should have threat protection activated with full function enforcement mode for custom authentication
Checks that a Cognito user pool has threat protection in Full function mode for both standard and custom authentication (sign-in through custom challe...
MFA should be enabled for Cognito user pools
Checks that a Cognito user pool with a password-only sign-in policy has MFA required or optional; off fails. MFA adds a second factor, something the u...
Cognito user pools should have deletion protection enabled
Checks that a Cognito user pool has deletion protection active. Without it, a single DeleteUserPool call removes the pool and every user account in it...
Connect
Amazon Connect instances should have CloudWatch logging enabled
Checks that an Amazon Connect instance has flow logs turned on, which sends events from its flows to a CloudWatch log group for finding errors, monito...
DMS
Database Migration Service replication instances should not be public
Flags DMS replication instances that are publicly accessible. A private replication instance has only a private IP address, so it cannot be reached fr...
DMS replication instances should have automatic minor version upgrade enabled
Checks that automatic version upgrade is on for the DMS replication instance. With it on, DMS moves the instance off a deprecated engine version durin...
DMS replication tasks for the target database should have logging enabled
Checks that the replication task logs its TARGET_APPLY and TARGET_LOAD components to CloudWatch at LOGGER_SEVERITY_DEFAULT or higher, so the statement...
DMS replication tasks for the source database should have logging enabled
Checks that the replication task logs its SOURCE_CAPTURE and SOURCE_UNLOAD components to CloudWatch at LOGGER_SEVERITY_DEFAULT or higher, so the chang...
DMS endpoints should use SSL
Checks that the DMS endpoint's SSL mode is require, verify-ca or verify-full, so the connection between the replication instance and the database...
DMS endpoints for Neptune databases should have IAM authorization enabled
Checks that a DMS endpoint for an Amazon Neptune target has IAM authorization enabled, so DMS reaches the Neptune cluster through the endpoint's ...
DMS endpoints for MongoDB should have an authentication mechanism enabled
Checks that a DMS endpoint for a MongoDB source uses password authentication rather than none, so only a MongoDB user with valid credentials can read ...
DMS endpoints for Redis OSS should have TLS enabled
Checks that a DMS endpoint for a Redis OSS target connects with TLS (SSL encryption rather than plain text), so the data DMS writes to the Redis OSS c...
DMS replication instances should be configured to use multiple Availability Zones
Checks that the DMS replication instance is a Multi-AZ deployment. DMS then keeps a synchronously replicated standby in another Availability Zone, and...
DataSync
DataSync tasks should have logging enabled
Checks that the DataSync task publishes logs to CloudWatch Logs, recording transfer errors or every file moved and verified, for investigations and au...
DocumentDB
Amazon DocumentDB clusters should be encrypted at rest
Checks that a DocumentDB cluster is encrypted at rest with an AWS KMS key. Cluster encryption also covers its instances, automated backups, snapshots ...
Amazon DocumentDB clusters should have an adequate backup retention period
Checks that a DocumentDB cluster keeps automated backups for at least 7 days; new clusters default to 1. The retention period bounds how far back a po...
Amazon DocumentDB manual cluster snapshots should not be public
Checks whether a DocumentDB manual cluster snapshot is public, which lets any AWS account copy or restore its data. A copy made while it was public is...
Amazon DocumentDB clusters should publish audit logs to CloudWatch Logs
Checks that a DocumentDB cluster exports audit logs to CloudWatch Logs, so authentication attempts, dropped collections, new indexes and user changes ...
Amazon DocumentDB clusters should have deletion protection enabled
Checks that a DocumentDB cluster has deletion protection enabled, so a request to delete the cluster fails until someone first turns the setting off. ...
Amazon DocumentDB clusters should be encrypted in transit
Checks that a DocumentDB cluster requires TLS 1.2 or later: the tls parameter in its cluster parameter group must be tls1.2+, tls1.3+ or fips-140-3, s...
DynamoDB
DynamoDB tables should automatically scale capacity with demand
Checks that the DynamoDB table uses on-demand capacity mode, or provisioned mode with auto scaling configured. A table whose capacity follows demand a...
DynamoDB tables should have point-in-time recovery enabled
Checks that point-in-time recovery (PITR) is turned on for the DynamoDB table. PITR backs the table up continuously, so after an accidental write or d...
DynamoDB Accelerator (DAX) clusters should be encrypted at rest
Checks that the DAX cluster is encrypted at rest. DAX writes cached data to disk as it propagates changes from the primary node to read replicas, and ...
DynamoDB tables should be present in a backup plan
Confirms that each DynamoDB table is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery point...
DynamoDB tables should have deletion protection enabled
Checks that deletion protection is turned on for the DynamoDB table. While it is on, no one can delete the table, whatever their IAM permissions, whic...
DynamoDB Accelerator clusters should be encrypted in transit
Checks that the DAX cluster's endpoint encryption type is TLS, so requests and responses between your application and the cluster are encrypted a...
EC2
EBS snapshots should not be configured to be publicly restorable
Checks whether an EBS snapshot's createVolumePermission grants the all group, which lets any AWS account create a volume holding all of the snaps...
VPC default security groups should not allow inbound or outbound traffic
Confirms that each VPC's default security group has no inbound or outbound rules. AWS attaches this group to resources launched without one and i...
Attached EBS volumes should be encrypted at-rest
Confirms that EBS volumes attached to an instance are encrypted at rest, which also protects their snapshots and the data moving between volume and in...
Stopped EC2 instances should be removed after a specified time period
Flags EC2 instances stopped for more than 30 days. A stopped instance gets no patches, so it rejoins the network carrying every vulnerability fixed wh...
VPC flow logging should be enabled in all VPCs
Verifies that each VPC has a flow log, which records the traffic crossing it for detecting anomalies and investigating incidents. Only a flow log on t...
EBS default encryption should be enabled
Verifies that EBS encryption by default is on for the account in this Region, so every new EBS volume and snapshot copy is encrypted at rest with no c...
EC2 instances should use Instance Metadata Service Version 2 (IMDSv2)
Verifies that EC2 instances require IMDSv2 (HttpTokens set to required). Its session tokens protect instance metadata, including the role credentials ...
EC2 instances should not have a public IPv4 address
Flags EC2 instances that have a public IPv4 address, whether auto-assigned or an Elastic IP. With a route to an internet gateway, that address makes t...
Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service
Confirms that each VPC with EC2 instances has an interface endpoint for the EC2 service, so the instances' EC2 API calls stay on the AWS network....
Unused EC2 EIPs should be removed
Flags an Elastic IP address attached neither to an EC2 instance nor to a network interface in use. AWS bills every Elastic IP address held, in use or ...
Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22
Flags security groups that allow TCP ingress from 0.0.0.0/0 or ::/0 to port 22 (SSH), letting anyone on the internet try to log in to what the group p...
Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389
Flags security groups that allow TCP ingress from 0.0.0.0/0 or ::/0 to port 3389 (RDP), letting anyone on the internet try to log in to what the group...
EC2 subnets should not automatically assign public IP addresses
Flags EC2 subnets configured to automatically assign public IPv4 addresses or IPv6 addresses to instances at launch, which gives new instances there a...
Unused Network Access Control Lists should be removed
Flags a custom network ACL that is associated with no subnet. Unassociated, its rules filter nothing, which matters most where someone wrote deny rule...
EC2 instances should not use multiple ENIs
Flags an EC2 instance with more than one network interface attached, EFAs included. A second interface usually puts the instance in two subnets, a pat...
Security groups should only allow unrestricted incoming traffic for authorized ports
Verifies that security groups allow ingress from 0.0.0.0/0 or ::/0, or from a managed prefix list holding either, only on TCP 80 and TCP 443 as single...
Security groups should not allow unrestricted access to ports with high risk
Flags security groups that allow TCP ingress from 0.0.0.0/0 or ::/0 to a high-risk port (20, 21, 22, 23, 25, 110, 135, 143, 445, 1433, 1434, 3000, 330...
Both VPN tunnels for an AWS Site-to-Site VPN connection should be up
Checks that both tunnels of the Site-to-Site VPN connection are UP; each ends in a different Availability Zone, so two keep the connection available w...
Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389
Flags network ACLs with an inbound rule allowing 0.0.0.0/0 or ::/0 to SSH (port 22) or RDP (port 3389), opening remote administration to the internet....
