Utho Checks
33 articles
- Ensure Utho API Tokens are rotated periodically (e.g., every 90 days)
- Ensure Multi-Factor Authentication (2FA) is enabled on the Utho account
- Ensure there are no unused EBS volumes in Utho
- Ensure there are no internet facing Cloud Instances in Utho
- Ensure no security groups allow ingress from all IPs to SSH Port in Utho
- Ensure no security groups allow ingress from all IPs to RDP Port in Utho
- Ensure there are no Security Groups not being used in Utho
- Ensure there are no Security Groups without ingress filtering being used
- Ensure Security Groups do not allow unrestricted ingress access to Redis port 6379
- Ensure Security Groups do not allow unrestricted ingress access to MySQL port 3306
- Ensure Security Groups do not allow unrestricted ingress access to Postgres port 5432
- Ensure Security Groups do not allow unrestricted ingress access to MongoDB ports 27017 and 27018
- Ensure Security Groups do not allow unrestricted ingress access to Memcached port 11211
- Ensure Security Groups do not allow unrestricted ingress access to Cassandra ports 7199 or 9160 or 8888
- Ensure Security Groups do not allow unrestricted ingress access to Oracle ports 1521 or 2483
- Ensure access keys are rotated every 90 days or less (Storage access keys)
- Ensure object storage buckets are not publicly accessible
- Ensure buckets have object versioning enabled
- Ensure there are no internet facing Elastic Load Balancers
- Ensure a WAF is attached to every public-facing Load Balancer
- Ensure Auto-Scaling is Enabled on Kubernetes Node Pools to Handle Compute Capacity Demand
- Ensure Kubernetes Node Pools Maintain a Minimum Scale Limit Greater Than One Worker Node
- Ensure automatic Kubernetes version upgrades are enabled.
- Ensure surge upgrades are enabled for zero-downtime node replacements.
- Ensure cluster network type is configured as private to prevent public exposure.
- Ensure there are no unused Elastic IP
- Ensure Transport layer encryption must be enabled for all database connections.
- Ensure Database must enforce IP restriction rules (trusted_hosts) to prevent unrestricted access.
- Ensure databases must deploy at least one read replica node across failure domains
- Ensure databases must deploy at least one standby replica node across failure domains
- Ensure there are no registry set as Public
- Ensure WAF Default managed rule group and rules are enabled.
- Ensure pitr(Point in Time Recovery) is enabled for databases