Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/ollionorg/cloud-custodian-aws-policies

CloudCustodian Rules engine for cloud security and governance, DSL in yaml for policies to query, filter, and take actions on resources
https://github.com/ollionorg/cloud-custodian-aws-policies

auto-remediation automation aws c7n cloud cloud-security cloud-security-audit cloud-security-posture-management cloudcustodian compliance cspm custodian governance policies security-policies security-tools

Last synced: 9 days ago
JSON representation

CloudCustodian Rules engine for cloud security and governance, DSL in yaml for policies to query, filter, and take actions on resources

Host: GitHub
URL: https://github.com/ollionorg/cloud-custodian-aws-policies
Owner: ollionorg
License: mit
Created: 2023-01-16T06:27:09.000Z (almost 2 years ago)
Default Branch: main
Last Pushed: 2023-08-25T08:30:43.000Z (about 1 year ago)
Last Synced: 2024-04-16T14:13:43.057Z (7 months ago)
Topics: auto-remediation, automation, aws, c7n, cloud, cloud-security, cloud-security-audit, cloud-security-posture-management, cloudcustodian, compliance, cspm, custodian, governance, policies, security-policies, security-tools
Homepage:
Size: 271 KB
Stars: 12
Watchers: 2
Forks: 8
Open Issues: 0
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS

Awesome Lists containing this project

README

![cloudcover-part-of-sttc-color-dark-logo.png](.img/cloudcover-part-of-sttc-color-dark-logo.png) +

---

# Cloud Custodian Policies for AWS
> powered by GitHub Actions

# Prerequisites
* Quotas limit increased to `200` (minimum) for CloudWatch Event Rules, in each region:
```shell
aws service-quotas request-service-quota-increase \
--service-code events \
--quota-code L-244521F2 \
--desired-value 200
```
* Alerts policies filenames should start with `a-`
* Remediation policies filenames should start with `r-`

---

# Custodian Policy Structure
* Ensure `Account {account_id} - ` is present in the `description` to identify multiple accounts independently.
* Ensure `name` is short and sweet. If the `name` is too long, validation check will fail.
* Ensure role name is not changed as it deployed via terraform in prerequisites.

---

# Using with GitHub Actions
> Ensure [validation.yml](.github/workflows/validation.yml) is being used for sanity

To use the policies with an AWS account, we have to refer the [sample workflow](.github/sample-workflow.yml) file.
The below sample workflow is for `cloudtrail` based policies. Similarly, the workflows can be created for hourly/daily frequencies.

```yaml
name: sample-workflow
on:
push:
branches:
- main
paths:
- policies/cloudtrail/**

defaults:
run:
shell: bash
working-directory: policies/cloudtrail/

env:
AWS_ACCOUNT_ID: "123456789012"
REGION_LIST: |
(
"us-east-1"
"ap-southeast-1"
)
ROLE_NAME: custodian-sample-role

jobs:
CustodianDeployer:
name: Deploy Lambda for CloudTrail Events
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- name: Checkout
uses: actions/checkout@v2

- name: Install python3.8
uses: actions/setup-python@v2
with:
python-version: '3.8'

- name: Install Custodian
run: |
pip install c7n

- name: Configure AWS credentials from ${{env.AWS_ACCOUNT_ID}} account
run: |
CREDS=( $(aws sts assume-role --role-arn "arn:aws:iam::${{env.AWS_ACCOUNT_ID}}:role/${{env.ROLE_NAME}}" --role-session-name "${{env.ROLE_NAME}}" --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --duration-seconds 5400 --output text) )
unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN
AWS_ACCESS_KEY_ID=${CREDS[0]}
echo "::add-mask::$AWS_ACCESS_KEY_ID"
echo AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID >> $GITHUB_ENV
AWS_SECRET_ACCESS_KEY=${CREDS[1]}
echo "::add-mask::$AWS_SECRET_ACCESS_KEY"
echo AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY >> $GITHUB_ENV
AWS_SESSION_TOKEN=${CREDS[2]}
echo "::add-mask::$AWS_SESSION_TOKEN"
echo AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN >> $GITHUB_ENV

- name: Check Access
run: |
aws sts get-caller-identity

- name: Deploy regional policies
run: |
find . $ -iname "*.yml" -o -iname "*.yaml" $ | { grep -v "route53\|cloudfront\|iam\|s3" || true; } | while read POLICY; do
sed -i 's,REPLACE_WEBHOOK_HERE,${{ secrets.CUSTODIAN_SLACK_WEBHOOK }},g' "$POLICY"
array=${{ env.REGION_LIST }}
for REGION in ${array[*]}; do
custodian run -s /tmp/ -v --cache-period 0 -c "$POLICY" --region "$REGION"
done
done

- name: Deploy global policies
run: |
find . $ -iname "*.yml" -o -iname "*.yaml" $ | { grep "route53\|cloudfront\|iam\|s3" || true; } | while read POLICY; do
sed -i 's,REPLACE_WEBHOOK_HERE,${{ secrets.CUSTODIAN_SLACK_WEBHOOK }},g' "$POLICY"
custodian run -s /tmp/ -v --cache-period 0 -c "$POLICY" --region us-east-1
done
```