Unused EC2 security groups should be removed
Flags security groups attached to no network interface, counting those of EC2 instances and the ones load balancers, RDS, Lambda and VPC endpoints cre...
EC2 Transit Gateways should not automatically accept VPC attachment requests
Checks that the transit gateway does not accept shared VPC attachment requests automatically (AutoAcceptSharedAttachments set to enable). With it on, ...
EC2 paravirtual instance types should not be used
Checks that the EC2 instance does not use paravirtual (PV) virtualization, a legacy type that cannot use enhanced networking and that current generati...
EC2 launch templates should not assign public IPs to network interfaces
Checks that the launch template's default version does not assign a public IP address to any network interface, which would make the instances it...
EBS volumes should be in a backup plan
Confirms that each in-use EBS volume is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery po...
EC2 Client VPN endpoints should have client connection logging enabled
Checks that the Client VPN endpoint logs client connections to CloudWatch Logs: each connection attempt, its result and the disconnect time, so you ca...
EC2 security groups should not allow ingress from 0.0.0.0/0 to remote server administration ports
Flags security groups that allow ingress from 0.0.0.0/0 to the remote administration ports 22 (SSH) or 3389 (RDP), letting anyone on the internet try ...
EC2 security groups should not allow ingress from ::/0 to remote server administration ports
Flags security groups that allow ingress from ::/0 to the remote administration ports 22 (SSH) or 3389 (RDP), letting anyone on the internet with IPv6...
VPCs should be configured with an interface endpoint for ECR API
Checks that each VPC with EC2 instances has an interface endpoint for the Amazon ECR API (com.amazonaws.<region>.ecr.api, or its FIPS name), so ...
VPCs should be configured with an interface endpoint for Docker Registry
Checks that each VPC with EC2 instances has an interface endpoint for the Amazon ECR Docker registry (com.amazonaws.<region>.ecr.dkr, or its FIP...
VPCs should be configured with an interface endpoint for Systems Manager
Checks that each VPC with EC2 instances has an interface endpoint for AWS Systems Manager (com.amazonaws.<region>.ssm, or its FIPS name), so the...
EC2 launch templates should use Instance Metadata Service Version 2 (IMDSv2)
Checks that the launch template's default version requires IMDSv2 (HttpTokens set to required), whose session tokens keep instance metadata, incl...
EC2 VPN connections should have logging enabled
Checks that the Site-to-Site VPN connection sends tunnel activity logs to CloudWatch Logs from both tunnels; a connection logging only one fails. The ...
EC2 VPC Block Public Access settings should block internet gateway traffic
Verifies that VPC Block Public Access is on in this Region in Bidirectional or Ingress-only mode. It is one switch per account and Region that blocks ...
EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes
Checks that a Spot Fleet request whose launch parameters set EBS encryption sets it on for every volume, so the instances it launches keep their data ...
EC2 network interfaces should have source/destination checking enabled
Verifies that source/destination checking is enabled on user-managed EC2 network interfaces, so each handles only traffic it sends or receives itself....
EC2 launch templates should enable encryption for attached EBS volumes
Checks that the launch template's default version does not set encryption off for any EBS volume, so instances launched from it get encrypted vol...
Block public access settings should be enabled for Amazon EBS snapshots
Flags Regions where block public access for EBS snapshots is off. Without it, any snapshot can be shared publicly, by intent or by mistake, and its da...
EC2 VPN connections should use IKEv2 protocol
Checks that every tunnel of the Site-to-Site VPN connection permits IKEv2 only. IKEv1 has known weaknesses in its key exchange, and a tunnel that also...
ECR
ECR private repositories should have image scanning configured
Verifies that private ECR repositories are covered by a scan on push or continuous scanning rule (manual scanning does not count), so images are check...
ECR private repositories should have tag immutability configured
Checks that the private ECR repository's tags are immutable, so a tag always names the same image and a push cannot replace an image already depl...
ECR repositories should have at least one lifecycle policy configured
Checks that the ECR repository has a lifecycle policy, so unused images are expired or archived by age or count instead of accumulating, which also ma...
ECR repositories should be encrypted with customer managed AWS KMS keys
Checks that the ECR repository is encrypted at rest with a customer managed KMS key. The default, AES256, is already encrypted but uses no KMS key, an...
ECS
ECS services should not have public IP addresses assigned to them automatically
Checks that the ECS service does not assign public IP addresses to its tasks automatically (assignPublicIp ENABLED). A task with a public IP address i...
ECS task definitions should not share the host's process namespace
Checks that the task definition family's latest active revision does not set pidMode to host; older revisions a service may still run are not rea...
ECS containers should run as non-privileged
Checks that no container in the task definition family's latest active revision sets privileged to true; older revisions a service may still run ...
ECS task definitions should configure containers to be limited to read-only access to root filesystems
Checks that every container in the task definition family's latest active revision sets readonlyRootFilesystem to true; older revisions are not r...
Secrets should not be passed as container environment variables
Checks that no container in the task definition family's latest active revision has an environment variable named exactly AWS_ACCESS_KEY_ID, AWS_...
ECS task definitions should have a logging configuration
Checks that every container in the task definition family's latest active revision has a logConfiguration with a logDriver set; any driver passes...
ECS Fargate services should run on the latest Fargate platform version
Checks that each ECS service on Fargate, by launch type or a FARGATE or FARGATE_SPOT capacity provider, sets its platform version to LATEST, or to 1.4...
ECS clusters should use Container Insights
Checks that the ECS cluster's containerInsights setting is enabled or enhanced (Container Insights with enhanced observability). Container Insigh...
ECS task sets should not automatically assign public IP addresses
Checks that no task set on the ECS service assigns public IP addresses automatically (assignPublicIp ENABLED). The finding names the service and fails...
ECS task definitions should not use host network mode
Checks that the task definition family's latest active revision does not set networkMode to host; older revisions a service may still run are not...
ECS Task Definitions should use in-transit encryption for EFS volumes
Checks that every EFS volume in the task definition family's latest active revision sets transitEncryption to ENABLED; revisions with no EFS volu...
ECS capacity providers should have managed termination protection enabled
Checks that each ECS capacity provider backed by an Auto Scaling group has managed termination protection enabled; Fargate providers are skipped. With...
ECS task definitions should configure non-root users in Linux container definitions
Checks that every container in the task definition family's latest active revision sets user to a non-root user; empty, root and 0 fail, with or ...
ECS task definitions should configure non-administrator users in Windows container definitions
Checks that every container in the task definition family's latest active revision sets user to an account other than ContainerAdministrator or A...
EFS
Elastic File System should be configured to encrypt file data at-rest using AWS KMS
Checks that the EFS file system is encrypted at rest with AWS KMS, which protects the confidentiality of its stored files and reduces the risk that an...
Amazon EFS volumes should be in backup plans
Confirms that each EFS file system is in an AWS Backup plan in the same Region, protecting it from deletion and data loss: EFS automatic backups are o...
EFS access points should enforce a root directory
Checks that the EFS access point enforces a root directory other than /, the file system's own root. Clients that mount through it then reach onl...
EFS access points should enforce a user identity
Checks that the EFS access point enforces a POSIX user identity, so every file system request through it runs as that user and group instead of the ID...
EFS mount targets should not be associated with subnets that assign public IP addresses on launch
Checks that no mount target of the EFS file system is in a subnet that assigns public IPv4 addresses on launch or IPv6 addresses on creation, where in...
EFS file systems should have automatic backups enabled
Checks that automatic backups are on for the EFS file system, so AWS Backup backs it up daily under the default EFS backup plan, which keeps each back...
EFS file systems should be encrypted at rest
Checks that the EFS file system encrypts its data at rest with AWS KMS, which protects the confidentiality of stored files and reduces the risk that a...
EKS
EKS cluster endpoints should not be publicly accessible
Checks whether the EKS cluster's Kubernetes API server endpoint is reachable from the internet, where only IAM, Kubernetes RBAC and any source CI...
EKS clusters should run on a supported Kubernetes version
Checks that the EKS cluster's control plane runs a Kubernetes version still in AWS standard support; a release in extended support or past it fai...
EKS clusters should have audit logging enabled
Checks that the EKS cluster sends the audit control plane log type to CloudWatch Logs, recording which users, administrators and system components cha...
