Cloud Security

AWS Policies

Here are the articles in this section:
AWS CloudTrail Least Privilege Access Configured
AWS CloudTrail Is Enabled In All Regions
AWS CloudTrail Sending To CloudWatch Logs
AWS CloudFormation Stack Uses IAM Service Role
AWS CloudFormation Stack Has Termination Protection
AWS CloudFormation Stack Has Not Drifted
AWS KMS CMK Key Rotation Is Enabled
AWS Application Load Balancer Has Web ACL
AWS Access Keys Are Used Every 90 Days
AWS Access Keys are Rotated Every 90 Days
AWS ACM Certificate Is Not Expired
AWS ACM Certificates are Valid
AWS Customer Owned AMI Is Private
AWS Access Keys not Created During Account Creation
AWS CloudTrail Has Log Validation Enabled
AWS CloudTrail S3 Bucket Has Access Logging Enabled
AWS CloudTrail Logs S3 Bucket Not Publicly Accessible
AWS CloudWatch Logs Has Data Retention of One Year
AWS CloudWatch Logs Are Encrypted
AWS Config Is Enabled for Global Resources
AWS Config Records All Resource Types
AWS Config Is Recording
AWS Config Recording With No Errors
AWS DynamoDB Table Has Autoscaling Targets Configured
AWS DynamoDB Table Has Autoscaling Enabled
AWS DynamoDB Table Has Encryption Enabled
AWS EC2 AMI Launched on Approved Host
AWS EC2 AMI Launched on Approved Instance Type
AWS EC2 AMI Launched With Approved Tenancy
AWS EC2 Instance Has Detailed Monitoring Enabled
AWS EC2 Instance Is EBS Optimized
AWS EC2 Instance Running on Approved AMI
AWS EC2 Instance Running on Approved Instance Type
AWS EC2 Instance Running in Approved VPC
AWS EC2 Instance Running On Approved Host
AWS EC2 Instance Running With Approved Tenancy
AWS EC2 Instance Volumes Are Encrypted
We need resource lookup to re-enable this
AWS EC2 Volume Is Encrypted
AWS EC2 Volume Snapshot Is Encrypted
AWS GuardDuty is Logging to a Master Account
AWS GuardDuty Is Enabled
AWS IAM Group Has Users
AWS IAM Policy Blacklist Is Respected
AWS IAM Policy Does Not Grant Full Administrative Privileges
AWS IAM Policy Is Not Assigned Directly To User
AWS IAM Policy Role Mapping Is Respected
AWS IAM User Has MFA Enabled
AWS Network ACL Restricts SSH
AWS IAM Password Used Every 90 Days
AWS Password Policy Enforces Complexity Guidelines
AWS Password Policy Enforces Password Age Limit Of 90 Days Or Less
AWS Password Policy Prevents Password Reuse
AWS RDS Instance Has Auto Minor Version Upgrade Enabled
AWS RDS Instance Is Not Publicly Accessible
AWS RDS Instance Snapshots Are Not Publicly Accessible
AWS RDS Instance Has Storage Encrypted
AWS RDS Instance Has Backups Enabled
AWS RDS Instance Has High Availability Configured
AWS Redshift Cluster Allows Version Upgrades
AWS Redshift Cluster Has Encryption Enabled
AWS Redshift Cluster Has Logging Enabled
AWS Redshift Cluster Has Correct Preferred Maintenance Window
AWS Redshift Cluster Has Sufficient Snapshot Retention Period
AWS Resource Has Minimum Number of Tags
AWS Resource Has Required Tags
AWS Root Account Has MFA Enabled
AWS Root Account Does Not Have Access Keys
AWS S3 Bucket Name Has No Periods
AWS S3 Bucket Not Publicly Readable
AWS S3 Bucket Not Publicly Writeable
AWS S3 Bucket Policy Does Not Use Allow With Not Principal
AWS S3 Bucket Policy Enforces Secure Access
AWS S3 Bucket Policy Restricts Allowed Actions
AWS S3 Bucket Policy Restricts Principal
AWS S3 Bucket Has Versioning Enabled
AWS S3 Bucket Has Encryption Enabled
AWS S3 Bucket Lifecycle Configuration Expires Data
AWS S3 Bucket Has Logging Enabled
AWS S3 Bucket Has MFA Delete Enabled
AWS S3 Bucket Has Public Access Block Enabled
AWS Security Group Restricts Ingress On Administrative Ports
AWS VPC Default Security Group Restricts All Traffic
AWS VPC Flow Logging Enabled
AWS WAF Has Correct Rule Ordering
AWS CloudTrail Logs Encrypted Using KMS CMK