AWS Bedrock

Access allowed from VPN

AMI (Amazon Machine Images) not in use

AMI (Amazon Machine Images) not in use (12 months)

Auto Scaling Group not in use

AWS Config configuration changes alarm

AWS DynamoDB Table Export

AWS EC2 VM Export Failure

AWS IAM Activity Using S3 Browser Utility

AWS IAM User Created Access Keys

AWS RDS Snapshot Export to S3

Azure AD Privileged Role Changes

Azure/EntraID: Reset password for Global Admin user

CloudTrail changes alarm

Connections towards DynamoDB should be via VPC endpoints

Connections towards S3 should be via VPC endpoint

Container Escape Detection

Container in CrashLoopBackOff state

Cross peering connectivity is allowed by EC2

Cross peering connectivity is allowed by ECS Task

Cross peering connectivity is allowed by Lambda

Cross peering connectivity is allowed by Pod

Cross transit connectivity is allowed by EC2

Cross transit connectivity is allowed by ECS

Cross transit connectivity is allowed by Lambda

Cross transit connectivity is allowed by Pod

DynamoDB tables not in use

EBS snapshots not in use

EBS volume not in use

EC2 large instance create alarm

EC2 should have a name set

EC2 with Admin access (*:*)

EC2 with GPU capabilities

EC2 with high privileged policies

ECS cluster delete alarm

ECS task with Admin access (*:*)

ECS task with high privileged policies

EKS cluster delete alarm

ElastiCache cluster delete alarm

Elastic IP not in use

ELB not in use

Ensure access keys are rotated every 90 days or less

Ensure all hosts in the target group are in healthy state

Ensure all hosts in the target group are in use

Ensure all IAM users with console access have MFA enabled

Ensure Amazon MQ broker instances are using desired instance types

Ensure Amazon MQ brokers are not publicly accessible

Ensure Amazon MQ brokers are not publicly accessible

Ensure Amazon MQ brokers are using the active/standby deployment mode

Ensure Amazon MQ brokers are using the latest engine version

Ensure Amazon MQ brokers Auto Minor Version Upgrade feature is enabled

Ensure Amazon MQ brokers Log Exports feature is enabled

Ensure Amazon SageMaker Notebook Instance is in VPC

Ensure API Gateway has Content Encoding feature enabled

Ensure Application Load Balancer (ALB) has access logging enabled

Ensure Application Load Balancers (ALB) are configured to drop HTTP headers

Ensure Auto-Tune feature is enabled in OpenSearch clusters

Ensure AWS Config is configured to include global resources

Ensure AWS EKS cluster has secrets encryption enabled

Ensure both VPN tunnels are up

Ensure CloudFormation stacks are sending event notifications to an SNS topic

Ensure CloudFormation stacks Termination Protection feature is enabled

Ensure CloudFront distribution enforce HTTPS protocol for data in-transit

Ensure CloudFront distributions use a security policy with minimum TLSv1.1 or TLSv1.2

Ensure CloudFront has WAF attached

Ensure CloudFront web distributions are configured to compress objects (files) automatically

Ensure CloudFront web distributions enforce field-level encryption

Ensure CloudTrail buckets are configured to use MFA

Ensure CloudTrail Log File Integrity Validation is enabled

Ensure CloudTrail logs are encrypted at rest

Ensure CloudTrail trails have multi-region enabled

Ensure CloudTrail trails record global service events

Ensure CloudWatch Logs service is configured to monitor CloudTrail trail logs

Ensure communication between CloudFront distributions and their origins is encrypted using HTTPS

Ensure container is not privileged

Ensure Container liveness probe is configured

Ensure Container readiness probe is configured

Ensure containers do not run with AllowPrivilegeEscalation

Ensure containers run with a high GID to avoid host conflict

Ensure containers run with a high UID to avoid host conflict

Ensure Database Migration Service (DMS) are not publicly accessible

Ensure Database Migration Service (DMS) replication instances are using Multi-AZ deployment configurations

Ensure Database Migration Service (DMS) replication instances have Auto Minor Version Upgrade feature enabled

Ensure data stored in the S3 bucket is securely encrypted at rest

Ensure default security groups are not in use by ALB

Ensure default security groups are not in use by EC2

Ensure default security groups are not in use by ECS

Ensure default security groups are not in use by ElastiCache

Ensure default security groups are not in use by ELB

Ensure default security groups are not in use by Lambda

Ensure default security groups are not in use by MSK

Ensure default security groups are not in use by OpenSearch

Ensure default security groups are not in use by RDS

Ensure default security groups are not in use by VPC Endpoints

Ensure default security groups do not allow unrestricted traffic

Ensure default service accounts are not actively used

Ensure DMS instances are not accessible via Internet (Network and API)

Ensure DocumentDB clusters have Log Exports feature enabled

Ensure DocumentDB database clusters have a minimum backup retention period

Ensure DocumentDB database instances are not accessible via Internet (Network and API)

Ensure DocumentDB database instances have storage encryption enabled