EKS node groups should run on a supported Kubernetes version
Checks that the EKS managed node group runs a Kubernetes version still in AWS standard support; a release in extended support or past it fails, and on...
ELB
Application Load Balancer should be configured to redirect all HTTP requests to HTTPS
Ensures every HTTP listener on an Application Load Balancer redirects requests to HTTPS, so no client is served over an unencrypted connection. One HT...
Classic Load Balancers with SSL/HTTPS listeners should use a certificate provided by AWS Certificate Manager
Verifies that every HTTPS or SSL listener on a Classic Load Balancer presents a certificate from AWS Certificate Manager rather than one uploaded to I...
Classic Load Balancer listeners should be configured with HTTPS or TLS termination
Verifies that every Classic Load Balancer listener uses HTTPS or SSL for front-end connections, so client traffic to the load balancer is encrypted. O...
Application load balancer should be configured to drop invalid http headers
Verifies that Application Load Balancers remove HTTP headers whose names are not valid instead of forwarding them to targets, reducing the risk of hea...
Application and Classic Load Balancers logging should be enabled
Confirms that Application and Classic Load Balancers write access logs to S3, recording each request's time, client IP address, path and response...
Application, Gateway, and Network Load Balancers should have deletion protection enabled
Confirms that deletion protection is enabled on Application, Gateway and Network Load Balancers, so the load balancer cannot be deleted, by mistake or...
Classic Load Balancers should have connection draining enabled
Verifies that connection draining is enabled on Classic Load Balancers, so requests already in flight finish when an instance is deregistered instead ...
Classic Load Balancers with SSL listeners should use a predefined security policy that has strong configuration
Confirms that every HTTPS or SSL listener on a Classic Load Balancer uses the ELBSecurityPolicy-TLS-1-2-2017-01 predefined security policy, which enab...
Classic Load Balancers should have cross-zone load balancing enabled
Confirms that cross-zone load balancing is enabled for Classic Load Balancers, distributing traffic evenly across all registered instances in all enab...
Classic Load Balancer should span multiple Availability Zones
Ensures Classic Load Balancers span multiple Availability Zones for increased fault tolerance. The threshold is two zones, the default AWS sets for th...
Application Load Balancer should be configured with defensive or strictest desync mitigation mode
Ensures Application Load Balancers use defensive or strictest desync mitigation mode to protect against HTTP desync attacks. Monitor mode fails: it fo...
Application, Network and Gateway Load Balancers should span multiple Availability Zones
Ensures Application, Network, and Gateway Load Balancers span multiple Availability Zones for fault tolerance. The threshold is two zones, the default...
Classic Load Balancer should be configured with defensive or strictest desync mitigation mode
Ensures Classic Load Balancers use defensive or strictest desync mitigation mode to protect against HTTP desync attacks. Monitor mode fails: it forwar...
Application Load Balancers should be associated with an AWS WAF web ACL
Confirms that Application Load Balancers are associated with an AWS WAF web ACL to protect against web exploits that could affect availability or cons...
Application and Network Load Balancers with listeners should use recommended security policies
Verifies that every HTTPS listener on an Application Load Balancer and every TLS listener on a Network Load Balancer uses one of the eight security po...
Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit
Confirms that each Application Load Balancer listener uses HTTPS and each Network Load Balancer listener uses an encrypted protocol, so client traffic...
Application and Network Load Balancer target groups should use encrypted health check protocols
Flags Elastic Load Balancing target groups, Gateway Load Balancer ones included, whose health check protocol is not HTTPS. Health-check traffic sent o...
ELB target groups should use encrypted transport protocols
Flags Elastic Load Balancing target groups whose protocol is not HTTPS, TLS or QUIC, which leaves traffic between the load balancer and its targets un...
EMR
Amazon EMR cluster primary nodes should not have public IP addresses
Checks that the primary node of a running or waiting EMR cluster has no public IP address, which would make it reachable from the internet. It reads t...
Amazon EMR block public access setting should be enabled
Confirms that Amazon EMR Block Public Access is enabled for the account in this Region, and that no ports other than 22 are open to the public, so a c...
Amazon EMR security configurations should have encryption at rest enabled
Checks that the EMR security configuration enables at-rest encryption, for EMRFS data in S3, local disks or both; a configuration without it fails, wh...
Amazon EMR security configurations should have encryption in transit enabled
Checks that the EMR security configuration enables in-transit encryption, which turns on TLS for the open-source applications that support it; a confi...
ElastiCache
ElastiCache (Redis OSS) clusters should have automatic backups enabled
Checks that node-based ElastiCache (Redis OSS) cache clusters, and Redis OSS or Valkey replication groups, keep automatic backups for at least 1 day, ...
ElastiCache clusters should have automatic minor version upgrades enabled
Checks that node-based ElastiCache (Redis OSS) cache clusters, including the nodes of a replication group, have automatic minor version upgrades turne...
ElastiCache replication groups should have automatic failover enabled
Checks that ElastiCache (Redis OSS or Valkey) replication groups have automatic failover enabled, so a read replica is promoted when the primary fails...
ElastiCache replication groups should be encrypted at rest
Checks that ElastiCache (Redis OSS or Valkey) replication groups are encrypted at rest, which encrypts data on disk during sync, backup and swap opera...
ElastiCache replication groups should be encrypted in transit
Checks that ElastiCache (Redis OSS or Valkey) replication groups have encryption in transit enabled, so traffic between clients and nodes, and between...
ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled
Checks that ElastiCache (Redis OSS) replication groups on engine versions below 6.0 have Redis OSS AUTH enabled, so clients must send a token before r...
ElastiCache clusters should not use the default subnet group
Flags ElastiCache clusters using the subnet group named default, which takes its subnets from the default VPC, instead of a custom one that limits whe...
ElasticBeanstalk
Elastic Beanstalk environments should have enhanced health reporting enabled
Checks that an Elastic Beanstalk environment uses enhanced health reporting, where a health agent on each instance reads its logs and operating system...
Elastic Beanstalk managed platform updates should be enabled
Ensures managed platform updates are enabled for Elastic Beanstalk environments, so AWS applies platform updates in a weekly maintenance window.
Elastic Beanstalk should stream logs to CloudWatch
Confirms that the Elastic Beanstalk environment streams its instance logs to CloudWatch Logs, so they outlive the instance that wrote them. It reads t...
Elasticsearch
Elasticsearch domains should have encryption at-rest enabled
Checks that the Elasticsearch domain has encryption at rest enabled, so its indexes, automated snapshots, swap files and the logs kept on its nodes ar...
Elasticsearch domains should not be publicly accessible
Confirms that Elasticsearch domains are deployed within a VPC rather than publicly accessible, so only clients inside your network can reach the searc...
Elasticsearch domains should encrypt data sent between nodes
Checks that the Elasticsearch domain has node-to-node encryption enabled, so traffic between its nodes is encrypted with TLS 1.2 and data stays encryp...
Elasticsearch domain error logging to CloudWatch Logs should be enabled
Checks that the Elasticsearch domain publishes its error logs to CloudWatch Logs, so warnings, errors and failures inside the cluster are kept for dia...
Elasticsearch domains should have audit logging enabled
Checks that the Elasticsearch domain publishes audit logs to CloudWatch Logs, recording authentication successes and failures, requests, index changes...
Elasticsearch domains should have at least three data nodes
Checks that the Elasticsearch domain has at least three data nodes and zone awareness turned on, so cluster operations continue when a node or an Avai...
Elasticsearch domains should be configured with at least three dedicated master nodes
Checks that the Elasticsearch domain uses at least three dedicated master nodes. They take cluster management off the data nodes, keep the quorum need...
Connections to Elasticsearch domains should be encrypted using the latest TLS security policy
Checks that the Elasticsearch domain requires HTTPS and that its endpoint uses Policy-Min-TLS-1-2-PFS-2023-10, the policy AWS's control names as ...
EventBridge
EventBridge custom event buses should have a resource-based policy attached
Checks that the custom event bus has a resource-based policy attached; any policy passes, whatever it grants. Without one, access rests on the account...
EventBridge global endpoints should have event replication enabled
Checks that event replication is enabled for the EventBridge global endpoint. Replication sends custom events to the event buses in both the primary a...