### Notes
* Ensure to change `REGION_LIST` inside the workflow file.
* Individual workflow files for each frequency.
* Slack Webhook. This repo will use `CUSTODIAN_SLACK_WEBHOOK` GitHub Secret to replace webhook while deployment.

---

# List of Policies
| Policy Name
|-------------------------------------
| r-security-group-ingress-mysql-acces
| route53-domain-has-autorenew-enabled
| r-security-group-ingress-rdp-access-
| r-security-group-ingress-ftp20-acces
| r-security-group-ingress-ftp20-acces
| r-security-group-ingress-ssh-access-
| a-vpn-tunnels-status-verify
| r-security-group-ingress-ahsp-access
| r-security-group-ingress-all-tcp-acc
| r-security-group-ingress-all-udp-acc
| route53-reg-domain-has-transfer-lock
| iam-access-key1-rotated-90-days-or-less
| no-cmk-is-marked-for-deletion
| root-account-mfa-enabled-check
| cmk-use-external-key-material
| aws-kms-key-rotation-is-enabled
| unencrypted-unattached-ebs-are-deleted
| aws-lambda-version-latest-not-custom
| a-sagemaker-direct-internet-access
| iam-45-days-unused-keys
| a-secret-manager-no-aws-default-kmsKey-used-check
| cloudfront-distributions-aws-waf-enabled
| rds-instance-public-accessibility-enable
| elasticache-clusters-data-at-rest-encrypted
| cloudtrail-log-file-validation-is-enabled
| a-vpc-network-acl-unused
| r-sns-encrypted-at-rest
| list-vpc-in-lambda
| check-default-vpc-in-lambda
| throttle-lambdas-in-default-vpc
| unrestricted-ssh
| redis-are-in-transit-encrypted
| iam-policies-attached-to-groups-roles
| aws-security-group-default-deny
| es-encryption-at-rest
| rest-api-gateway-stage-logging-enabled
| eip-attached
| iam-user-unused-credentials
| rds-instance-enhance-monitoring-enable
| waf-enabled
| r-unused-ec2-eips-removed
| no-managed-policies-attached-iam-users-directly
| r-redshift-automatic-snapshots-enabled
| rds-automatic-minor-version-upgrades-enabled
| a-elbv2-accesslog-enabled-check
| flow-logs-are-enabled-in-all-region
| a-security-groups-unused
| r-s3-bucket-encryption-set
| redis-has-multi-az-failover-enabled
| vpc-sg-opened-only-to-authorized-ports
| sagemaker-endpoint-configuration-encryption
| r-redshift-automatic-upgrades-major-
| route53-domain-is-not-expired-high
| unused-iam-with-password-ak-deleted
| cloudfront-distribution-origin-acces
| es-least-three-data-nodes
| aws-lambda-env-vars-encrypted-at-rest
| rds-backup-enabled
| es-node-to-node-encryption-enabled
| elasticache-memcache-not-using-default-ports
| iam-policies-in-use
| cloudfront-distributions-require-enc
| s3-account-level-public-access-blocks
| es-has-enabled-slow-logs-to-cw-logs
| aws-log-group-missing-retention-days
| rds-instance-encryption-enable
| r-sns-encrypted-at-rest
| dynamodb-encrypted-aws-kms
| r-delete-igw-unattached-vpc
| no-root-account-access-key-exists
| aws-config-is-enabled-in-all-regions
| elasticache-clusters-in-transit-encrypted
| rds-instance-deletion-protection-enable
| iam-policy-no-statements-with-admin-access
| a-elb-classic-connection-draining-check
| cmk-expiry-set-with-ext-key-material
| iam-allow-all-policy-alert
| cloudtrail-integrated-cloudwatch-logs
| a-wafv2-logging-enabled
| a-sns-encrypted-at-rest
| cloudtrail-logs-are-encrypted-using-kms-cmk
| a-elb-classic-crosszone-check
| aws-lambda-tracing-is-enabled
| rest-api-gateway-stages-ssl-backend-auth
| s3-bucket-versioning-medium
| es-least-three-dedicated-master-nodes
| r-apigateway-caching-verify
| cloudfront-distribution-logging-enabled
| elb-custom-security-policy-ssl-check
| iam-password-policy-best-practices
| aws-log-group-encryption-at-rest
| efs-encryption-has-cmk-for-data-at-rest
