AWS Checks
178 articles
- Ensure IAM Access Analyzer has no active findings
- Ensure ACM certificates do not expire within 7 days
- Ensure ACM certificates have Certificate Transparency logging enabled
- Ensure API Gateway REST APIs require authorization
- Ensure API Gateway has client certificate enabled to access your backend endpoint
- Ensure API Gateway REST APIs use a private endpoint
- Ensure API Gateway has a WAF ACL attached
- Ensure each Lambda function is covered by a CloudTrail data event selector
- Ensure there are no secrets in Lambda function code
- Ensure there are no secrets in Lambda function environment variables
- Ensure Lambda function resource-based policy does not allow public access
- Ensure Lambda functions do not use obsolete runtimes
- Ensure no secrets are found in CloudFormation outputs
- Ensure CloudFront distributions have Field Level Encryption enabled
- Ensure Geo restrictions are enabled in CloudFront distributions
- Ensure CloudFront distributions require HTTPS
- Ensure CloudFront distributions have logging enabled
- Ensure CloudTrail delivered logs to CloudWatch in the last 24 hours
- Ensure CloudTrail logs are encrypted at rest using KMS CMKs
- Ensure CloudTrail log file validation is enabled
- Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
- Ensure the CloudTrail S3 bucket ACL does not grant access to everyone
- Ensure CloudTrail is enabled in all regions
- Ensure CloudTrail logs S3 object-level read events
- Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
- Ensure a log metric filter and alarm exist for changes to network gateways
- Ensure a log metric filter and alarm exist for route table changes
- Ensure a log metric filter and alarm exist for VPC changes
- Ensure a log metric filter and alarm exist for AWS Config configuration changes
- Ensure a log metric filter and alarm exist for CloudTrail configuration changes
- Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
- Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
- Ensure a log metric filter and alarm exist for S3 bucket configuration changes
- Ensure a log metric filter and alarm exist for IAM policy changes
- Ensure a log metric filter and alarm exist for usage of root account
- Ensure a log metric filter and alarm exist for security group changes
- Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
- Ensure a log metric filter and alarm exist for unauthorized API calls
- Ensure AWS Config is enabled in all regions
- Ensure there are no public EC2 AMIs
- Ensure EBS default encryption is enabled
- Ensure there are no public EBS snapshots
- Ensure EBS snapshots are encrypted
- Ensure EBS volumes are encrypted
- Ensure internet facing EC2 instances do not have an instance profile attached
- Ensure running EC2 instances are not older than 180 days
- Ensure EC2 instances have an IAM instance profile attached
- Ensure no secrets are found in EC2 User Data
- Ensure no Network ACLs allow SSH port 22 from the internet
- Ensure no Network ACLs allow RDP port 3389 from the internet
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to all ports
- Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to SSH port 22
- Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to RDP port 3389
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to Cassandra TCP ports 7199, 9160 or 8888
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to Memcached TCP port 11211
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to MongoDB TCP ports 27017 and 27018
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to MySQL TCP port 3306
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to Oracle TCP ports 1521 or 2483
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to Postgres TCP port 5432
- Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to Redis TCP port 6379
- Ensure the default security group of every VPC restricts all traffic
- Ensure non-default security groups are in use
- Ensure the ECR registry has a scanning rule that covers all repositories
- Ensure ECR repository policies do not allow public access
- Ensure there are no secrets in ECS task definition environment variables
- Ensure Classic Load Balancer HTTPS listeners use the TLS 1.2 2017-01 policy
- Ensure there are no internet-facing Classic Load Balancers
- Ensure Classic Load Balancers have access logging enabled
- Ensure members of groups with the AdministratorAccess policy have MFA enabled
- Ensure the root account has not been used in the last day
- Ensure attached AWS managed IAM policies do not allow full *:* administrative privileges
- Ensure a SAML provider is configured for federated access to AWS
- Ensure custom IAM policies do not allow role assumption on wildcard resources
- Ensure the root account has no active access keys
- Ensure IAM password policy expires passwords within 90 days or less
- Ensure IAM password policy requires at least one lowercase letter
- Ensure IAM password policy requires minimum length of 14 or greater
- Ensure IAM password policy requires at least one number
- Ensure IAM password policy prevents reuse of the last 24 passwords
- Ensure IAM password policy requires at least one symbol
- Ensure IAM password policy requires at least one uppercase letter
- Ensure IAM policies are attached only to groups or roles
- Ensure hardware MFA is enabled for the root account
- Ensure MFA is enabled for the root account
- Ensure access keys are rotated every 90 days or less
- Ensure a support role has been created to manage incidents with AWS Support
- Ensure console access is disabled for IAM users inactive for more than 45 days