FSx
FSx for OpenZFS file systems should be configured to copy tags to backups and volumes
Checks that the FSx for OpenZFS file system copies its tags to backups and to volumes; it fails unless both are on. Copied tags let each backup and vo...
FSx for Lustre file systems should be configured to copy tags to backups
Checks that the FSx for Lustre file system copies its tags to its backups, so each backup can be identified, owned and governed like the file system i...
FSx for OpenZFS file systems should be configured for Multi-AZ deployment
Checks that the FSx for OpenZFS file system uses the Multi-AZ (HA) deployment type, whose file servers and storage span two Availability Zones and fai...
FSx for NetApp ONTAP file systems should be configured for Multi-AZ deployment
Checks that the FSx for NetApp ONTAP file system uses a Multi-AZ deployment type (Multi-AZ 1 or Multi-AZ 2), whose standby file server runs in a secon...
FSx for Windows File Server file systems should be configured for Multi-AZ deployment
Checks that the FSx for Windows File Server file system uses the Multi-AZ deployment type, a cluster of file servers in two Availability Zones that fa...
Glue
AWS Glue machine learning transforms should be encrypted at rest
Checks that the Glue machine learning transform encrypts its user data, the model and labels, with SSE-KMS; a transform with ML user data encryption d...
AWS Glue Spark jobs should run on supported versions of AWS Glue
Checks that a Glue Spark ETL job sets a Glue version at or above the minimum AWS's control accepts; a job with no Glue version set fails too. A v...
GuardDuty
GuardDuty should be enabled
Confirms that Amazon GuardDuty is enabled in each Region, so unusual or unauthorized activity is detected even in Regions you do not use. A finding on...
GuardDuty EKS Audit Log Monitoring should be enabled
Checks that GuardDuty EKS Audit Log Monitoring is enabled on this Region's detector, so GuardDuty reads the Kubernetes audit logs of every EKS cl...
GuardDuty Lambda Protection should be enabled
Checks that GuardDuty Lambda Protection is enabled on this Region's detector, so GuardDuty monitors the network activity of every Lambda function...
GuardDuty EKS Runtime Monitoring should be enabled
Checks that GuardDuty runtime monitoring covers EKS on this Region's detector, through Runtime Monitoring or the older EKS Runtime Monitoring, so...
GuardDuty Malware Protection for EC2 should be enabled
Checks that GuardDuty Malware Protection for EC2 is enabled on this Region's detector, so GuardDuty scans the EBS volumes of EC2 instances and co...
GuardDuty RDS Protection should be enabled
Checks that GuardDuty RDS Protection is enabled on this Region's detector, so GuardDuty profiles login activity on supported Aurora, RDS for Post...
GuardDuty S3 Protection should be enabled
Checks that GuardDuty S3 Protection is enabled on this Region's detector, so GuardDuty analyses object-level S3 data events on every bucket in th...
GuardDuty Runtime Monitoring should be enabled
Checks that GuardDuty Runtime Monitoring is enabled on this Region's detector, so OS-level, network and file events on EKS, ECS on Fargate and EC...
GuardDuty ECS Runtime Monitoring should be enabled
Checks that automated agent configuration for ECS on Fargate is enabled in GuardDuty Runtime Monitoring on this Region's detector, the only way t...
GuardDuty EC2 Runtime Monitoring should be enabled
Checks that automated agent configuration for EC2 is enabled in GuardDuty Runtime Monitoring on this Region's detector, so GuardDuty deploys its ...
IAM
IAM policies should not allow full "*" administrative privileges
Checks that the default version of each customer managed policy you created has no Allow statement with Action * on Resource *, which grants full admi...
IAM users should not have IAM policies attached
Checks that no IAM user has a policy attached directly, managed or inline; users should get permissions from IAM groups or by assuming a role. Grants ...
IAM users' access keys should be rotated every 90 days or less
Checks that each active IAM user access key is no more than 90 days old, counted from its creation because IAM records no rotation date. Rotation limi...
IAM root user access key should not exist
Checks that the root user has no access keys. A root key gives long-term, unrestricted API access to the whole account, so programmatic work belongs o...
MFA should be enabled for all IAM users that have a console password
Checks that every IAM user with a console password has an MFA device assigned, so a stolen or guessed password alone cannot sign in. A user without a ...
Hardware MFA should be enabled for the root user
Verifies that the root user's MFA is a hardware device (a passkey or security key, or a hardware TOTP token), since an authenticator app may not ...
Password policies for IAM users should have strong configurations
Checks that the account password policy requires long, complex IAM user passwords that expire and cannot be reused, at the strictest value IAM.7 and I...
Unused IAM user credentials should be removed
Flags IAM users with a console password or active access key unused for 90 days or more; removing them narrows what an abandoned or compromised accoun...
MFA should be enabled for the root user
Checks that the root user has an MFA device, so a stolen root password alone cannot sign in to an account with complete access to everything in it. An...
Ensure IAM password policy expires passwords within 90 days or less
Verifies that the IAM account password policy expires passwords within 90 days or fewer, so a leaked password stops working on its own. Expiry switche...
Ensure a support role has been created to manage incidents with AWS Support
Checks that the AWSSupportAccess managed policy is attached to at least one IAM role, user or group, so authorized people can manage incidents with AW...
MFA should be enabled for all IAM users
Checks that every IAM user has an MFA device assigned, so a stolen password alone cannot sign in. Users with only access keys are in scope too: for th...
IAM customer managed policies that you create should not allow wildcard actions for services
Checks that the default version of each customer managed policy you created has no Allow statement whose Action or NotAction is a whole service (servi...
IAM user credentials unused for 45 days should be removed
Flags IAM users with a console password or active access key unused for 45 days or more; removing them narrows what an abandoned or compromised accoun...
Expired SSL/TLS certificates managed in IAM should be removed
Checks that no SSL/TLS server certificate stored in IAM has expired. An expired certificate left in IAM can still be deployed to a resource by mistake...
IAM identities should not have the AWSCloudShellFullAccess policy attached
Checks that no IAM user, role or group has the AWS managed policy AWSCloudShellFullAccess attached directly. It allows file transfer between a local m...
IAM Access Analyzer external access analyzer should be enabled
Confirms that each Region has an active IAM Access Analyzer external access analyzer, which flags resources such as S3 buckets and IAM roles shared ou...
Inspector
Amazon Inspector EC2 scanning should be enabled
Confirms that Amazon Inspector EC2 scanning is enabled in each Region where the account has EC2 instances, so Inspector checks their installed package...
Amazon Inspector ECR scanning should be enabled
Checks that Amazon Inspector ECR scanning is enabled in each Region where the account has ECR repositories, so container images are scanned for operat...
Amazon Inspector Lambda code scanning should be enabled
Ensures Amazon Inspector Lambda code scanning is enabled in each Region where the account has Lambda functions, so function code is checked for flaws ...
Amazon Inspector Lambda standard scanning should be enabled
Confirms that Amazon Inspector Lambda standard scanning is enabled in each Region where the account has Lambda functions, so the packages in each func...
KMS
IAM customer managed policies should not allow decryption actions on all KMS keys
Checks that the default version of each customer managed policy, attached or not, allows neither kms:Decrypt nor kms:ReEncryptFrom, by name or by wild...
IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys
Checks that no inline policy embedded in an IAM user, group or role allows kms:Decrypt or kms:ReEncryptFrom, by name or by wildcard, on every KMS key....
AWS KMS keys should not be deleted unintentionally
Checks whether a customer managed KMS key is scheduled for deletion. When the waiting period ends the key is deleted and data encrypted under it can n...
AWS KMS key rotation should be enabled
Checks that automatic key rotation is enabled on each customer managed symmetric encryption KMS key. Rotation gives the key new key material, yearly b...
KMS keys should not be publicly accessible
Checks whether a customer managed KMS key's policy lets everyone ("*") use the key with no condition that pins the caller and no Deny t...
Kinesis
Firehose delivery streams should be encrypted at rest
Checks that a Firehose stream's records are encrypted at rest with an AWS KMS key. A Direct PUT stream needs Firehose server-side encryption; a s...
Kinesis streams should be encrypted at rest
Checks that Kinesis data streams use server-side encryption with an AWS KMS key, so records are encrypted before they are written to the stream's...
Kinesis streams should have an adequate data retention period
Checks that Kinesis data streams keep records for at least 168 hours (7 days), the default of AWS's control, so consumers that fall behind or fai...