| elasticache-automatic-backup-retention-period-15
| aws-iam-ssl-tls-expired-certs-alert
| dms-instance-not-publicly-accessible
| r-redshift-enhanced-vpc-routing-enabled
| ec2-instance-detailed-monitoring-enabled
| rest-api-gateway-stage-associated-aws-waf-web-acl
| ami-owned-by-an-aws-account-are-encrypted
| s3-public-rw-prohibited
| rds-cluster-deletion-protection-enable
| ec2-instance-ebs-optimization-enabled
| root-account-hardware-mfa-enabled-check
| cloudFront-distributions-default-root-object
| iam-access-key1-rotated-45-days-or-less
| acm-certificate-expiration-check
| no-key-pair-present-in-aws-account
| password-policy-check-pwd-reuse-prevention
| aws-log-group-retention-not-less-than-year
| unrestricted-common-ports
| es-encrypted-tls-1-2
| aws-log-group-missing-retention-days-remediate
| elasticache-redis-not-using-default-ports
| iam-90-days-unused-keys
| redis-clusters-are-encrypted-at-rest
| r-redshift-encryption-enabled
| r-redshift-prohibit-public-access
| copy-tags-volume-to-ebs-snapshots
| Account 123456789012 - Create
| a-lambda-should-in-vpc
| cloudwatch-alarm-action-should-be-enabled
| a-rds-aurora-clusters-backtracking-enabled
| internet-gateway-authorized-vpc-only
| a-elb-accesslog-enabled-check
| rds-cluster-encryption-enable
| dynamodb-point-in-time-recovery
| redshift-cluster-public-access-check
| kms-cmk-marked-for-deletion
| vpc-default-security-group-closed
| s3-mfa-delete-enabled
| r-apigateway-stage-cache-data-encrypted
| r-elbv2-enabled-drop-http-headers
| efs-encryption-is-enabled-for-data-at-rest
| a-sagemaker-notebook-encryption
| elasticsearch-node-to-node-encryption
| r-s3-enable-versioning
| r-rest-api-gateway-stages-x-ray-tracing-enabled
| r-elb-delete-unused
| redshift-cluster-tls-ssl-check
| es-node-to-node-encryption-enabled
| s3-access-logging-is-enabled
| a-redshift-audit-logging-enabled
| cloudtrail-is-enabled-all-region
| r-aws-lambda-tracing-is-enabled
| root-account-hardware-mfa-enabled-check
| a-rds-cluster-snapshot-shared-with-account
| a-elasticache-snapshot-copies-to-s3
| a-rds-public-snapshot
| a-rds-instance-access-to-public
| a-s3-bucket-settings-for-public-is-set
| a-route53-has-autorenew-enabled
| a-s3-deny-bucket-policy-grant-access-to-all
| a-ec2-ami-creation-alert
| a-ec2-public-ami
| a-ec2-unattached-ebs-are-encrypted
| a-ec2-public-ebs-snapshot
| a-s3-server-side-encryption-is-enabl
| a-s3-bucket-acl-grant-access-to-all-or-auth-users
| ami-shared-with-other-account
| a-rds-public-cluster-snapshot
| a-s3-access-logging-is-enabled-for-s3-buckets
| a-s3-versioning-is-enabled-for-s3-buckets
| a-ec2-ebs-snapshot-shared-with-account
| a-redshift-snapshot-shared-with-account
| a-route53-reg-domain-has-transfer-lock
| r-ec2-ami-shared-with-account
| a-rds-snapshot-shared-with-account
| a-iam-mfa-enable-users-with-console-password
| a-firehose-delivery-stream-encryptio
| a-s3-bucket-settings-for-public-is-set
| a-redis-clusters-are-encrypted-with-cmk
| a-elb-clb-is-not-using-unencrypted-protocol
| a-redis-clusters-are-auth-enabled
| r-s3-server-side-encryption-is-enabled
| a-firehose-delivery-stream-encryptio
| r-security-group-default-sg-remove-permissions
| a-s3-acl-access-to-all-or-auth-users
| a-s3-deny-bucket-policy-access-to-all
| r-s3-policy-enforces-encryption-in-transit
| a-elb-listener-is-not-using-unencrypted-protocol
| r-security-group-unused-sg-remove
| r-enable-vpc-flowlog-on-vpcs
| a-s3-server-side-encryption-is-enabled
