-
- OCI Tenancy: {tenancy_name if tenancy_name != "unknown" else tenancy_id}
+ OracleCloud Tenancy: {tenancy_name if tenancy_name != "unknown" else tenancy_id}
@@ -1005,7 +1007,7 @@ class HTML(Output):
-
diff --git a/prowler/lib/powershell/powershell.py b/prowler/lib/powershell/powershell.py
index 034d28fa16..8142fa8e45 100644
--- a/prowler/lib/powershell/powershell.py
+++ b/prowler/lib/powershell/powershell.py
@@ -220,18 +220,19 @@ class PowerShellSession:
if output == "":
return {}
- json_match = re.search(r"(\[.*\]|\{.*\})", output, re.DOTALL)
- if not json_match:
- logger.error(
- f"Unexpected PowerShell output: {output}\n",
- )
- else:
+ decoder = json.JSONDecoder()
+ for index, character in enumerate(output):
+ if character not in ("{", "["):
+ continue
try:
- return json.loads(json_match.group(1))
- except json.JSONDecodeError as error:
- logger.error(
- f"Error parsing PowerShell output as JSON: {str(error)}\n",
- )
+ parsed_json, _ = decoder.raw_decode(output[index:])
+ return parsed_json
+ except json.JSONDecodeError:
+ continue
+
+ logger.error(
+ f"Unexpected PowerShell output: {output}\n",
+ )
return {}
diff --git a/prowler/lib/utils/utils.py b/prowler/lib/utils/utils.py
index 0a5787f7a7..c4b29f6cc1 100644
--- a/prowler/lib/utils/utils.py
+++ b/prowler/lib/utils/utils.py
@@ -64,7 +64,7 @@ def open_file(input_file: str, mode: str = "r") -> TextIOWrapper:
except OSError as os_error:
if os_error.strerror == "Too many open files":
logger.critical(
- "Ooops! You reached your user session maximum open files. To solve this issue, increase the shell session limit by running this command `ulimit -n 4096`. For more info visit https://docs.prowler.cloud/en/latest/troubleshooting/"
+ "Ooops! You reached your user session maximum open files. To solve this issue, increase the shell session limit by running this command `ulimit -n 4096`. For more info visit https://docs.prowler.com/troubleshooting/"
)
else:
logger.critical(
diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json
index 6969414824..4a8246fd23 100644
--- a/prowler/providers/aws/aws_regions_by_service.json
+++ b/prowler/providers/aws/aws_regions_by_service.json
@@ -1454,6 +1454,23 @@
]
}
},
+ "bedrock-agentcore": {
+ "regions": {
+ "aws": [
+ "ap-northeast-1",
+ "ap-south-1",
+ "ap-southeast-1",
+ "ap-southeast-2",
+ "eu-central-1",
+ "eu-west-1",
+ "us-east-1",
+ "us-east-2",
+ "us-west-2"
+ ],
+ "aws-cn": [],
+ "aws-us-gov": []
+ }
+ },
"bedrock-data-automation": {
"regions": {
"aws": [
@@ -1555,6 +1572,7 @@
"aws": [
"af-south-1",
"ap-east-1",
+ "ap-east-2",
"ap-northeast-1",
"ap-northeast-2",
"ap-northeast-3",
@@ -1565,6 +1583,8 @@
"ap-southeast-3",
"ap-southeast-4",
"ap-southeast-5",
+ "ap-southeast-6",
+ "ap-southeast-7",
"ca-central-1",
"ca-west-1",
"eu-central-1",
@@ -1578,6 +1598,7 @@
"il-central-1",
"me-central-1",
"me-south-1",
+ "mx-central-1",
"sa-east-1",
"us-east-1",
"us-east-2",
@@ -4584,8 +4605,10 @@
"ap-southeast-2",
"ca-central-1",
"eu-central-1",
+ "eu-south-1",
"eu-west-1",
"eu-west-2",
+ "eu-west-3",
"us-east-1",
"us-east-2",
"us-west-2"
@@ -6967,21 +6990,6 @@
"aws-us-gov": []
}
},
- "lookoutvision": {
- "regions": {
- "aws": [
- "ap-northeast-1",
- "ap-northeast-2",
- "eu-central-1",
- "eu-west-1",
- "us-east-1",
- "us-east-2",
- "us-west-2"
- ],
- "aws-cn": [],
- "aws-us-gov": []
- }
- },
"lumberyard": {
"regions": {
"aws": [
@@ -7261,6 +7269,7 @@
"eu-west-1",
"eu-west-2",
"eu-west-3",
+ "me-central-1",
"me-south-1",
"sa-east-1",
"us-east-1",
@@ -7892,6 +7901,7 @@
"ap-southeast-3",
"ap-southeast-4",
"ap-southeast-5",
+ "ap-southeast-6",
"ap-southeast-7",
"ca-central-1",
"ca-west-1",
@@ -7953,6 +7963,7 @@
"aws": [
"af-south-1",
"ap-east-1",
+ "ap-east-2",
"ap-northeast-1",
"ap-northeast-2",
"ap-northeast-3",
@@ -7963,6 +7974,8 @@
"ap-southeast-3",
"ap-southeast-4",
"ap-southeast-5",
+ "ap-southeast-6",
+ "ap-southeast-7",
"ca-central-1",
"ca-west-1",
"eu-central-1",
@@ -7976,6 +7989,7 @@
"il-central-1",
"me-central-1",
"me-south-1",
+ "mx-central-1",
"sa-east-1",
"us-east-1",
"us-east-2",
@@ -9799,6 +9813,20 @@
]
}
},
+ "rtbfabric": {
+ "regions": {
+ "aws": [
+ "ap-northeast-1",
+ "ap-southeast-1",
+ "eu-central-1",
+ "eu-west-1",
+ "us-east-1",
+ "us-west-2"
+ ],
+ "aws-cn": [],
+ "aws-us-gov": []
+ }
+ },
"rum": {
"regions": {
"aws": [