Lambda
Lambda function policies should prohibit public access
Verifies that Lambda function resource-based policies do not grant public access from outside the account, which would let anyone use the function. Th...
Lambda functions should use supported runtimes
Checks that the Lambda function uses a supported runtime. When a runtime's components stop receiving security updates, Lambda deprecates it: a fu...
Lambda functions should be in a VPC
Checks that the Lambda function is connected to a VPC; subnet routing and public reachability are not evaluated. A function in a VPC reaches your priv...
VPC Lambda functions should operate in multiple Availability Zones
Checks that a Lambda function connected to a VPC uses subnets in at least two Availability Zones, so that the failure of a single zone does not stop t...
Lambda functions should have AWS X-Ray active tracing enabled
Checks that active tracing with AWS X-Ray is enabled for the Lambda function. X-Ray breaks down each traced invocation's latency, which helps dia...
MQ
ActiveMQ brokers should stream audit logs to CloudWatch
Checks that an Amazon MQ for ActiveMQ broker streams its audit log to CloudWatch Logs. The audit log records management actions taken through JMX or t...
ActiveMQ brokers should use active/standby deployment mode
Checks that an Amazon MQ for ActiveMQ broker uses active/standby deployment mode: two broker instances in two Availability Zones sharing Amazon EFS st...
RabbitMQ brokers should use cluster deployment mode
Checks that an Amazon MQ for RabbitMQ broker uses cluster deployment: three broker nodes across Availability Zones with data replicated to every node....
MSK
MSK clusters should be encrypted in transit among broker nodes
Flags MSK clusters whose brokers send data to each other in plaintext rather than over TLS, so replication traffic inside the cluster can be read or a...
MSK clusters should have enhanced monitoring configured
Flags MSK clusters that send CloudWatch metrics at the DEFAULT or PER_BROKER level rather than PER_TOPIC_PER_BROKER or finer. Topic-level metrics show...
MSK Connect connectors should be encrypted in transit
Flags MSK Connect connectors that exchange data with their Apache Kafka cluster in plaintext rather than over TLS, so the records they copy between th...
Amazon MSK clusters should have public access disabled
Flags Amazon MSK clusters whose public access is not turned off, so their brokers can be reached from the internet rather than only from inside the VP...
MSK connectors should have logging enabled
Flags MSK Connect connectors that deliver no worker logs to CloudWatch Logs, Amazon S3 or Amazon Data Firehose, which leaves no record for debugging a...
MSK clusters should disable unauthenticated access
Flags MSK clusters that allow unauthenticated access, which lets any client that can reach the brokers publish to, read from or delete data in Kafka t...
Macie
Macie should be enabled
Checks that Amazon Macie is enabled in the Region, so it keeps an inventory of the S3 buckets there, monitors them for security and access control, an...
Macie automated sensitive data discovery should be enabled
Checks that Amazon Macie automated sensitive data discovery is enabled in the Region, so Macie samples the S3 buckets there each day and reports where...
Neptune
Neptune DB clusters should be encrypted at rest
Checks that a Neptune DB cluster is encrypted at rest with an AWS KMS key, which also covers its logs, automated backups and snapshots, so the graph&#...
Neptune DB clusters should publish audit logs to CloudWatch Logs
Checks that a Neptune DB cluster publishes audit logs to CloudWatch Logs, so a record of each query and the client that sent it is kept outside the cl...
Neptune DB cluster snapshots should not be public
Checks whether a Neptune manual DB cluster snapshot is public, which lets any AWS account copy or restore its data. A copy made while it was public is...
Neptune DB clusters should have deletion protection enabled
Checks that a Neptune DB cluster has deletion protection enabled, so a request to delete the cluster, accidental or unauthorized, fails until the prot...
Neptune DB clusters should have automated backups enabled
Checks that a Neptune DB cluster keeps automated backups for at least 7 days. Retention sets how far back a point-in-time restore can reach, so a shor...
Neptune DB cluster snapshots should be encrypted at rest
Checks that a Neptune DB cluster snapshot is encrypted at rest, so its data stays protected wherever it is copied, shared or restored. Neptune, Docume...
Neptune DB clusters should have IAM database authentication enabled
Checks that a Neptune DB cluster has IAM database authentication enabled, so every request is authenticated with IAM credentials and signed with AWS S...
Neptune DB clusters should be configured to copy tags to snapshots
Checks that a Neptune DB cluster copies its tags to snapshots when they are created, so each snapshot carries the tags that drive cost allocation, own...
Neptune DB clusters should be deployed across multiple Availability Zones
Checks that a Neptune DB cluster has instances in more than one Availability Zone, so if the primary or its zone fails, Neptune can promote a reader i...
NetworkFirewall
Network Firewall firewalls should be deployed across multiple Availability Zones
Checks that the Network Firewall firewall has endpoints in at least two Availability Zones. With an endpoint in each zone, traffic can be balanced and...
Network Firewall logging should be enabled
Checks that the Network Firewall firewall sends at least one log type (Alert, Flow or TLS) to a destination, recording the traffic its stateful engine...
Network Firewall policies should have at least one rule group associated
Checks that the Network Firewall policy has at least one stateful or stateless rule group. The rule groups are what filter packets and traffic flows, ...
The default stateless action for Network Firewall policies should be drop or forward for full packets
Checks that the Network Firewall policy's default stateless action for full packets is Drop or Forward to stateful rule groups, not Pass, so a pa...
The default stateless action for Network Firewall policies should be drop or forward for fragmented packets
Checks that the Network Firewall policy's default stateless action for fragmented packets is Drop or Forward to stateful rule groups, not Pass, s...
Stateless network firewall rule group should not be empty
Checks that the stateless Network Firewall rule group contains at least one rule. An empty stateless rule group in a firewall policy can look as if it...
Network Firewall firewalls should have deletion protection enabled
Checks that deletion protection is on for the Network Firewall firewall, so a firewall that is inspecting traffic to, from or between VPCs cannot be d...
Network Firewall firewalls should have subnet change protection enabled
Checks that subnet change protection is on for the Network Firewall firewall, protecting its subnet associations, and so the endpoints traffic is rout...
Opensearch
OpenSearch domains should have encryption at rest enabled
Checks that the OpenSearch domain encrypts its data at rest with an AWS KMS key. That covers its indexes, logs, swap files and automated snapshots, so...
OpenSearch domains should not be publicly accessible
Confirms that OpenSearch domains are deployed within a VPC rather than exposed to the public internet, so only clients inside your network can reach t...
OpenSearch domains should encrypt data sent between nodes
Checks that the OpenSearch domain has node-to-node encryption on, so traffic between its nodes is TLS 1.2 encrypted and data stays encrypted as OpenSe...
OpenSearch domain error logging to CloudWatch Logs should be enabled
Checks that the OpenSearch domain publishes its error logs to CloudWatch Logs. They carry the warnings and errors OpenSearch raises, such as invalid q...
OpenSearch domains should have audit logging enabled
Checks that the OpenSearch domain publishes audit logs to CloudWatch Logs, recording user activity such as authentication failures, requests refused f...
OpenSearch domains should have at least three data nodes
Checks that the OpenSearch domain has at least three data nodes and zone awareness turned on, so the cluster keeps serving if a node or an Availabilit...
OpenSearch domains should have fine-grained access control enabled
Checks that the OpenSearch domain has fine-grained access control enabled, so each request is authorized by role at the index, document and field leve...
Connections to OpenSearch domains should be encrypted using the latest TLS security policy
Checks that the OpenSearch domain requires HTTPS and that its endpoint uses Policy-Min-TLS-1-2-PFS-2023-10, so clients connect only over TLS 1.2 or la...
OpenSearch domains should have the latest software update installed
Checks that the OpenSearch domain, on either engine, has no service software update waiting, so it runs the latest platform fixes, including security ...
OpenSearch domains should have at least three dedicated primary nodes
Checks that the OpenSearch domain has at least three dedicated master (primary) nodes. They manage the cluster without holding data, and three keep th...
PrivateCA
AWS Private CA root certificate authority should be disabled
Checks that an AWS Private CA root certificate authority is disabled; a root in any other state fails, and only an active one can be disabled. The roo...
RDS
RDS snapshot should be private
Confirms that RDS DB snapshots and DB cluster snapshots are not public. Any AWS account can copy or restore a public snapshot, and making it private d...
RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration
Flags RDS DB instances with PubliclyAccessible set, which gives the instance a public IP address and an endpoint that resolves to it from outside the ...
RDS DB instances should have encryption at-rest enabled
Verifies that RDS DB instances have storage encryption enabled, which also covers their logs, automated backups, read replicas and snapshots. For an i...
RDS cluster snapshots and database snapshots should be encrypted at rest
Verifies that RDS DB snapshots and DB cluster snapshots are encrypted at rest, so the data in them stays protected wherever they are copied or restore...
RDS DB instances should be configured with multiple Availability Zones
Confirms that RDS DB instances use a Multi-AZ deployment, which keeps a synchronous standby in a second Availability Zone and fails over to it automat...
Enhanced monitoring should be configured for RDS DB instances
Confirms that RDS DB instances have Enhanced Monitoring turned on, which reads per-process CPU, memory and I/O from the operating system the database ...
RDS clusters should have deletion protection enabled
Confirms that RDS DB clusters have deletion protection enabled, so a stray delete of the cluster fails; it does not stop the data inside it being drop...
RDS DB instances should have deletion protection enabled
Confirms that RDS DB instances have deletion protection enabled, so a stray delete of the instance fails; it does not stop the data inside it being dr...
RDS DB instances should publish logs to CloudWatch Logs
Verifies that RDS DB instances publish database logs to CloudWatch Logs, where they are kept for security audits and for diagnosing availability issue...
IAM authentication should be configured for RDS instances
Checks that RDS for MySQL, MariaDB and PostgreSQL DB instances, and Aurora DB instances, have IAM database authentication enabled, so clients can sign...
RDS instances should have automatic backups enabled
Ensures RDS DB instances keep automated backups for at least 7 days, so a point-in-time restore can reach back that far; a retention period of 0 turns...
IAM authentication should be configured for RDS clusters
Checks that RDS DB clusters have IAM database authentication enabled, so clients can sign in with short-lived IAM tokens instead of stored passwords. ...
RDS automatic minor version upgrades should be enabled
Confirms that RDS DB instances have automatic minor version upgrades enabled, so engine patches and security fixes are applied in the maintenance wind...
Amazon Aurora clusters should have backtracking enabled
Confirms that Aurora MySQL clusters have backtracking enabled, so the cluster can be rewound to an earlier point in minutes to undo a destructive chan...
RDS DB clusters should be configured for multiple Availability Zones
Confirms that RDS DB clusters have instances in more than one Availability Zone, so a failover has a running instance elsewhere to move to. The cluste...
Aurora DB clusters should be configured to copy tags to DB snapshots
Checks that Aurora DB clusters copy their tags to DB snapshots when the snapshots are created, so each snapshot inherits the tags that drive cost allo...
RDS DB instances should be configured to copy tags to snapshots
Checks that RDS DB instances copy their tags to snapshots when the snapshots are created, so each snapshot inherits the tags that drive cost allocatio...
Existing RDS event notification subscriptions should be configured for critical cluster events
Checks that each RDS event subscription for DB clusters covers the maintenance and failure event categories, so a pending cluster maintenance action o...
Existing RDS event notification subscriptions should be configured for critical database instance events
Checks that each RDS event subscription for DB instances covers the maintenance, configuration change and failure event categories, so a pending maint...
An RDS event notifications subscription should be configured for critical database parameter group events
Checks that a Region with RDS event subscriptions has an active one for DB parameter groups covering configuration change, so an edit that can change ...
An RDS event notifications subscription should be configured for critical database security group events
Checks that a Region with RDS event subscriptions has an active one for DB security groups covering configuration change and failure. A Region with no...
RDS instances should not use a database engine default port
Flags RDS DB instances listening on their engine's default port, the one untargeted scans try first. This is one thin layer, never a substitute f...
RDS Database Clusters should use a custom administrator username
Flags RDS database clusters whose master username is admin, root, sa, oracle or postgres, in any letter case. These are the names tried first, so a cl...
RDS database instances should use a custom administrator username
Flags RDS database instances whose master username is admin, root, sa, oracle or postgres, in any letter case. These are the names tried first, so an ...
RDS DB instances should be protected by a backup plan
Confirms that each RDS DB instance is selected by an AWS Backup plan in the same Region (no backup has to have run yet) or already has a recovery poin...
RDS DB clusters should be encrypted at rest
Verifies that RDS DB clusters are encrypted at rest, which also covers the cluster's automated backups, logs and snapshots. DocumentDB and Neptun...
Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs
Verifies that Aurora MySQL DB clusters publish audit logs to CloudWatch Logs, so the record of logins, data changes and schema changes is kept outside...
RDS DB clusters should have automatic minor version upgrade enabled
Ensures automatic minor version upgrade is enabled on RDS DB clusters, including Aurora, so the cluster and its instances receive minor version patche...
RDS for PostgreSQL DB instances should publish logs to CloudWatch Logs
Verifies that RDS for PostgreSQL DB instances publish the postgresql log to CloudWatch Logs, where it is kept durably and can be searched and alarmed ...
Aurora PostgreSQL DB clusters should publish logs to CloudWatch Logs
Verifies that Aurora PostgreSQL DB clusters publish the postgresql log to CloudWatch Logs, where it is kept durably and can be searched and alarmed on...
RDS for PostgreSQL DB instances should be encrypted in transit
Checks that RDS for PostgreSQL DB instances set rds.force_ssl to 1 in their DB parameter group. With it on, the database rejects any connection that d...
RDS for MySQL DB instances should be encrypted in transit
Checks that RDS for MySQL DB instances set require_secure_transport to 1 in their DB parameter group. With it on, the database refuses any connection ...
RDS for SQL Server DB instances should publish logs to CloudWatch Logs
Verifies that RDS for SQL Server DB instances publish the error log to CloudWatch Logs. RDS keeps at most 30 error logs on the instance and may delete...
RDS for SQL Server DB instances should be encrypted in transit
Checks that RDS for SQL Server DB instances set rds.force_ssl to 1 in their DB parameter group, which makes SQL Server encrypt every connection. Witho...
RDS for MariaDB DB instances should publish logs to CloudWatch Logs
Verifies that RDS for MariaDB DB instances publish the error log to CloudWatch Logs, where it is kept durably for audits and for diagnosing availabili...
RDS DB proxies should require TLS encryption for connections
Flags RDS DB proxies that do not require TLS, so a client can connect to the proxy unencrypted. The setting covers only the client-to-proxy leg: wheth...
RDS for MariaDB DB instances should be encrypted in transit
Checks that RDS for MariaDB DB instances set require_secure_transport to 1 in their DB parameter group, so the database refuses any connection that do...
Aurora MySQL DB clusters should have audit logging enabled
Confirms that Aurora MySQL DB clusters have audit logging enabled through the server_audit_logging cluster parameter, so the engine can record logins,...
RDS DB instances should not be deployed in public subnets with routes to internet gateways
Flags RDS DB instances whose DB subnet group includes any subnet with an active route to an internet gateway, whatever its destination; a subnet with ...
RDS for PostgreSQL DB clusters should be configured to copy tags to DB snapshots
Checks that RDS for PostgreSQL DB clusters copy their tags to DB snapshots when the snapshots are created, so each snapshot inherits the tags that dri...
RDS for MySQL DB clusters should be configured to copy tags to DB snapshots
Checks that RDS for MySQL DB clusters copy their tags to DB snapshots when the snapshots are created, so each snapshot inherits the tags that drive co...
RDS DB clusters should have enough backup retention period set
Flags Amazon RDS DB clusters whose backup retention period is shorter than 7 days, which limits how far back a point-in-time restore can reach and so ...
RDS global clusters should run on a supported Aurora MySQL version
Flags Aurora MySQL global clusters on an engine version below the minimum AWS publishes for this control, unless it is a long-term support release; su...
Redshift
Amazon Redshift clusters should prohibit public access
Flags Redshift clusters that are publicly accessible. A public cluster has an elastic IP address that clients outside the VPC can connect to, leaving ...
Connections to Amazon Redshift clusters should be encrypted in transit
Checks that Redshift clusters require encrypted connections, which means require_ssl is true in the cluster's parameter group. Without it, client...