| r-cloudwatch-set-log-group-retention | Description | Resource Name | ----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------| s-replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress mysql access from 0.0.0.0/0 replace with VPN IP | security-group | | Account 123456789012 - Ensure AWS Route 53 domains have AutoRenew enabled | r53domain | replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress rdp access from 0.0.0.0/0 replace with VPN IP | security-group | s-replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress ftp20 access from 0.0.0.0/0 replace with VPN IP | security-group | s-replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress ftp20 access from 0.0.0.0/0 replace with VPN IP | security-group | replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress SSH access from 0.0.0.0/0 replace with VPN IP | security-group | | Account 123456789012 Both VPN tunnels provided by AWS Site-to-Site VPN should be in UP status | aws.vpn-connection | -replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress ahsp access from 0.0.0.0/0 replace with VPN IP | security-group | ess-replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress TCP access from 0.0.0.0/0 replace with VPN IP | security-group | ess-replace-vpn-ip | Account 123456789012 - VPC security groups should restrict ingress UDP access from 0.0.0.0/0 replace with VPN IP | security-group | | Account 123456789012 - Ensure AWS Route 53 Registered domain has Transfer lock enabled | r53domain | | Account 123456789012 - Ensure access key1 is rotated every 90 days or less | iam-user | | Account 123456789012 - Ensure CMK KMS is not marked for deletion | kms-key | | Account 123456789012 - Ensure MFA is enabled for the root account | account | | Account 123456789012 - Ensure CMK KMS uses external key material | kms-key | | Account 123456789012 - Ensure rotation for customer created CMKs is enabled | aws.kms-key | | Account 123456789012 - Ensure unattached EBS volumes are encrypted | ebs | | Account 123456789012 - Ensure AWS Lambda version is $LATEST and not custom version | aws.lambda | | Account 123456789012 - Amazon SageMaker Notebook Instances Should Not Have Direct Internet Access | aws.sagemaker-notebook | | Account 123456789012 - Ensure access keys are unused for 45 days are disabled/deleted | iam-user | | Account 123456789012 - Ensure no AWS default KMS Key is used to protect Secrets | aws.secrets-manager | | Account 123456789012 - CloudFront Distributions Should Have AWS WAF Enabled | aws.distribution | | Account 123456789012 - Ensure that Public Accessibility is set to No for Database Instances | rds | | Account 123456789012 - Ensure that AWS ElastiCache Redis clusters are Data At-Rest encrypted | elasticache-group | | Account 123456789012 - Ensure CloudTrail log file validation is enabled | aws.cloudtrail | | Account 123456789012 Unused network access control lists should be removed | network-acl | | Account 123456789012 - Set Encryption On SNS topics | aws.sns | | Account 123456789012 - list vpc in lambda | lambda | | Account 123456789012 - check default vpc in lambda | vpc | | Account 123456789012 - throttle Lambdas in default VPC | lambda | | Account 123456789012 - Ensure security group ingress doesn't allow 0.0.0.0/0 to port 22 | aws.security-group | | Account 123456789012 - Ensure that AWS ElastiCache Redis clusters are In-Transit encrypted | elasticache-group | | Account 123456789012 - Ensure IAM policies are attached only to groups or roles | aws.iam-user | | Account 123456789012 - Ensure the default security group of every VPC restricts all traffic | aws.security-group | | Account 123456789012 - Amazon Elasticsearch Service