Skip to content

Latest commit

 

History

History
381 lines (188 loc) · 15.8 KB

aws.md

File metadata and controls

381 lines (188 loc) · 15.8 KB

ACM

AWS ACM Certificate Expiration

AWS ACM Certificate Status

AWS ACM Secure Algorithms

Access Keys

AWS Access Key Rotation

AWS Access Key Uploaded to Github

AWS Access Keys At Account Creation

CloudFormation

AWS CloudFormation Stack Drift

AWS CloudFormation Stack IAM Service Role

AWS CloudFormation Stack Termination Protection

CloudTrail

AWS CloudTrail CloudWatch Logs

AWS CloudTrail Enabled

A CloudTrail Was Created or Updated

AWS CloudTrail Least Privilege Access

AWS CloudTrail Log Encryption

AWS CloudTrail Log Validation

AWS CloudTrail S3 Bucket Access Logging

AWS CloudTrail S3 Bucket Public

Monitor Unauthorized API Calls

Account Security Configuration Changed

CloudTrail Stopped

CodeBuild Project made Public

CloudWatch

AWS CloudWatch Log Encryption

AWS CloudWatch Logs Data Retention

Sensitive AWS CloudWatch Log Encryption

Config Audit

AWS Config Global Resources

AWS Config Recording Status

AWS Config Records All Resource Types

AWS Config Service Created

AWS Config Service Disabled

AWS Config Status

DynamoDB

AWS DynamoDB Table Autoscaling Configuration

AWS DynamoDB Table Autoscaling

AWS DynamoDB Table Encryption

AWS DynamoDB Table TTL

EC2

AWS EC2 AMI Approved Host

AWS EC2 AMI Approved Instance Type

AWS EC2 AMI Approved Tenancy

AWS EC2 Instance Approved AMI

AWS EC2 Instance Approved Host

AWS EC2 Instance Approved Instance Type

AWS EC2 Instance Approved Tenancy

AWS Snapshot Made Public

AWS CDE EC2 Volume Encryption

AWS EC2 Instance Approved VPC

AWS EC2 Instance Detailed Monitoring

AWS EC2 Instance EBS Optimization

AWS AMI Sharing

Amazon Machine Image (AMI) Modified to Allow Public Access

AWS EC2 Manual Security Group Change

AWS EC2 Volume Encryption

AWS EC2 Volume Snapshot Encryption

EC2 Network ACL Modified

EC2 Network Gateway Modified

EC2 Route Table Modified

EC2 Security Group Modified

EC2 VPC Modified

Load Balancer

AWS ELB SSL Policies

AWS Enforces SSL Policies

AWS Application Load Balancer Web ACL

GuardDuty

AWS GuardDuty Enabled

AWS GuardDuty High Severity Finding

AWS GuardDuty Low Severity Finding

AWS GuardDuty Master Account

AWS GuardDuty Medium Severity Finding

IAM

AWS IAM Group Users

Detect Reconnaisance from IAM Users

AWS IAM Password Unused

AWS IAM Policy Administrative Privileges

AWS IAM Policy Assigned to User

AWS IAM Policy Blocklist

AWS IAM Policy Does Not Grant Any Administrative Access

AWS IAM Policy Does Not Grant Network Admin Access

AWS IAM Policy Role Mapping

AWS IAM Resource Does Not Have Inline Policy

AWS IAM Role Restricts Usage

AWS IAM User MFA

AWS IAM User Not In Conflicting Groups

AWS Root Account Hardware MFA

AWS Root Account MFA

AWS Unused Access Key

IAM Assume Role Blocklist Ignored

IAM Change

IAM Entity Created Without CloudFormation

IAM Inline Policy Network Admin

IAM Policy Modified

KMS CMK Disabled or Deleted

Logins Without MFA

Logins Without SAML

Monitor Unauthorized API Calls

New IAM Credentials Updated

Root Account Access Key Created

Root Account Activity

Root Console Login

Root Password Changed

Logins Without MFA

Logins Without SAML

Detect Reconnaisance from IAM Users

Failed Root Console Login

KMS

AWS KMS CMK Key Rotation

AWS KMS Key Restricts Usage

KMS CMK Disabled or Deleted

Network ACLs

AWS Network ACL Overly Permissive Entry Created

AWS Network ACL Restricts Inbound Traffic

AWS Network ACL Restricts Insecure Protocols

AWS Network ACL Restricts Outbound Traffic

AWS Network ACL Restricts SSH

Password Policy

AWS Password Policy Complexity Guidelines

AWS Password Policy Password Age Limit

AWS Password Policy Password Reuse

RDS

AWS RDS Instance Backup

AWS RDS Instance Encryption

AWS RDS Instance Has Acceptable Backup Retention Period

AWS RDS Instance High Availability

AWS RDS Instance Minor Version Upgrades

AWS RDS Instance Public Access

AWS RDS Instance Snapshot Public Access

Redshift

AWS Redshift Cluster Encryption

AWS Redshift Cluster Has Acceptable Snapshot Retention Period

AWS Redshift Cluster Logging

AWS Redshift Cluster Maintenance Window

AWS Redshift Cluster Snapshot Retention

AWS Redshift Cluster Version Upgrade

Account Policies

AWS Resource Made Public

AWS Resource Minimum Tags

AWS Resource Required Tags

AWS Root Account Access Keys

AWS Root Account Hardware MFA

AWS Root Account MFA

S3

AWS S3 Access Error

AWS S3 Access IP Allowlist

AWS S3 Bucket Action Restrictions

AWS S3 Bucket Encryption

AWS S3 Bucket Lifecycle Configuration

AWS S3 Bucket Logging

AWS S3 Bucket MFA Delete

AWS S3 Bucket Name DNS Compliance

AWS S3 Bucket Object Lock Configured

AWS S3 Bucket Policy Allow With Not Principal

AWS S3 Bucket Policy Modified

AWS S3 Bucket Principal Restrictions

AWS S3 Bucket Public Access Block

AWS S3 Bucket Public Read

AWS S3 Bucket Public Write

AWS S3 Bucket Secure Access

AWS S3 Bucket Versioning

AWS S3 Insecure Access

AWS S3 Unauthenticated Access

AWS S3 Unknown Requester

S3 Bucket Deleted

VPC

AWS Security Group - Only DMZ Publicly Accessible

AWS Security Group Administrative Ingress

AWS Security Group Restricts Access To CDE

AWS Security Group Restricts Inbound Traffic

AWS Security Group Restricts Inter-SG Traffic

AWS Security Group Restricts Outbound Traffic

AWS Security Group Restricts Traffic Leaving CDE

AWS Security Group Tightly Restricts Inbound Traffic

AWS Security Group Tightly Restricts Outbound Traffic

AWS Security Group Used

AWS VPC Default Network ACL Restricts All Traffic

AWS VPC Default Security Group Restrictions

AWS VPC Flow Logs

AWS VPC Healthy Log Status

VPC Flow Logs Inbound Port Allowlist

VPC Flow Logs Inbound Port Blocklist

VPC Flow Logs Unapproved Outbound DNS Traffic

AWS WAF

AWS WAF Has XSS Predicate

AWS WAF Rule Ordering