Amazon Redshift clusters should have automatic snapshots enabled
Confirms that Redshift clusters have automated snapshots enabled and retained for at least seven days, the control's default, so a bad load or an...
Amazon Redshift clusters should have audit logging enabled
Checks that Redshift clusters have audit logging turned on, to CloudWatch Logs or Amazon S3, so connection attempts and changes to database users are ...
Amazon Redshift should have automatic upgrades to major versions enabled
Checks that Redshift clusters allow automatic major version upgrades. With them on, Redshift installs new releases, which can carry security patches a...
Redshift clusters should use enhanced VPC routing
Confirms that Redshift clusters have Enhanced VPC Routing enabled to route COPY and UNLOAD traffic through the VPC, where security groups, network ACL...
Amazon Redshift clusters should not use the default Admin username
Flags Redshift clusters whose admin username is a default or easily guessed name: awsuser, admin, root, sa, oracle or postgres. Default names are publ...
Redshift clusters should be encrypted at rest
Checks that Redshift clusters are encrypted at rest. Encryption covers the data blocks and system metadata of the cluster and its snapshots, reducing ...
Redshift security groups should allow ingress on the cluster port only from restricted origins
Flags Redshift clusters whose attached security groups allow ingress from 0.0.0.0/0 or ::/0 to the cluster port over any protocol, which invites unaut...
Redshift cluster subnet groups should have subnets from multiple Availability Zones
Verifies that Redshift cluster subnet groups contain subnets from at least two Availability Zones, so a cluster using the group can keep operating whe...
Redshift clusters should have Multi-AZ deployments enabled
Confirms that Multi-AZ deployment is enabled for Redshift clusters. A Multi-AZ cluster runs its compute in two Availability Zones behind one endpoint,...
RedshiftServerless
Amazon Redshift Serverless workgroups should use enhanced VPC routing
Flags Amazon Redshift Serverless workgroups that do not have enhanced VPC routing enabled. Without it, COPY/UNLOAD traffic between the workgroup and o...
Connections to Redshift Serverless workgroups should be required to use SSL
Verifies that Redshift Serverless workgroups require SSL for all connections, so the database refuses clients that do not negotiate TLS. A workgroup a...
Redshift Serverless workgroups should prohibit public access
Flags Amazon Redshift Serverless workgroups whose publiclyAccessible setting is true. A public workgroup has an elastic IP address that clients outsid...
Redshift Serverless namespaces should be encrypted with customer managed AWS KMS keys
Checks that the Amazon Redshift Serverless namespace is encrypted at rest with a customer managed AWS KMS key. With your own key you control its key p...
Redshift Serverless namespaces should not use the default admin username
Flags Amazon Redshift Serverless namespaces whose admin username is a default or easily guessed name: admin, awsuser, root, sa, oracle or postgres. Th...
Redshift Serverless namespaces should export logs to CloudWatch Logs
Flags Amazon Redshift Serverless namespaces that do not export connection and user logs to CloudWatch Logs. Without these exports, failed sign-ins and...
Route53
Route 53 public hosted zones should log DNS queries
Checks that DNS query logging is enabled for the Route 53 public hosted zone, so the queries Route 53 answers for it (the name queried, record type, r...
S3
S3 general purpose buckets should have block public access settings enabled
Checks that all four S3 Block Public Access settings are on for the account. Account-level settings apply to every bucket and a bucket cannot loosen t...
S3 general purpose buckets should block public read access
Checks whether an S3 general purpose bucket's policy or ACL grants public read access that Block Public Access, on the bucket or the account, doe...
S3 general purpose buckets should block public write access
Checks whether an S3 general purpose bucket's policy or ACL grants public write access that Block Public Access, on the bucket or the account, do...
S3 general purpose buckets should require requests to use TLS
Checks that the S3 general purpose bucket's policy denies every request made without TLS, so data sent to or from the bucket cannot be read or al...
S3 general purpose bucket policies should restrict access to other AWS accounts
Checks that the S3 general purpose bucket's policy does not allow another AWS account, or everyone, s3:DeleteBucketPolicy, s3:PutBucketAcl, s3:Pu...
S3 general purpose buckets should use cross-Region replication
Checks that the S3 general purpose bucket has an enabled replication rule to a bucket in another Region, so a copy of its data survives a Regional out...
S3 general purpose buckets should block public access
Checks that all four Block Public Access settings are on for the S3 general purpose bucket itself; the account-level settings do not count here. With ...
S3 general purpose buckets should have server access logging enabled
Checks that server access logging is on for the S3 general purpose bucket, recording each request for security and access audits. The bucket that rece...
S3 general purpose buckets with versioning enabled should have Lifecycle configurations
Checks that a versioned S3 general purpose bucket has at least one enabled lifecycle rule. With versioning on, every overwrite and delete keeps the pr...
S3 general purpose buckets should have event notifications enabled
Checks that the S3 general purpose bucket sends event notifications to Amazon EventBridge, an SNS topic, an SQS queue or a Lambda function, so changes...
ACLs should not be used to manage user access to S3 general purpose buckets
Checks that the S3 general purpose bucket has ACLs disabled, with Object Ownership set to Bucket owner enforced. An ACL grants access outside the buck...
S3 general purpose buckets should have Lifecycle configurations
Checks that the S3 general purpose bucket has at least one enabled lifecycle rule, so S3 expires or transitions its objects on a schedule rather than ...
S3 general purpose buckets should have versioning enabled
Checks that versioning is enabled on the S3 general purpose bucket; a bucket where it is suspended or was never set fails. With versioning, an overwri...
S3 general purpose buckets should have Object Lock enabled
Checks that the S3 general purpose bucket has Object Lock enabled. Object Lock stores objects write-once-read-many, so a locked object version cannot ...
S3 general purpose buckets should be encrypted at rest with AWS KMS keys
Checks that the S3 general purpose bucket's default encryption uses an AWS KMS key (SSE-KMS or DSSE-KMS) rather than SSE-S3, so reading an object...
S3 access points should have block public access settings enabled
Checks that an S3 access point has all four Block Public Access settings on. S3 combines them with the bucket's and the account's settings a...
S3 general purpose buckets should have MFA delete enabled
Checks that MFA delete is enabled on the S3 general purpose bucket, so permanently deleting an object version or changing versioning needs a code from...
S3 general purpose buckets should log object-level write events
Checks that at least one CloudTrail multi-Region trail logs S3 object-level write events for every bucket, recording who wrote or deleted each object....
S3 general purpose buckets should log object-level read events
Checks that at least one CloudTrail multi-Region trail logs S3 object-level read events for every bucket, recording who read each object. One trail co...
S3 Multi-Region Access Points should have block public access settings enabled
Checks that an S3 Multi-Region Access Point has all four Block Public Access settings on. S3 combines them with the account's and each bucket...
S3 directory buckets should have lifecycle configurations
Checks that the S3 directory bucket has at least one enabled lifecycle rule, so S3 deletes objects nobody needs on a schedule instead of keeping them ...
SES
SES configuration sets should have TLS enabled for sending emails
Checks that an Amazon SES configuration set requires TLS for delivery. By default SES sends a message in plain text when the receiving mail server can...
SNS
SNS topics should be encrypted at-rest using AWS KMS
Checks that the SNS topic is encrypted at rest with an AWS KMS key; SNS's default disk encryption does not count. With a KMS key, reading a store...
SNS topic access policies should not allow public access
Checks whether an SNS topic's access policy lets everyone ("*") use the topic with no condition that pins the caller and no Deny that c...
SQS
Amazon SQS queues should be encrypted at rest
Checks that the SQS queue is encrypted at rest with SQS-managed keys (SSE-SQS) or an AWS KMS key (SSE-KMS), which protects message bodies stored on di...
SQS queue access policies should not allow public access
Checks whether an SQS queue's access policy lets everyone ("*") use the queue with no condition that pins the caller and no Deny that c...
SSM
EC2 instances should be managed by AWS Systems Manager
Checks that each running or stopped EC2 instance in the Region is a Systems Manager managed node, so it can be inventoried, patched and configured thr...
EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation
Checks that Systems Manager Patch Manager reports no missing patches for the EC2 instance and none that failed to install in its last patching operati...
EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT
Checks that the node managed by Systems Manager has an association compliance status of COMPLIANT after its State Manager associations run; one failin...