Domains Should Have Encryption At Rest Enabled | aws.elasticsearch | | Account 123456789012 - API Gateway Stage Logging Should Be Enabled | rest-stage | | Account 123456789012 - Ensure EIP allocated to VPC are attached to EC2 instances or in-use ENIs | network-addr | | Account 123456789012 - Ensure user credentials unused for 90 days are disabled/deleted | aws.iam-user | | Account 123456789012 - Ensure Enhance monitoring is enabled for RDS Database Instance | rds | | Account 123456789012 - Ensure Waf enabled on ALB | app-elb | | Account 123456789012 unused ec2 eip's should be removed | aws.elastic-ip | | Account 123456789012 - Ensure no Managed Policies are attached to IAM Users directly | iam-user | | Account 123456789012 - Amazon Redshift Clusters Should Have Automatic Snapshots Enabled | redshift | | Account 123456789012 - RDS Automatic Minor Version Upgrades Should Be Enabled | aws.rds | | Account 123456789012 - ELBv2 Accesslog Enabled Check | app-elb | | Account 123456789012 - Ensure VPC flow logging is enabled in all VPCs | vpc | | Account 123456789012 - Ensure no unused security groups exists | aws.security-group | | Account 123456789012 - Ensure S3 bucket encryption is enabled | s3 | | Account 123456789012 - Ensure AWS ElastiCache Redis cluster with Multi-AZ Automatic Failover feature is set to enabled | elasticache-group | | Account 123456789012 - Ensure security group doesn't have 0.0.0.0/0 ingress except for port 443 | aws.security-group | | Account 123456789012 - SageMaker Endpoint Configuration Encryption Should Be Enabled | aws.sagemaker-endpoint-config | versions-enabled | Account 123456789012 - Amazon Redshift Should Have Automatic Upgrades To Major Versions Enabled | aws.redshift | | Account 123456789012 - Ensure AWS Route 53 Registered domain is not expired | r53domain | | Account 123456789012 User has no password, User has no ak/sk and User is older than 7 days deleted | iam-user | s-identity-enabled | Account 123456789012 - CloudFront distributions should have origin access identity enabled | aws.distribution | | Account 123456789012 - Elasticsearch domains should have at least three data nodes | aws.elasticsearch | | Account 123456789012 - Ensure AWS Lambda env vars encrypted at rest | aws.lambda | | Account 123456789012 - RDS DB Instance Backup Should Be Enabled | aws.rds | | Account 123456789012 - Ensure AWS Elasticsearch Service domains are using the latest version of Elasticsearch engine | elasticsearch | | Account 123456789012 - Ensure that AWS ElastiCache Memcached clusters are not using 11211 port | cache-cluster | | Account 123456789012 - Ensure IAM policy are in use | iam-policy | ryption-transit | Account 123456789012 - CloudFront distributions should require encryption in transit | aws.distribution | | Account 123456789012 - Ensure Account level S3 public access block is enabled | aws.account | | Account 123456789012 - Ensure AWS Elasticsearch Service domains have enabled the support for publishing slow logs to AWS CloudWatch Logs | elasticsearch | | Account 123456789012 - Ensure log groups have retention period set | aws.log-group | | Account 123456789012 - Ensure Encryption is enabled for the database Instance | rds | | Account 123456789012 - Set Encryption On SNS topics | aws.sns | | Account 123456789012 - DynamoDB table should be encrypted with AWS KMS | aws.dynamodb-table | | Account 123456789012 - Delete internet gateways unattached vpc | internet-gateway | | Account 123456789012 - Ensure no root account access key exists | account | | Account 123456789012 - Ensure AWS Config is