diff --git a/prowler/providers/aws/lib/quick_inventory/quick_inventory.py b/prowler/providers/aws/lib/quick_inventory/quick_inventory.py
index cb2a9b5e77..8e7bc6e450 100644
--- a/prowler/providers/aws/lib/quick_inventory/quick_inventory.py
+++ b/prowler/providers/aws/lib/quick_inventory/quick_inventory.py
@@ -297,7 +297,7 @@ def create_output(resources: list, provider: AwsProvider, args):
csv_file.close()
print(
- f"\n{Fore.YELLOW}WARNING: Only resources that have or have had tags will appear (except for IAM and S3).\nSee more in https://docs.prowler.cloud/en/latest/tutorials/quick-inventory/#objections{Style.RESET_ALL}"
+ f"\n{Fore.YELLOW}WARNING: Only resources that have or have had tags will appear (except for IAM and S3).\nSee more in https://docs.prowler.com/user-guide/cli/tutorials/quick-inventory/#objections{Style.RESET_ALL}"
)
print("\nMore details in files:")
print(f" - CSV: {args.output_directory}/{output_file + csv_file_suffix}")
diff --git a/prowler/providers/aws/lib/security_hub/security_hub.py b/prowler/providers/aws/lib/security_hub/security_hub.py
index 2553c4720f..5386d88c23 100644
--- a/prowler/providers/aws/lib/security_hub/security_hub.py
+++ b/prowler/providers/aws/lib/security_hub/security_hub.py
@@ -256,7 +256,7 @@ class SecurityHub:
security_hub_client.list_enabled_products_for_import()
):
logger.warning(
- f"Security Hub is enabled in {region} but Prowler integration does not accept findings. More info: https://docs.prowler.cloud/en/latest/tutorials/aws/securityhub/"
+ f"Security Hub is enabled in {region} but Prowler integration does not accept findings. More info: https://docs.prowler.com/user-guide/providers/aws/securityhub#aws-security-hub-integration-with-prowler"
)
return region, None
else:
diff --git a/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.metadata.json b/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.metadata.json
index f5e9856ebf..b0fdb77a47 100644
--- a/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.metadata.json
+++ b/prowler/providers/aws/services/awslambda/awslambda_function_using_supported_runtimes/awslambda_function_using_supported_runtimes.metadata.json
@@ -32,9 +32,7 @@
"Url": "https://hub.prowler.com/check/awslambda_function_using_supported_runtimes"
}
},
- "Categories": [
- "container-security"
- ],
+ "Categories": [],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json
index eb8b780511..0ee1edebc7 100644
--- a/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json
+++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json
@@ -1,29 +1,40 @@
{
"Provider": "aws",
"CheckID": "documentdb_cluster_backup_enabled",
- "CheckTitle": "Check if DocumentDB Clusters have backup enabled.",
- "CheckType": [],
+ "CheckTitle": "DocumentDB cluster has automated backups enabled with retention period of at least 7 days",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Effects/Data Destruction"
+ ],
"ServiceName": "documentdb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsRdsDbCluster",
- "Description": "Check if DocumentDB Clusters have backup enabled.",
- "Risk": "Ensure that your Amazon DocumentDB database clusters have set a minimum backup retention period in order to achieve compliance requirements in your organization.",
- "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-2",
+ "Description": "**Amazon DocumentDB clusters** are evaluated for **automated backups** and an adequate **backup retention period**. Clusters should have `backup_retention_period` set to at least the configured minimum (default `7` days). Values of `0` indicate backups are disabled; values below the threshold are considered insufficient.",
+ "Risk": "Without adequate backups, clusters can't be reliably restored. Accidental deletes, logical corruption, or ransomware may cause irreversible data loss once a short retention window expires, leading to prolonged outages, missed RPO/RTO, and limited ability to roll back malicious or erroneous changes.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.amazonaws.cn/en_us/documentdb/latest/developerguide/what-is.html",
+ "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#",
+ "https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/aws-enabledocdbclusterbackupretentionperiod.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws docdb modify-db-cluster --region --db-cluster-identifier --backup-retention-period 7 --apply-immediately",
