checks
51 articles
- Ensure Two-Factor Authentication Is Enabled on the OVHcloud Account
- Ensure 2FA Backup Codes Are Generated
- Ensure API Credentials Have an Expiration Date
- Ensure Unused API Credentials Are Revoked
- Ensure API Credentials Are Not Granted Wildcard Access
- Ensure IAM Local Users Exist Instead of Sharing the Owner Login
- Ensure IAM Local Users Follow Least Privilege
- Ensure IAM Local User Passwords Are Rotated
- Ensure IAM Policies Do Not Grant Wildcard Actions
- Ensure Identity Federation (SSO) Is Configured
- Ensure Administrative Contacts Are Current
- Ensure Instances Do Not Run End-of-Life Operating Systems
- Ensure Account Audit Logs Are Forwarded to Logs Data Platform
- Ensure Account Activity Logs Are Forwarded to Logs Data Platform
- Ensure Managed Service Logs Are Forwarded
- Ensure Production Projects Are Attached to a vRack
- Ensure Private Subnet Ranges Do Not Overlap
- Ensure Private Instances Use a Managed Gateway for Outbound Access
- Ensure Unassociated Floating IPs Are Released
- Ensure Block Storage Volumes Have Recent Snapshots or Backups
- Ensure Old Snapshots Are Removed According to Retention Policy
- Ensure Object Storage Bucket Encryption (SSE-OMK) Is Enabled
- Ensure Versioning Is Enabled on Critical Buckets
- Ensure Object Storage Users Have Least-Privilege Access
- Ensure Kubernetes API Server Access Is IP-Restricted
- Ensure Kubernetes Cluster Is Attached to a Private Network
- Ensure Kubernetes Cluster Version Is Supported
- Ensure Kubernetes Security Patch Policy Is Not Disabled
- Ensure OIDC Authentication Is Configured for the Cluster
- Ensure Node Pool Autoscaling Has Sensible Limits
- Ensure Kubernetes Audit Logs Are Forwarded
- Ensure Database Authorized IPs Are Restricted
- Ensure Production Databases Are on a Private Network
- Ensure Database Backup Retention Meets Policy
- Ensure Production Databases Run With Multiple Nodes
- Ensure Database Engine Version Is Supported
- Ensure Database Admin Users Are Minimized
- Ensure Database Logs Are Forwarded to Logs Data Platform
- Ensure Managed Private Registry Access Is IP-Restricted
- Ensure KMS Access Is Restricted Through Scoped IAM Policies
- Ensure Project Quotas Are Near Expected Usage
- Ensure Secret Manager Access Is Restricted Through Scoped IAM Policies
- Ensure Resources Carry Required Tags
- Ensure Public Cloud Users Do Not Hold the Administrator Role Unnecessarily
- Ensure Production Instances Have an Automated Backup Workflow
- Ensure File Storage Shares Are Restricted to Specific Networks
- Ensure Object Lock Is Enabled on Backup Buckets
- Ensure Public Cloud Load Balancer Listeners Use HTTPS
- Ensure Load Balancer TLS Certificates Are Not Expired or Expiring
- Ensure AI Notebooks, Training Jobs and Deploy Apps Are Not Publicly Accessible
- Ensure a Consumption Alert Is Set on Public Cloud Projects