enabled in all regions | account | | Account 123456789012 - Ensure that AWS ElastiCache Redis clusters are In-Transit encrypted | elasticache-group | | Account 123456789012 - Ensure Deletion Protection is enabled for RDS DB Instance | rds | | Account 123456789012 - Ensure IAM policy with no statements with admin access | iam-policy | | Account 123456789012 - ELB Connection Draining Check | elb | | Account 123456789012 - Ensure that the key expiry is set for CMK with external key material | kms-key | | Account 123456789012 - Ensure IAM policies that allow full administrative privileges are not created | iam-policy | | Account 123456789012 - Ensure CloudTrail trails are integrated with CloudWatch Logs | cloudtrail | | Account 123456789012 - Logging should be enabled on AWS WAFv2 regional and global web access control list (ACLs) | aws.wafv2 | | Account 123456789012 - SNS topics should be encrypted at rest using AWS KMS | aws.sns | | Account 123456789012 - Ensure CloudTrail logs are encrypted at rest using KMS CMKs | aws.cloudtrail | | Account 123456789012 - ELB CrossZone Check | elb | | Account 123456789012 - Ensure AWS lambda tracing is enabled. | aws.lambda | | Account 123456789012 - API Gateway REST API stages should be configured to use SSL certificates for backend authentication | rest-stage | | Account 123456789012 - Ensure versioning is enabled for S3 buckets | s3 | | Account 123456789012 - Elasticsearch domains should be configured with at least three dedicated master nodes | aws.elasticsearch | | Account 123456789012 - API Gateway stage caching verify | rest-stage | | Account 123456789012 - CloudFront distribution should have logging enabled | aws.distribution | | Account 123456789012 - Ensure Classic LB SSL listeners are using custom policy | elb | | Account 123456789012 - IAM Password Policy Best Practices | account | | Account 123456789012 - Log group encryption at rest should be enabled | aws.log-group | | Account 123456789012 - Ensure CMK is used to encrypt data at rest for EFS | efs | | Account 123456789012 - ElastiCache Redis Cluster Automatic Backup Should Be Enabled With Retention Period Of 15 days Or Greater | elasticache-group | | Account 123456789012 - SSL/TLS Certificate that are already expired | iam-certificate | | Account 123456789012 - DMS replication instances should not be publicly accessible | aws.dms-instance | | Account 123456789012 - Amazon Redshift Clusters VPC Routing Enabled | redshift | | Account 123456789012 - EC2 instance detailed monitoring should be enabled | ec2 | | Account 123456789012 - API Gateway Should Be Associated With An AWS WAF Web ACL | rest-stage | | Account 123456789012 - Ensure AMIs owned by an AWS account are encrypted | ami | | Account 123456789012 - Ensure S3 bucket prohibite public read or write access | s3 | | Account 123456789012 - Ensure Deletion Protection is enabled for RDS DB Cluster | rds-cluster | | Account 123456789012 - EC2 instance should have EBS optimization enabled | ec2 | | Account 123456789012 - Ensure hardware MFA is enabled for the root account | account | | Account 123456789012 - CloudFront Distributions Should Have A Default Root Object Configured | aws.distribution | | Account 123456789012 - Ensure access key1 is rotated every 45 days or less | iam-user | | Account 123456789012 - ACM certificates about to expire in 14 days | acm-certificate | | Account 123456789012 - Ensure no key pair present in aws account. | aws.key-pair | | Account 123456789012 - Ensure that the IAM Password Policy prevents a new password from being the same as the last 6 