- "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#",
- "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#",
- "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/sufficient-backup-retention-period.html#"
+ "CLI": "aws docdb modify-db-cluster --db-cluster-identifier --backup-retention-period 7 --apply-immediately",
+ "NativeIaC": "```yaml\n# CloudFormation: Set DocumentDB backup retention to at least 7 days\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n BackupRetentionPeriod: 7 # CRITICAL: enables automated backups and sets retention to >=7 days\n```",
+ "Other": "1. Open the Amazon DocumentDB console\n2. Go to Clusters and select \n3. Click Modify\n4. Set Backup retention period to 7 (or higher)\n5. Check Apply immediately\n6. Click Continue and then Modify cluster",
+ "Terraform": "```hcl\n# Terraform: Ensure DocumentDB backup retention is at least 7 days\nresource \"aws_docdb_cluster\" \"\" {\n cluster_identifier = \"\"\n backup_retention_period = 7 # CRITICAL: enables automated backups and sets retention to >=7 days\n}\n```"
},
"Recommendation": {
- "Text": "Enable automated backup for production data. Define a retention period and periodically test backup restoration. A Disaster Recovery process should be in place to govern Data Protection approach.",
- "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-2"
+ "Text": "Enable **automated backups** and set retention to meet RPO/RTO (typically `7-35` days).\n- Regularly test point-in-time restores\n- Apply **least privilege** to backup/snapshot management\n- Protect backup artifacts and define stable backup windows\n- Include restores in a tested **disaster recovery** plan",
+ "Url": "https://hub.prowler.com/check/documentdb_cluster_backup_enabled"
}
},
- "Categories": [],
+ "Categories": [
+ "resilience"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json
index 5341ee202f..7debb166f9 100644
--- a/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json
+++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_cloudwatch_log_export/documentdb_cluster_cloudwatch_log_export.metadata.json
@@ -1,29 +1,39 @@
{
"Provider": "aws",
"CheckID": "documentdb_cluster_cloudwatch_log_export",
- "CheckTitle": "Check if DocumentDB clusters are using the log export feature.",
- "CheckType": [],
+ "CheckTitle": "DocumentDB cluster exports audit and profiler logs to CloudWatch Logs",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+ ],
"ServiceName": "documentdb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsRdsDbCluster",
- "Description": "Check if DocumentDB clusters are using the log export feature.",
- "Risk": "Ensure that all your Amazon DocumentDB clusters are using the Log Exports feature in order to publish audit logs directly to CloudWatch Logs. The events recorded by Log Exports include events such as successful and failed authentication attempts, creating indexes, or dropping collections in DocumentDB databases.",
- "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4",
+ "Description": "Amazon DocumentDB clusters are evaluated for exporting `audit` and `profiler` logs to **CloudWatch Logs**.\nClusters missing one or both log types are identified as lacking complete log export configuration.",
+ "Risk": "Missing **audit** and/or **profiler** exports reduces observability of authentication, authorization, and data definition activity.\nAttacks like brute-force logins, privilege abuse, or destructive schema changes can go unnoticed, degrading **confidentiality** and **integrity** and delaying incident response.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DocumentDB/enable-profiler.html",
+ "https://docs.aws.amazon.com/cli/latest/reference/docdb/create-db-cluster.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws docdb modify-db-cluster --region --db-cluster-identifier --db-cluster-parameter-group-name --cloudwatch-logs-export-configuration '{EnableLogTypes:[profiler]}' --apply-immediately",
- "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/enable-profiler.html",
- "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/enable-profiler.html",
- "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/enable-profiler.html"
+ "CLI": "aws docdb modify-db-cluster --db-cluster-identifier --cloudwatch-logs-export-configuration '{\"EnableLogTypes\":[\"audit\",\"profiler\"]}' --apply-immediately",
