| Account.1 |
Security contact information should be provided for an AWS account. |
Medium |
| CloudTrail.1 |
CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events |
High |
| CloudWatch.1 |
A log metric filter and alarm should exist for usage of the root" user" |
Low |
| CloudWatch.2 |
Ensure a log metric filter and alarm exist for unauthorized API calls |
Low |
| CloudWatch.3 |
Ensure a log metric filter and alarm exist for Management Console sign-in without MFA |
Low |
| CloudWatch.4 |
Ensure a log metric filter and alarm exist for IAM policy changes |
Low |
| CloudWatch.5 |
Ensure a log metric filter and alarm exist for CloudTrail configuration changes |
Low |
| CloudWatch.6 |
Ensure a log metric filter and alarm exist for AWS Management Console authentication failures |
Low |
| CloudWatch.7 |
Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs |
Low |
| CloudWatch.8 |
Ensure a log metric filter and alarm exist for S3 bucket policy changes |
Low |
| CloudWatch.9 |
Ensure a log metric filter and alarm exist for AWS Config configuration changes |
Low |
| CloudWatch.10 |
Ensure a log metric filter and alarm exist for security group changes |
Low |
| CloudWatch.11 |
Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) |
Low |
| CloudWatch.12 |
Ensure a log metric filter and alarm exist for changes to network gateways |
Low |
| CloudWatch.13 |
Ensure a log metric filter and alarm exist for route table changes |
Low |
| CloudWatch.14 |
Ensure a log metric filter and alarm exist for VPC changes |
Low |
| Config.1 |
AWS Config should be enabled and use the service-linked role for resource recording |
Critical |
| EC2.10 |
Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service |
Medium |
| EC2.15 |
EC2 subnets should not automatically assign public IP addresses |
Medium |
| EC2.172 |
EC2 VPC Block Public Access settings should block internet gateway traffic |
Medium |
| EC2.182 |
Amazon EBS Snapshots should not be publicly accessible |
High |
| EC2.2 |
VPC default security groups should not allow inbound or outbound traffic |
High |
| EC2.55 |
VPCs should be configured with an interface endpoint for ECR API |
Medium |
| EC2.56 |
VPCs should be configured with an interface endpoint for Docker Registry |
Medium |
| EC2.57 |
VPCs should be configured with an interface endpoint for Systems Manager |
Medium |
| EC2.58 |
VPCs should be configured with an interface endpoint for Systems Manager Incident Manager Contacts |
Medium |
| EC2.6 |
VPC flow logging should be enabled in all VPCs |
Medium |
| EC2.60 |
VPCs should be configured with an interface endpoint for Systems Manager Incident Manager |
Medium |
| EC2.7 |
EBS default encryption should be enabled |
Medium |
| GuardDuty.1 |
GuardDuty should be enabled |
High |
| IAM.7 |
Password policies for IAM users should have strong configurations |
Medium |
| IAM.11 |
Ensure IAM password policy requires at least one uppercase letter |
Medium |
| IAM.12 |
Ensure IAM password policy requires at least one lowercase letter |
Medium |
| IAM.13 |
Ensure IAM password policy requires at least one symbol |
Medium |
| IAM.14 |
Ensure IAM password policy requires at least one number |
Medium |
| IAM.15 |
Ensure IAM password policy requires minimum password length of 14 or greater |
Medium |
| IAM.16 |
Ensure IAM password policy prevents password reuse |
Low |
| IAM.17 |
Ensure IAM password policy expires passwords within 90 days or less |
Low |
| IAM.18 |
Ensure a support role has been created to manage incidents with AWS Support |
Low |
| Inspector.1 |
Amazon Inspector EC2 scanning should be enabled |
High |
| Inspector.2 |
Amazon Inspector ECR scanning should be enabled |
High |
| Inspector.3 |
Amazon Inspector Lambda code scanning should be enabled |
High |
| Inspector.4 |
Amazon Inspector Lambda standard scanning should be enabled |
High |
| Macie.1 |
Macie should be enabled |
Medium |
| S3.1 |
S3 general purpose buckets should have block public access settings enabled |
Medium |
| S3.13 |
S3 general purpose buckets should have Lifecycle configurations |
Low |
| S3.5 |
S3 general purpose buckets should require requests to use SSL |
Medium |
| S3.9 |
S3 general purpose buckets should have server access logging enabled |
Medium |
| SSM.6 |
SSM Automation should have CloudWatch logging enabled |
Medium |
| SSM.7 |
SSM documents should have the block public sharing setting enabled |
Critical |