passwords. | aws.account | | Account 123456789012 - Ensure log groups have retention period at least a year | aws.log-group | | Account 123456789012 - Ensure SG ingress doesn't allow 0.0.0.0/0 to ports 20,21,22,139,445,3306 or 3389 | aws.security-group | | Account 123456789012 - Connections to Elasticsearch domains should be encrypted using TLS 1.2 | aws.elasticsearch | | Account 123456789012 - Ensure log groups have retention period set | aws.log-group | | Account 123456789012 - Ensure that AWS ElastiCache redis clusters are not using 6379 port | elasticache-group | | Account 123456789012 - Ensure access keys are unused for 90 days are disabled/deleted | iam-user | | Account 123456789012 - Ensure that AWS ElastiCache Redis clusters are Data At-Rest encrypted | elasticache-group | | Account 123456789012 - Redshift cluster audit logging and encryption should be enabled | aws.redshift | | Account 123456789012 - Amazon Redshift Clusters Should Prohibit Public Access | aws.redshift | | r-ebs-snapshots-create-encrypted | Account 123456789012 - copy tags volume to ebs snapshots | encrypted ebs snapshot remove unencrypted ebs | ebs-snapshot | ebs-snapshot | | Account 123456789012 - Lambda functions should be in a VPC | lambda | | Account 123456789012 - CloudWatch alarm action should be enabled | aws.alarm | | Account 123456789012 - Amazon Aurora clusters should have backtracking enabled | rds-cluster | | Account 123456789012 - Ensure Internet Gateway has authorized VPC | internet-gateway | | Account 123456789012 - ELB Accesslog Enabled Check | elb | | Account 123456789012 - Ensure Encryption is enabled for the RDS cluster | rds-cluster | | Account 123456789012 - DynamoDB Table Point-In-Time Recovery Should Be Enabled | aws.dynamodb-table | | Account 123456789012 - Ensure Redshift Cluster are not publicly accessible | redshift | | Account 123456789012 - Ensure KMS CMK is not marked for deletion | kms-key | | Account 123456789012 - Ensure default security group of any VPC does not allow inbound or outbound traffic | aws.security-group | | Account 123456789012 - Ensure MFA Delete Is Enabled On S3 Buckets | aws.s3 | | Account 123456789012 - API Gateway REST API cache data should be encrypted at rest | rest-stage | | Account 123456789012 - ELBv2 Enabled Drop HTTP Headers | app-elb | | Account 123456789012 - Ensure EFS Encryption is enabled for data at rest | efs | | Account 123456789012 - Sagemaker Notebook Instance Encryption Missing. | aws.sagemaker-notebook | | Account 123456789012 - Ensure Elasticsearch has node to node encryption enabled | aws.elasticsearch | | Account 123456789012 - s3 enable versioning | s3 | | Account 123456789012 - API Gateway REST API Stages should Have AWS X-Ray Tracing Enabled | rest-stage | | Account 123456789012 - Delete unused ELB | elb | | Account 123456789012 - Ensure Redshift Cluster require_ssl is not false | redshift | | Account 123456789012 - Ensure node-to-node encryption feature is enabled for AWS Elasticsearch Service domains | elasticsearch | | Account 123456789012 - Ensure Server access logging is enabled | s3 | | Account 123456789012 - Redshift Cluster Audit Logging Should Be Enabled | aws.redshift | | Account 123456789012 - Ensure CloudTrail is enabled in all regions | aws.cloudtrail | | Account 123456789012 - Ensure AWS lambda tracing is enabled. | aws.lambda | | Account 123456789012 - Ensure hardware MFA is enabled for the root account | account | | Account 123456789012 - Ensure RDS cluster snapshot is not shared with any aws account | rds-cluster-snapshot | | Account 123456789012 - Ensure Elasticache snapshot is not copied to S3 Bucket | cache-snapshot | | Account 123456789012 - Ensure RDS Snapshot is not shared with public | rds-snapshot | | Account 123456789012 - Ensure RDS instances are not publicly accessible | rds | | Account 123456789012 - Ensure bucket settings are proper for public access | s3 | | Account 123456789012 - Ensure AWS Route 53 domains have AutoRenew enabled | r53domain | | Account 123456789012 - S3 Bucket Policy deny Access to Everyone | s3 | | Account 123456789012 - AMI Creation alert | ami | | Account 123456789012 - Ensure AMIs are not shared with public | ami | | Account 123456789012 - Ensure unattached EBS volumes are encrypted | ebs | | Account 123456789012 - Ensure EBS snapshot is not publicly accessible | ebs-snapshot | ed-for-s3-bucket | Account 123456789012 - Ensure Server Side Encryption is enabled | s3 | | Account 123456789012 - S3 Bucket Access Control List Grant Access to Everyone or Authenticated Users | s3 | | Account 123456789012 - Ensure AMI is not shared with any aws account | ami | | Account 123456789012 - Ensure RDS Cluster Snapshot is not shared with public | rds-cluster-snapshot | | Account 123456789012 - Ensure Server access logging is enabled | s3 | | Account 123456789012 - Ensure versioning is enabled for S3 buckets | s3 | | Account 123456789012 - Ensure EBS snapshot is not shared with any aws account | ebs-snapshot | | Account 123456789012 - Ensure Redshift Cluster Snapshot is not shared with another account | redshift-snapshot | | Account 123456789012 - Ensure AWS Route 53 Registered domain has Transfer lock enabled | r53domain | | Ensure public launch permission from AMI are removed | ami | | Account 123456789012 - Ensure RDS snapshot is not shared with any aws account | rds-snapshot | | Account 123456789012 - Ensure MFA must be enabled for all user accounts that have a console password. | aws.iam-user | n-sse-configured | Account 123456789012 - Ensure AWS Kinesis Data Firehose delivery stream with Direct PUT and other sources as source has Server-side encryption configured | firehose | | Account 123456789012 - Ensure bucket settings are proper for public access | s3 | | Account 123456789012 - Ensure that AWS ElastiCache Redis clusters are Data At-Rest encrypted with CMK | elasticache-group | | Account 123456789012 - Classic ELB is using unencrypted protocol | elb | | Account 123456789012 - Ensure AWS ElastiCache Redis cluster with Redis AUTH feature is enabled | elasticache-group | | Account 123456789012 - Ensure Server Side Encryption is enabled | s3 | n-config-has-cmk | Account 123456789012 - Ensure AWS Kinesis Data Firehose delivery stream with Direct PUT and other sources as source has Server-side encryption configured with KMS Customer Managed Keys | firehose | | Account 123456789012 - Ensure default security group of any VPC does not allow inbound or outbound traffic | security-group | | Account 123456789012 - S3 Bucket Access Control List Grant Access to Everyone or Authenticated Users | s3 | | Account 123456789012 - S3 Bucket Policy deny Access to Everyone | s3 | | Account 123456789012 - Ensure that bucket policy enforces encryption in transit | s3 | | Account 123456789012 - Ensure ELB are not using unencrypted protocol | app-elb | | Account 123456789012 - Ensure remove unused security group | security-group | | Account 123456789012 - Ensure that each VPC has VPC FlowLogs enabled | vpc | | Account 123456789012 - Ensure Server Side Encryption is enabled | s3 | | Account 123456789012 - Set log group retention on cloudwatch | log-group |