AWS Checks
59 articles
- Ensure Security Alternate Contact is Registered
- Ensure ACM Certificates Use a Secure Key Algorithm
- Ensure API Gateway REST API Stage Cache Data is Encrypted at Rest
- Ensure API Gateway REST API Stage Has Logging Enabled
- Ensure API Gateway REST API Stage Variables Do Not Contain Secrets
- Ensure API Gateway REST API Stage Has X-Ray Tracing Enabled
- Ensure API Gateway V2 API Stage Has Access Logging Enabled
- Ensure API Gateway V2 API Has an Authorizer Configured
- Ensure EC2 Auto Scaling Group Has Capacity Rebalancing Enabled
- Ensure Auto Scaling Group Associated with a Load Balancer Has ELB Health Checks Enabled
- Ensure Auto Scaling Group Launch Configuration Does Not Assign a Public IP Address
- Ensure Auto Scaling Group Uses Multiple Availability Zones
- Ensure Lambda Function Environment Variables are Encrypted with a Customer-Managed KMS Key
- Ensure Lambda Function Has a Dead Letter Queue Configured
- Ensure Lambda Function URL CORS Does Not Allow Wildcard Origins (*)
- Ensure Lambda Function URL is Not Publicly Accessible
- Ensure at Least One AWS Backup Plan Exists
- Ensure AWS Backup Recovery Point is Encrypted at Rest
- Ensure AWS Backup Vault is Encrypted at Rest
- Ensure CloudFormation Stack Has Termination Protection Enabled
- Ensure CloudFront Distribution Uses a Custom SSL/TLS Certificate
- Ensure CloudFront Distribution Uses an AWS WAF Web ACL
- Ensure CloudTrail Trail Has Insights Enabled
- Ensure CloudWatch Log Group is Encrypted with an AWS KMS Key
- Ensure CloudWatch Log Group is Not Publicly Accessible
- Ensure DynamoDB DAX Cluster Has Encryption at Rest Enabled
- Ensure DynamoDB Accelerator (DAX) Cluster Has Encryption in Transit Enabled
- Ensure DynamoDB Table Has Deletion Protection Enabled
- Ensure DynamoDB Table is Protected by a Backup Plan
- Ensure DynamoDB Table is Encrypted at Rest with AWS KMS
- Ensure DynamoDB Table Has Point-in-Time Recovery (PITR) Enabled
- Ensure All EBS Snapshots Have Public Access Blocked
- Ensure ECR Repository Has Image Tag Immutability Enabled
- Ensure ECR Repository Image Contains No Hardcoded Secrets
- Ensure ECS Service Does Not Have Automatic Public IP Assignment
- Ensure EFS File System Has Encryption at Rest Enabled
- Ensure EFS File System Has Backup Enabled
- Ensure EFS File System Has No Publicly Accessible Mount Targets
- Ensure EKS Cluster Has Deletion Protection Enabled
- Ensure EKS Cluster Has Private Endpoint Access Enabled
- Ensure ElastiCache Cluster is Not Using Public Subnets
- Ensure ElastiCache Redis Cache Cluster Has In-Transit Encryption Enabled
- Ensure ElastiCache Redis Cache Cluster Has at Rest Encryption Enabled
- Ensure Elastic Load Balancer Has Only HTTPS or SSL Listeners
- Ensure ELBv2 Application Load Balancer Listeners Use HTTPS or Redirect HTTP to HTTPS
- Ensure Unattached Customer Managed IAM Policy Does Not Allow ':*' Administrative Privileges
- Ensure IAM Group Does Not Have AdministratorAccess Policy Attached
- Ensure VPC Has Network Firewall Enabled
- Ensure RDS Cluster Has Deletion Protection Enabled
- Ensure RDS Cluster Storage is Encrypted
- Ensure Redshift Cluster is Encrypted at Rest
- Ensure Redshift Cluster is Encrypted in Transit
- Ensure S3 Bucket Has Bucket ACLs Disabled
- Ensure S3 Bucket Has Server-Side Encryption with AWS KMS
- Ensure S3 Bucket Has Object Lock Enabled
- Ensure Secrets Manager Secret Has Rotation Enabled
- Ensure Secrets Manager Secret Resource Policy Does Not Allow Public Access
- Ensure Secrets Manager Secret Has Been Accessed Within the Last 90 Days
- Ensure SNS Topic is Encrypted at Rest with KMS