+ "NativeIaC": "```yaml\n# CloudFormation: enable DocumentDB log exports\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n EnableCloudwatchLogsExports:\n - audit # Critical: export audit logs to CloudWatch Logs\n - profiler # Critical: export profiler logs to CloudWatch Logs\n```",
+ "Other": "1. In AWS Console, go to Amazon DocumentDB > Clusters\n2. Select the cluster and choose Actions > Modify\n3. In Log exports, check Audit and Profiler\n4. Check Apply immediately and click Modify cluster",
+ "Terraform": "```hcl\n# Enable DocumentDB log exports\nresource \"aws_docdb_cluster\" \"\" {\n enabled_cloudwatch_logs_exports = [\"audit\", \"profiler\"] # Critical: export both logs to CloudWatch Logs\n}\n```"
},
"Recommendation": {
- "Text": "Enabled DocumentDB Log export functionality to analyze, monitor, and archive auditing events for security and compliance requirements.",
- "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-4"
+ "Text": "Enable export of both `audit` and `profiler` logs to **CloudWatch Logs** for all clusters and centralize analysis.\nApply **least privilege** to log access, define retention and immutability, integrate with alerting, and use **separation of duties** to protect and regularly review logs for **defense in depth**.",
+ "Url": "https://hub.prowler.com/check/documentdb_cluster_cloudwatch_log_export"
}
},
- "Categories": [],
+ "Categories": [
+ "logging"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json
index 2ae338a208..c9df9532d4 100644
--- a/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json
+++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_deletion_protection/documentdb_cluster_deletion_protection.metadata.json
@@ -1,29 +1,40 @@
{
"Provider": "aws",
"CheckID": "documentdb_cluster_deletion_protection",
- "CheckTitle": "Check if DocumentDB Clusters has deletion protection enabled.",
- "CheckType": [],
+ "CheckTitle": "DocumentDB cluster has deletion protection enabled",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+ ],
"ServiceName": "documentdb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsRdsDbCluster",
- "Description": "Check if DocumentDB Clusters has deletion protection enabled.",
- "Risk": "Enabling cluster deletion protection offers an additional layer of protection against accidental database deletion or deletion by an unauthorized user. A DocumentDB cluster can't be deleted while deletion protection is enabled. You must first disable deletion protection before a delete request can succeed.",
- "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5",
+ "Description": "**Amazon DocumentDB clusters** are evaluated for the `deletion_protection` setting on the cluster configuration.\n\nThe finding highlights clusters where this protection is not enabled.",
+ "Risk": "Without **deletion protection**, clusters can be deleted by mistake or misuse, causing sudden outage and loss of recovery points, impacting **availability** and **data integrity**.\n\nCompromised accounts or faulty automation can remove databases or skip final snapshots, hindering restoration.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://support.icompaas.com/support/solutions/articles/62000233689-ensure-documentdb-clusters-has-deletion-protection-enabled",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/DocumentDB/deletion-protection.html",
+ "https://docs.aws.amazon.com/documentdb/latest/developerguide/db-cluster-delete.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws aws docdb modify-db-cluster --region --db-cluster-identifier --deletion-protection --apply-immediately",
- "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/deletion-protection.html#",
- "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/deletion-protection.html#",
- "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/DocumentDB/deletion-protection.html#"
+ "CLI": "aws docdb modify-db-cluster --db-cluster-identifier --deletion-protection --apply-immediately",
+ "NativeIaC": "```yaml\n# CloudFormation: Enable deletion protection on a DocumentDB cluster\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n MasterUsername: \"\"\n MasterUserPassword: \"\"\n DeletionProtection: true # CRITICAL: Prevents cluster deletion until disabled\n```",
