Home
Pricing
Github
Slack Channel
Home
Quick Start
Development
Operations
User Guide
Destinations
Analysis
Tutorials
Help
Log Analysis
Overview
Setup
Rules
Supported Logs
Standard Fields
Cloud Security
Overview
Setup
Policies
Built-in Policy Runbooks
AWS CloudTrail Is Enabled In All Regions
AWS CloudTrail Sending To CloudWatch Logs
AWS KMS CMK Key Rotation Is Enabled
AWS Application Load Balancer Has Web ACL
AWS Access Keys Are Used Every 90 Days
AWS Access Keys are Rotated Every 90 Days
AWS ACM Certificate Is Not Expired
AWS Access Keys not Created During Account Creation
AWS CloudTrail Has Log Validation Enabled
AWS CloudTrail S3 Bucket Has Access Logging Enabled
AWS CloudTrail Logs S3 Bucket Not Publicly Accessible
AWS Config Is Enabled for Global Resources
AWS DynamoDB Table Has Autoscaling Targets Configured
AWS DynamoDB Table Has Autoscaling Enabled
AWS DynamoDB Table Has Encryption Enabled
AWS EC2 AMI Launched on Approved Host
AWS EC2 AMI Launched on Approved Instance Type
AWS EC2 AMI Launched With Approved Tenancy
AWS EC2 Instance Has Detailed Monitoring Enabled
AWS EC2 Instance Is EBS Optimized
AWS EC2 Instance Running on Approved AMI
AWS EC2 Instance Running on Approved Instance Type
AWS EC2 Instance Running in Approved VPC
AWS EC2 Instance Running On Approved Host
AWS EC2 Instance Running With Approved Tenancy
AWS EC2 Instance Volumes Are Encrypted
AWS EC2 Volume Is Encrypted
AWS GuardDuty is Logging to a Master Account
AWS GuardDuty Is Enabled
AWS IAM Group Has Users
AWS IAM Policy Blacklist Is Respected
AWS IAM Policy Does Not Grant Full Administrative Privileges
AWS IAM Policy Is Not Assigned Directly To User
AWS IAM Policy Role Mapping Is Respected
AWS IAM User Has MFA Enabled
AWS IAM Password Used Every 90 Days
AWS Password Policy Enforces Complexity Guidelines
AWS Password Policy Enforces Password Age Limit Of 90 Days Or Less
AWS Password Policy Prevents Password Reuse
AWS RDS Instance Is Not Publicly Accessible
AWS RDS Instance Snapshots Are Not Publicly Accessible
AWS RDS Instance Has Storage Encrypted
AWS RDS Instance Has Backups Enabled
AWS RDS Instance Has High Availability Configured
AWS Redshift Cluster Allows Version Upgrades
AWS Redshift Cluster Has Encryption Enabled
AWS Redshift Cluster Has Logging Enabled
AWS Redshift Cluster Has Correct Preferred Maintenance Window
AWS Redshift Cluster Has Sufficient Snapshot Retention Period
AWS Resource Has Minimum Number of Tags
AWS Resource Has Required Tags
AWS Root Account Has MFA Enabled
AWS Root Account Does Not Have Access Keys
AWS S3 Bucket Name Has No Periods
AWS S3 Bucket Not Publicly Readable
AWS S3 Bucket Not Publicly Writeable
AWS S3 Bucket Policy Does Not Use Allow With Not Principal
AWS S3 Bucket Policy Enforces Secure Access
AWS S3 Bucket Policy Restricts Allowed Actions
AWS S3 Bucket Policy Restricts Principal
AWS S3 Bucket Has Versioning Enabled
AWS S3 Bucket Has Encryption Enabled
AWS S3 Bucket Lifecycle Configuration Expires Data
AWS S3 Bucket Has Logging Enabled
AWS S3 Bucket Has MFA Delete Enabled
AWS S3 Bucket Has Public Access Block Enabled
AWS Security Group Restricts Ingress On Administrative Ports
AWS VPC Default Security Group Restricts All Traffic
AWS VPC Flow Logging Enabled
AWS WAF Has Correct Rule Ordering
AWS CloudTrail Logs Encrypted Using KMS CMK
Automatic Remediation
Supported Resources
Enterprise
Overview
Data Analytics
SaaS Logs
Snowflake Integration
SAML/SSO Integration
Role-Based Access Control
Powered by GitBook

AWS Config Is Enabled for Global Resources

Risk

Remediation Effort

Low

Low

This policy validates that at least one AWS Config recorder is configured to record changes to global resources, such as IAM entities.

Remediation

To remediate this, enable global resources for at least one active AWS Config recorder in the account.

Reference

Previous
AWS CloudTrail Logs S3 Bucket Not Publicly Accessible
Next
AWS DynamoDB Table Has Autoscaling Targets Configured
Last updated 6 months ago