SSM documents should not be public
Checks whether an SSM document this account owns is shared with All, which makes it readable by every AWS account and can expose information about you...
SSM Automation should have CloudWatch logging enabled
Checks that Systems Manager Automation in this Region sends the output of aws:executeScript actions to CloudWatch Logs, so there is a record of the sc...
SSM documents should have the block public sharing setting enabled
Ensures the block public sharing setting for SSM documents, which is set per Region, is on in this Region. A public document can expose information ab...
SageMaker
Amazon SageMaker notebook instances should not have direct internet access
Checks that direct internet access is disabled on the SageMaker notebook instance. With it enabled, SageMaker routes the instance's traffic to th...
SageMaker notebook instances should be launched in a custom VPC
Checks that the SageMaker notebook instance is attached to a subnet. Without one it runs in the SageMaker service VPC, where your security groups and ...
Users should not have root access to SageMaker notebook instances
Checks that root access is disabled for users of the SageMaker notebook instance. With root, every user is an administrator who can read and change an...
SageMaker endpoint production variants should have an initial instance count greater than 1
Checks that every instance-based production variant in the endpoint configuration has an initial instance count above 1, so SageMaker can spread its i...
SageMaker models should have network isolation enabled
Checks that the SageMaker model has network isolation enabled. Inference containers have network access by default; with isolation on, the container c...
SageMaker notebook instances should run on supported platforms
Checks that the notebook instance runs on notebook-al2023-v1, the only platform AWS supports. Amazon Linux 2 reached end of support for notebook insta...
SageMaker data quality job definitions should have inter-container traffic encryption enabled
Flags Amazon SageMaker data quality monitoring job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled. Without it, traf...
SageMaker model explainability job definitions should have inter-container traffic encryption enabled
Flags Amazon SageMaker model explainability monitoring job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled, leaving ...
SageMaker data quality job definitions should have network isolation enabled
Flags Amazon SageMaker data quality monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the container...
SageMaker model bias job definitions should have network isolation enabled
Flags Amazon SageMaker model bias monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containers ...
SageMaker model quality job definitions should have inter-container traffic encryption enabled
Flags Amazon SageMaker model quality monitoring job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled, leaving traffic...
SageMaker monitoring schedules should have network isolation enabled
Flags Amazon SageMaker monitoring schedules whose job definition, inline or named, has NetworkConfig.EnableNetworkIsolation disabled; without isolatio...
SageMaker model bias job definitions should have inter-container traffic encryption enabled
Flags SageMaker model bias job definitions whose NetworkConfig.EnableInterContainerTrafficEncryption is disabled, leaving traffic between the job'...
SageMaker models should use private registry in VPC for primary containers
Checks that the model's primary container has repository access mode Vpc, pulling its image from a private Docker registry in your VPC; Platform ...
SageMaker feature group offline stores should be encrypted with AWS KMS keys
Checks that the feature group's offline store names a KMS key of yours for the Amazon S3 data it writes. Without one the data is still encrypted,...
SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys
Checks that the feature group's online store, on standard storage, names a KMS key of yours. Without one the records are still encrypted, under a...
SageMaker models should use private registry in VPC for multi-container inference pipelines
Checks that every container in the model's container list has repository access mode Vpc, pulling its image from a private Docker registry in you...
SageMaker model explainability job definitions should have network isolation enabled
Flags Amazon SageMaker model explainability monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the c...
SageMaker notebook instances should be encrypted with customer managed AWS KMS keys
Checks that a SageMaker notebook instance names a customer managed KMS key for its ML storage volume, which holds the notebooks and data under /home/e...
SageMaker monitoring schedules should have inter-container traffic encryption enabled
Flags Amazon SageMaker monitoring schedules whose job definition, inline or named, has NetworkConfig.EnableInterContainerTrafficEncryption disabled, l...
SageMaker inference experiments should have instance storage volume encrypted with customer managed AWS KMS keys
Checks that a SageMaker inference experiment names a customer managed KMS key (its top-level KmsKey) for the storage volume on the ML instances hostin...
SageMaker inference experiments should have data storage encrypted with customer managed AWS KMS keys
Checks that a SageMaker inference experiment with data capture names a customer managed KMS key for the requests and responses it captures to Amazon S...
SageMaker model quality job definitions should have network isolation enabled
Flags Amazon SageMaker model quality monitoring job definitions whose NetworkConfig.EnableNetworkIsolation is disabled. Without isolation the containe...
SecretsManager
Secrets Manager secrets should have automatic rotation enabled
Checks that a Secrets Manager secret has automatic rotation turned on. Rotation replaces long-term credentials with short-term ones, which limits how ...
Secrets Manager secrets configured with automatic rotation should rotate successfully
Checks that a Secrets Manager secret with automatic rotation turned on rotated as scheduled; it fails once a scheduled rotation is more than a day ove...
Remove unused Secrets Manager secrets
Checks that a Secrets Manager secret has been retrieved in this Region within 90 days, AWS's default period. An unused secret can still be used b...
Secrets Manager secrets should be rotated within a specified number of days
Checks that a Secrets Manager secret has rotated within 90 days, AWS's default period; one never rotated is judged by the time since it was creat...
ServiceCatalog
Service Catalog portfolios should be shared within an AWS organization only
Checks that a Service Catalog portfolio is shared only through AWS Organizations: any account-to-account share (type ACCOUNT) fails it, even one to an...
StepFunctions
Step Functions state machines should have logging turned on
Checks that the Step Functions state machine logs to CloudWatch Logs at any level other than OFF. The logs record execution history and results, which...
Transfer
Transfer Family servers should not use FTP protocol for endpoint connection
Checks that the Transfer Family server does not offer FTP; a server with FTP among its protocols fails. FTP sends files and sign-in credentials unencr...
Transfer Family connectors should have logging enabled
Checks that the Transfer Family connector has a logging role, which lets it write its events to CloudWatch Logs; a connector without one fails. The lo...
WAF
AWS WAF Classic Global Web ACL logging should be enabled
Checks that logging is enabled for the AWS WAF Classic global web ACL, which protects CloudFront distributions. Logs record each request the web ACL i...
AWS WAF Classic Regional rules should have at least one condition
Checks that the AWS WAF Classic Regional rule has at least one condition. A rule with no conditions inspects nothing, so traffic passes untouched whil...
AWS WAF Classic Regional rule groups should have at least one rule
Checks that the AWS WAF Classic Regional rule group has at least one rule. An empty rule group inspects nothing, so traffic passes untouched while a n...
AWS WAF Classic Regional web ACLs should have at least one rule or rule group
Checks that the AWS WAF Classic Regional web ACL has at least one rule or rule group. Without one, every request to its load balancers and API Gateway...
AWS WAF Classic global rules should have at least one condition
Checks that the AWS WAF Classic global rule has at least one condition. A rule with no conditions inspects nothing, so traffic passes untouched while ...
AWS WAF Classic global rule groups should have at least one rule
Checks that the AWS WAF Classic global rule group has at least one rule. An empty rule group inspects nothing, so traffic passes untouched while a nam...
AWS WAF Classic global web ACLs should have at least one rule or rule group
Checks that the AWS WAF Classic global web ACL has at least one rule or rule group. Without one, every request to its CloudFront distributions gets th...
AWS WAF web ACLs should have at least one rule or rule group
Checks that the AWS WAF web ACL (regional or CloudFront scope) has at least one rule or rule group. An empty web ACL sends every request to its defaul...
AWS WAF web ACL logging should be enabled
Checks that logging is enabled for the AWS WAF web ACL (WAFv2, regional or CloudFront scope). Logs record each request the web ACL inspects and the ru...
AWS WAF rules should have CloudWatch metrics enabled
Checks that CloudWatch metrics are enabled on the AWS WAF rule group and on every rule in it; it passes only when all of them are on. Without metrics ...
WorkSpaces
WorkSpaces user volumes should be encrypted at rest
Checks that a WorkSpace's user volume (D: on Windows, /home on Linux) is encrypted at rest with an AWS KMS key, which also encrypts disk I/O and ...
WorkSpaces root volumes should be encrypted at rest
Checks that a WorkSpace's root volume (C: on Windows, / on Linux) is encrypted at rest with an AWS KMS key, which also encrypts disk I/O and the ...
No check matches that. Try a service name, or clear the filter.