+ "Other": "1. In the AWS Console, go to Amazon DocumentDB > Clusters\n2. Select the target cluster and click Modify\n3. Enable Deletion protection\n4. Check Apply immediately and click Save changes",
+ "Terraform": "```hcl\n# Terraform: Enable deletion protection on a DocumentDB cluster\nresource \"aws_docdb_cluster\" \"\" {\n master_username = \"\"\n master_password = \"\"\n deletion_protection = true # CRITICAL: Prevents cluster deletion until disabled\n}\n```"
},
"Recommendation": {
- "Text": "Enable deletion protection for production DocumentDB Clusters.",
- "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-5"
+ "Text": "Enable **deletion protection** on all non-ephemeral clusters, prioritizing production.\n\nEnforce **least privilege** for delete and modify actions, require change control to toggle protection, and implement **defense in depth** with automation that continuously enforces this setting. *Before decommissioning*, take a final snapshot.",
+ "Url": "https://hub.prowler.com/check/documentdb_cluster_deletion_protection"
}
},
- "Categories": [],
+ "Categories": [
+ "resilience"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json
index 0f3d519070..76f98e77b8 100644
--- a/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json
+++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_multi_az_enabled/documentdb_cluster_multi_az_enabled.metadata.json
@@ -1,30 +1,36 @@
{
"Provider": "aws",
"CheckID": "documentdb_cluster_multi_az_enabled",
- "CheckTitle": "Ensure DocumentDB Cluster have Multi-AZ enabled.",
- "CheckType": [],
+ "CheckTitle": "DocumentDB cluster has Multi-AZ enabled",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices"
+ ],
"ServiceName": "documentdb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsRdsDbCluster",
- "Description": "Ensure DocumentDB Cluster have Multi-AZ enabled.",
- "Risk": "Ensure that your Amazon DocumentDB Clusters are using Multi-AZ deployment configurations to provide High Availability (HA) through automatic failover to standby replicas in the event of a failure such as an Availability Zone (AZ) outage, an internal hardware or network outage, a software failure or in case of a planned maintenance session.",
- "RelatedUrl": "https://docs.aws.amazon.com/documentdb/latest/developerguide/failover.html",
+ "Description": "**Amazon DocumentDB clusters** with **Multi-AZ** (`multi_az`) indicate deployment of a primary and one or more replicas across Availability Zones.",
+ "Risk": "Without Multi-AZ, the cluster depends on a single AZ/instance. An AZ or node failure-or maintenance-can stop reads and writes, causing downtime, timeouts, and SLA breaches. Availability degrades, RTO rises, and applications may experience failed or retried transactions until replacement capacity is created.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/documentdb/latest/developerguide/failover.html",
+ "https://support.icompaas.com/support/solutions/articles/62000233690-ensure-documentdb-cluster-have-multi-az-enabled"
+ ],
"Remediation": {
"Code": {
- "CLI": "",
- "NativeIaC": "",
- "Other": "",
- "Terraform": ""
+ "CLI": "aws docdb create-db-instance --db-instance-identifier --db-cluster-identifier --db-instance-class --engine docdb --availability-zone ",
+ "NativeIaC": "```yaml\n# CloudFormation: add a replica to enable Multi-AZ for an existing DocumentDB cluster\nResources:\n DocDBReplica:\n Type: AWS::DocDB::DBInstance\n Properties:\n DBClusterIdentifier: \"\" # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ\n DBInstanceClass: \"\"\n AvailabilityZone: \"\" # CRITICAL: place in a different AZ to provide Multi-AZ failover\n```",
+ "Other": "1. In the AWS Console, go to Amazon DocumentDB and open your cluster\n2. Click Create instance\n3. Set Instance class and choose an Availability Zone different from the primary\n4. Click Create to add the replica\n5. Verify the cluster now shows Multi-AZ enabled",
+ "Terraform": "```hcl\n# Add a replica to enable Multi-AZ for an existing DocumentDB cluster\nresource \"aws_docdb_cluster_instance\" \"\" {\n cluster_identifier = \"\" # CRITICAL: adds a new instance to the cluster to achieve Multi-AZ\n instance_class = \"\"\n availability_zone = \"\" # CRITICAL: different AZ ensures Multi-AZ failover\n}\n```"
},
"Recommendation": {
- "Text": "Enable Multi-AZ for all DocumentDB Clusters.",
- "Url": "https://docs.aws.amazon.com/documentdb/latest/developerguide/failover.html"