- Ensure MFA is enabled for all IAM users with console access
- Ensure rotation for customer created CMKs is enabled
- Ensure Amazon OpenSearch Service domains have audit logging enabled
- Ensure there are no Amazon OpenSearch Service domains that allow open access
- Ensure RDS instances have backup enabled
- Ensure RDS instances are integrated with CloudWatch Logs
- Ensure RDS instances are not publicly exposed to the internet
- Ensure RDS instances are protected by an AWS Backup plan
- Ensure RDS instance storage is encrypted
- Ensure RDS snapshots and cluster snapshots are not public
- Ensure Redshift cluster has audit logging enabled
- Ensure Route 53 public hosted zones log queries to CloudWatch Logs
- Ensure S3 buckets have object versioning enabled
- Ensure S3 bucket policies do not allow public object writes
- Ensure there are no S3 buckets open to the Everyone or Any AWS user
- Ensure S3 bucket policies deny insecure (HTTP) uploads
- Ensure S3 buckets have server access logging enabled
- Ensure Amazon SageMaker models have VPC settings configured
- Ensure Amazon SageMaker notebook instances are encrypted with a customer-specified KMS key
- Ensure Amazon SageMaker notebook instances have VPC settings configured
- Ensure Amazon SageMaker training jobs have intercontainer encryption enabled
- Ensure Amazon SageMaker training jobs have volume KMS encryption enabled
- Ensure Amazon SageMaker training jobs have VPC settings configured
- Ensure SNS topic policies do not allow public access
- Ensure SQS queue policies do not allow public access
- Ensure SQS queues have Server Side Encryption enabled
- Ensure there are no Trusted Advisor checks in error or warning state
- Ensure VPC flow logging is enabled in all VPCs
- Ensure VPC peering route tables do not route 0.0.0.0/0 or the entire requester VPC CIDR
- Ensure EBS volumes are in an AWS Backup selection
- Ensure VPC security groups do not allow wide-open public IPv4 CIDR ranges (/1 to /23)
- Ensure RDS snapshots are encrypted
- Ensure Redshift clusters are not publicly accessible
- Ensure ACM certificates use a secure key algorithm
- Ensure API Gateway stage cache encryption is enabled
- Ensure API Gateway stages have CloudWatch execution logging
- Ensure API Gateway REST API stage variables do not contain secrets
- Ensure API Gateway REST API stage has X-Ray tracing enabled
- Ensure API Gateway V2 API stage has access logging enabled
- Ensure API Gateway V2 API has an authorizer configured
- Ensure EC2 Auto Scaling groups have Capacity Rebalancing enabled
- Ensure Auto Scaling group associated with a load balancer has ELB health checks enabled
- Ensure Auto Scaling group launch configuration does not assign a public IP address
- Ensure Auto Scaling group uses multiple Availability Zones
- Ensure Lambda function environment variables are encrypted with a customer-managed KMS key
- Ensure Lambda function has a Dead Letter Queue configured
- Ensure Lambda function URL CORS does not allow wildcard origins (*)
- Ensure Lambda function URLs use AWS IAM authentication
- Ensure at least one AWS Backup plan exists
- Ensure AWS Backup recovery point is encrypted at rest
- Ensure AWS Backup vault is encrypted at rest
- Ensure CloudFormation stack has termination protection enabled
- Ensure CloudFront distribution uses a custom SSL/TLS certificate
- Ensure CloudFront distribution uses an AWS WAF web ACL
- Ensure CloudTrail trails have Insights enabled
- Ensure CloudWatch log group is encrypted with an AWS KMS key
- Ensure CloudWatch log groups are not in a public resource policy
- Ensure DynamoDB DAX cluster has encryption at rest enabled
- Ensure DynamoDB Accelerator (DAX) cluster has encryption in transit enabled
- Ensure DynamoDB table has deletion protection enabled
- Ensure DynamoDB table is protected by a backup plan
- Ensure DynamoDB table is encrypted at rest with AWS KMS
- Ensure DynamoDB table has point-in-time recovery (PITR) enabled
- Ensure all EBS snapshots have public access blocked
- Ensure ECR repositories are not set to fully mutable image tags
- Ensure ECR repository images contain no hardcoded secrets
- Ensure ECS service does not have automatic public IP assignment
- Ensure EFS file system has encryption at rest enabled
- Ensure EFS file system has backup enabled
- Ensure EFS file systems have no mount targets in public subnets
- Ensure EKS cluster has deletion protection enabled
- Ensure EKS cluster has private endpoint access enabled
- Ensure ElastiCache cluster is not using public subnets
- Ensure ElastiCache Redis replication groups use in-transit encryption
- Ensure ElastiCache Redis replication groups use at-rest encryption
- Ensure Classic Load Balancers have only HTTPS or SSL listeners
- Ensure Application Load Balancer HTTP listeners have a rule that redirects to HTTPS
- Ensure unattached custom IAM policies do not allow full admin access
- Ensure IAM group does not have AdministratorAccess policy attached
- Ensure VPC has Network Firewall enabled
- Ensure RDS cluster has deletion protection enabled
- Ensure RDS cluster storage is encrypted
- Ensure Redshift cluster is encrypted at rest
- Ensure Redshift cluster is encrypted in transit
- Ensure S3 bucket has bucket ACLs disabled
- Ensure S3 bucket has server-side encryption with AWS KMS
- Ensure S3 bucket has Object Lock enabled
- Ensure Secrets Manager secret has rotation enabled
- Ensure Secrets Manager secret resource policy does not allow public access
- Ensure Secrets Manager secret has been accessed within the last 90 days
- Ensure SNS topic is encrypted at rest with KMS