AWS Services
130 articles
- Ensure there are no ECR repositories set as Public
- Ensure there are no Public Accessible RDS instances
- Ensure there are no internet facing Elastic Load Balancers
- Ensure there are no internet facing EC2 Instances
- Ensure Redshift Cluster is not publicly accessible
- Ensure GuardDuty is enabled
- Ensure there are no Elasticsearch Service domains that allow open access
- Ensure Lambda functions invoke API operations are being recorded by CloudTrail
- Ensure RDS Snapshots and Cluster Snapshots are not public
- Ensure S3 buckets have Object-level logging enabled in CloudTrail
- Ensure SQS queues have policy set are not Public
- Ensure to report ACM Certificates are about to expire in 7 days or less
- Ensure SNS topics have policy set are not Public
- Ensure there are no KMS keys exposed
- Ensure KMS keys with key rotation is not disabled
- Ensure CloudFront distributions are set to HTTPS
- Ensure no secrets are found in EC2 User Data
- Ensure no secrets are found in CloudFormation outputs
- Ensure API Gateway has client certificate enabled to access your backend endpoint
- Ensure API Gateway has a WAF ACL attached
- Ensure API Gateway has configured authorizers
- Ensure S3 buckets have secure transport policy
- Ensure ECR image scanning on push is enabled
- Ensure CloudFront distributions have Field Level Encryption enabled
- Ensure no secrets are found in ECS task definitions variables
- Ensure Instance Profile is attached for internet facing EC2 instances
- Ensure S3 buckets have policies which do not allow WRITE access
- Ensure SNS Encryption with KMS Enabled
- Ensure Elastic Beanstalk Managed Updates are Enabled
- Ensure Lambda Inside a VPC Check
- Ensure Elastic Beanstalk Enhanced Health Reporting Enabled
- Ensure Lambda Concurrency Limit is Configured
- Ensure Lambda Dead Letter Queue (DLQ) is enabled
- Ensure DynamoDB Auto Scaling Enabled
- Ensure ec2 instance detailed monitoring enabled
- Ensure DynamoDB Accelerator (DAX) Encryption Enabled
- Ensure DynamoDB Point In Time Recovery (PITR) Enabled
- Ensure RDS Instance Deletion Protection Enabled
- Ensure RDS Enhanced Monitoring Enabled
- Ensure DynamoDB Table Encrypted with KMS
- Ensure Enterprise Support Plan is Enabled
- Ensure Amazon EFS Encrypted
- Ensure ElastiCache Redis Cluster Automatic Backup Enabled
- Ensure RDS Cluster Deletion Protection Enabled
- Ensure EBS Volume in AWS Backup Plan
- Ensure No Public IP associated with EC2 Instances
- Ensure there are no Outdated AMI
- Ensure S3 Bucket Default Encryption with KMS Enabled
- Ensure WAF Classic Logging Enabled
- Ensure WAF Logging Enabled
- Ensure EKS Secrets Encrypted
- Ensure WAF Enabled on ALB
- Ensure EKS has No Public Endpoint Access
- Ensure VPC Endpoints Enabled
- Ensure Subnet Auto-assign Public IP Disabled
- Ensure ELB has only HTTPS Listeners
- Ensure Internet Gateways Attached to Authorized VPCs Only
- Ensure All IAM Users Belong to IAM Groups
- Ensure Business Support or Above is Enabled
- Ensure ELB Deletion Protection Enabled
- Ensure Security Hub is Enabled
- Ensure CloudWatch Log Group Retention Configured
- Ensure Account is Part of AWS Organizations
- Ensure S3 Bucket Public Read Disabled
- Ensure ELB uses predefined security policy (ssl)
- Ensure EMR Master blocks public access
- Ensure API Gateway X-Ray Tracing Enabled
- Ensure there are no Unattached Elastic IPs
- Ensure Lambda Public Access Prohibited
- Ensure RDS Multi-AZ HA Enabled
- Ensure CloudFront Origin Access Identity Enabled
- Ensure Amazon Elasticsearch Encrypted at Rest
- Ensure Cloud Watch Log Groups Encryption Enabled
- Ensure Secrets Manager Rotation Enabled
- Ensure Secrets Manager Scheduled Rotation was Enabled
- Ensure Secrets Manager Secrets are Encrypted with KMS
- Ensure Amazon Elasticsearch In VPC (Not Public) Check
- Ensure ELB Cross AZ Load Balancing Enabled
- Ensure SageMaker Endpoint KMS Encryption Enabled
- Ensure API Gateway has logging enabled
- Ensure AWS Shield Protection Enabled
- Ensure CloudFront distributions are not using deprecated SSL protocols
- Ensure RDS instances have minor version upgrade enabled
- Ensure no EC2 Stopped Instances
- Ensure there are no SSM Documents set as public
- Ensure Application Load Balancer has a WAF ACL attached
- Ensure S3 Bucket Default Lock Enabled
- Ensure Cloud Front Default Root Object is Configured
- Ensure Amazon Elasticsearch Node-to-Node Encryption Enabled
- Ensure CloudFront SNI Enabled
- Ensure ElastiCache Redis Cluster Automatic Backup Enabled
- Ensure AWS Shield is Advanced Enabled with Auto-Renew Check
- Ensure API Gateway SSL Enabled
- Ensure Shield DRT Access Enabled
- Ensure API Gateway Restricted to Source IPs
- Ensure Lambda Code is Versioned Check
- Ensure Application Load Balancer is dropping invalid packets to prevent header based http request smuggling
- Ensure CloudWatch Alarm Action Check
- Ensure Cloudfront distributions are using WAF
- Ensure Redshift Cluster Maintenance Settings Check
- Ensure CloudWatch has allowed cross-account sharing
- Ensure to have backup protection - encryption of backup for S3
- Ensure CloudFront Origin Failover Enabled
- Ensure if there are CMK KMS keys not used
- Ensure ELB ACM certificate required
- Ensure ELB Health Checks are Configured for Auto Scaling Groups
- Check if ECR image scan found vulnerabilities in the newest image version
- Ensure GuardDuty Untreated Findings Check
- Ensure EC2 Instance Metadata Service v2 (IMDSv2) Configured
- Ensure Security Groups are Attached to ENIs
- Cost Optimization Knowledge Base Update - Replication Rules
- Ensure S3 Block Public Access Enabled (Account-Level)
- Ensure EC2 Desired Instance Tenancy Setting Check
- Ensure API Gateway Not Edge Optimized
- Eliminate use of the 'root' user for administrative and daily
- Do not setup access keys during initial user setup for all IAM users that have a console password
- Ensure there is only one active access key available for any single IAM user
- Ensure IAM Users Receive Permissions Only Through Groups
- Ensure that all the expired SSL/TLS certificates stored in AWS IAM are removed
- Ensure that IAM Access analyzer is enabled for all regions
- Ensure IAM users are managed centrally via identity federation or AWS Organizations for multi-account environments
- Ensure all S3 buckets employ encryption-at-rest
- Ensure S3 Bucket Policy is set to deny HTTP requests
- Ensure Redshift Cluster Configuration Check
- Ensure MFA Delete is enabled on S3 buckets
- Ensure all data in Amazon S3 has been discovered, classified and secured when required
- Ensure Code Pipeline Deployment Count Check
- Ensure that Object-level logging for write events is enabled for S3 bucket
- Ensure that Object-level logging for read events is enabled for S3 bucket
- Ensure a log metric filter and alarm exist for AWS Organizations changes