+ "Text": "Enable **Multi-AZ** for DocumentDB and distribute instances across distinct AZs.\n- Maintain at least one replica\n- Set promotion priorities to guide failover\n- Test failover regularly and use resilient client retries\n\nThis builds **fault tolerance** and preserves service availability.",
+ "Url": "https://hub.prowler.com/check/documentdb_cluster_multi_az_enabled"
}
},
"Categories": [
- "redundancy"
+ "resilience"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json
index 46c214d8e9..4beaa85ace 100644
--- a/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json
+++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_public_snapshot/documentdb_cluster_public_snapshot.metadata.json
@@ -1,26 +1,36 @@
{
"Provider": "aws",
"CheckID": "documentdb_cluster_public_snapshot",
- "CheckTitle": "Check if DocumentDB manual cluster snapshot is public.",
- "CheckType": [],
+ "CheckTitle": "DocumentDB manual cluster snapshot is not shared publicly",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Effects/Data Exposure",
+ "TTPs/Initial Access"
+ ],
"ServiceName": "documentdb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "critical",
"ResourceType": "AwsRdsDbClusterSnapshot",
- "Description": "Check if DocumentDB manual cluster snapshot is public.",
- "Risk": "If you share an unencrypted manual snapshot as public, the snapshot is available to all AWS accounts. Public snapshots may result in unintended data exposure.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/docdb-cluster-snapshot-public-prohibited.html",
+ "Description": "**Amazon DocumentDB** manual cluster snapshot visibility is evaluated to detect snapshots marked as **public** instead of limited to specified AWS accounts.",
+ "Risk": "**Public snapshots** weaken **confidentiality**: any AWS account can restore and read database contents, enabling data exfiltration.\n\nThey also aid **lateral movement** by revealing embedded secrets/config and reduce accountability when restores occur outside your account.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3",
+ "https://docs.aws.amazon.com/config/latest/developerguide/docdb-cluster-snapshot-public-prohibited.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws docdb modify-db-snapshot-attribute --db-snapshot-identifier --attribute-name restore --values-to-remove all",
+ "CLI": "aws docdb modify-db-cluster-snapshot-attribute --db-cluster-snapshot-identifier --attribute-name restore --values-to-remove all",
"NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-3",
+ "Other": "1. Open the Amazon DocumentDB console and go to Snapshots\n2. Select the public manual cluster snapshot\n3. Click Actions > Share\n4. Set DB snapshot visibility to Private (remove \"all\" if listed)\n5. Click Save",
"Terraform": ""
},
"Recommendation": {
- "Text": "To remove public access from a manual snapshot, follow the Sharing a snapshot tutorial.",
- "Url": "https://docs.aws.amazon.com/documentdb/latest/developerguide/backup_restore-share_cluster_snapshots.html#backup_restore-share_snapshots"
+ "Text": "Keep snapshot visibility `Private` and share only with trusted accounts under **least privilege**. Prefer **CMEK encryption** to enforce key-based access and prevent public sharing. Periodically review sharing lists, restrict IAM permissions that alter visibility, and monitor for exposure as **defense in depth**.",
+ "Url": "https://hub.prowler.com/check/documentdb_cluster_public_snapshot"
}
},
"Categories": [
diff --git a/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json b/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json
index 8e26bf67df..bf3af04b2a 100644
--- a/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json
+++ b/prowler/providers/aws/services/documentdb/documentdb_cluster_storage_encrypted/documentdb_cluster_storage_encrypted.metadata.json
@@ -1,31 +1,44 @@
{
"Provider": "aws",
"CheckID": "documentdb_cluster_storage_encrypted",
- "CheckTitle": "Check if DocumentDB cluster storage is encrypted.",
+ "CheckTitle": "DocumentDB cluster storage is encrypted at rest",
"CheckType": [
- "Data Protection"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
+ "Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)",
+ "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
+ "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls",
+ "Effects/Data Exposure"
],
"ServiceName": "documentdb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsRdsDbCluster",
- "Description": "Check if DocumentDB cluster storage is encrypted.",
- "Risk": "Ensure that encryption of data at rest is enabled for your Amazon DocumentDB (with MongoDB compatibility) database clusters for additional data security and regulatory compliance.",
- "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-1",
+ "Description": "**Amazon DocumentDB clusters** are assessed for **storage encryption at rest** via the cluster's `encrypted` setting.\n\nIt identifies clusters where data volumes, automated backups, and snapshots aren't protected by AWS KMS-managed encryption.",
+ "Risk": "Without at-rest encryption, cluster data, snapshots, and backups can be read in plaintext if copies are leaked, mis-shared, or underlying storage is accessed. This harms **confidentiality**, enables offline analysis and data exfiltration, and widens the blast radius of insider or backup repository compromise.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-1",
+ "https://docs.aws.amazon.com/documentdb/latest/developerguide/elastic-encryption.html",
+ "https://docs.aws.amazon.com/documentdb/latest/developerguide/encryption-at-rest.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws docdb create-db-cluster --db-cluster-identifier --port --engine docdb --master-username --master-user-password --storage-encrypted",
- "NativeIaC": "",
- "Other": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_28/",
- "Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_28#fix-buildtime"
+ "CLI": "aws docdb create-db-cluster --db-cluster-identifier --engine docdb --master-username --master-user-password --storage-encrypted",
+ "NativeIaC": "```yaml\n# CloudFormation: Create an encrypted DocumentDB cluster\nResources:\n :\n Type: AWS::DocDB::DBCluster\n Properties:\n Engine: docdb\n MasterUsername: \n MasterUserPassword: \n StorageEncrypted: true # Critical: enables encryption at rest to pass the check\n```",
+ "Other": "1. In the AWS Console, go to Amazon DocumentDB\n2. Click Create cluster\n3. Expand Show advanced settings\n4. In Encryption-at-rest, select Enable encryption\n5. Choose or keep the default KMS key\n6. Click Create cluster\n\nTo replace an existing unencrypted cluster:\n1. Select the unencrypted cluster > Actions > Take snapshot\n2. After the snapshot completes, select it > Actions > Restore snapshot\n3. In Encryption-at-rest, select Enable encryption and restore as a new cluster\n4. Update your applications to use the new cluster endpoint",
+ "Terraform": "```hcl\n# Terraform: Encrypted DocumentDB cluster\nresource \"aws_docdb_cluster\" \"\" {\n master_username = \"\"\n master_password = \"\"\n storage_encrypted = true # Critical: enables encryption at rest to pass the check\n}\n```"
},
"Recommendation": {
- "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.",
- "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/documentdb-controls.html#documentdb-1"
+ "Text": "Enable **storage encryption at rest** for all DocumentDB clusters and prefer **customer-managed KMS keys** for control over access, rotation, and revocation. Apply **least privilege** to key usage, enforce **separation of duties**, and monitor key and snapshot access. *If a cluster isn't encrypted*, migrate to a new encrypted cluster.",
+ "Url": "https://hub.prowler.com/check/documentdb_cluster_storage_encrypted"
}
},
- "Categories": [],
+ "Categories": [
+ "encryption"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.metadata.json b/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.metadata.json
index 3055d2263b..b0dda79381 100644
--- a/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.metadata.json
+++ b/prowler/providers/aws/services/ecr/ecr_registry_scan_images_on_push_enabled/ecr_registry_scan_images_on_push_enabled.metadata.json
@@ -1,32 +1,37 @@
{
"Provider": "aws",
"CheckID": "ecr_registry_scan_images_on_push_enabled",
- "CheckTitle": "Check if ECR Registry has scan on push enabled",
+ "CheckTitle": "ECR registry has image scanning on push enabled for all repositories",
"CheckType": [
- "Identify",
- "Vulnerability, patch, and version management"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
],
"ServiceName": "ecr",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:ecr:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "Other",
- "Description": "Check if ECR Registry has scan on push enabled",
- "Risk": "Amazon ECR image scanning helps in identifying software vulnerabilities in your container images. Amazon ECR uses the Common Vulnerabilities and Exposures (CVEs) database from the open-source Clair project and provides a list of scan findings. ",
+ "Description": "Amazon ECR registries with repositories are evaluated for image scanning configured as `scan on push` at the registry level, with scan rules that cover all repositories (no restrictive filters), for either **basic** or **enhanced** scanning.",
+ "Risk": "Absent or filtered `scan on push` lets **vulnerable images** be pushed and deployed without timely detection, enabling exploitation of known CVEs (RCE, privilege escalation), supply chain compromise, and lateral movement - threatening workload integrity and data confidentiality.",
"RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html"
+ ],
"Remediation": {
"Code": {
"CLI": "aws ecr put-registry-scanning-configuration --rules 'scanFrequency=SCAN_ON_PUSH,repositoryFilters=[{filter=string,filterType=WILDCARD}]'",
"NativeIaC": "",
- "Other": "",
- "Terraform": ""
+ "Other": "1. Open the AWS Management Console and go to Amazon ECR\n2. In the left menu, click Account settings (or Settings), then find Registry scanning\n3. Click Edit\n4. Set Scanning type to Enhanced scanning\n5. Enable Scan on push\n6. Under Repository filters, set Filter type to WILDCARD and Filter to *\n7. Click Save",
+ "Terraform": "```hcl\nresource \"aws_ecr_registry_scanning_configuration\" \"\" {\n scan_type = \"ENHANCED\"\n\n rule {\n scan_frequency = \"SCAN_ON_PUSH\" # Ensures scan on push\n repository_filter {\n filter = \"*\" # Applies to all repositories\n filter_type = \"WILDCARD\"\n }\n }\n}\n```"
},
"Recommendation": {
- "Text": "Enable ECR image scanning and review the scan findings for information about the security of the container images that are being deployed.",
- "Url": "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html"
+ "Text": "Enable registry-wide `scan on push` and ensure rules apply to all repositories (no filters). Prefer **enhanced scanning** for broader coverage, and pair with continuous scans when available. Integrate findings into CI/CD gates and alerts to enforce **defense in depth** and block promotion of risky images.",
+ "Url": "https://hub.prowler.com/check/ecr_registry_scan_images_on_push_enabled"
}
},
- "Categories": [],
+ "Categories": [
+ "container-security"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.metadata.json b/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.metadata.json
index d76e3520dc..7dc472ce85 100644
--- a/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.metadata.json
+++ b/prowler/providers/aws/services/ecr/ecr_repositories_lifecycle_policy_enabled/ecr_repositories_lifecycle_policy_enabled.metadata.json
@@ -1,32 +1,41 @@
{
"Provider": "aws",
"CheckID": "ecr_repositories_lifecycle_policy_enabled",
- "CheckTitle": "Check if ECR repositories have lifecycle policies enabled",
+ "CheckTitle": "ECR repository has a lifecycle policy configured",
"CheckType": [
- "Identify",
- "Resource configuration"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Effects/Resource Consumption"
],
"ServiceName": "ecr",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "low",
"ResourceType": "AwsEcrRepository",
- "Description": "Check if ECR repositories have lifecycle policies enabled",
- "Risk": "Amazon ECR repositories run the risk of retaining huge volumes of images, increasing unnecessary cost.",
+ "Description": "Amazon ECR repositories have a **lifecycle policy** configured to automatically expire container images based on age, count, or tags.",
+ "Risk": "Without **lifecycle policies**, images accumulate indefinitely, leading to:\n- **Availability** issues when quotas block pushes and CI/CD\n- **Integrity** risk from redeploying outdated, vulnerable images\n- **Cost** growth from unnecessary storage",
"RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/LifecyclePolicies.html",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/lp_creation.html",
+ "https://aws.plainenglish.io/automation-deletion-untagged-container-image-in-amazon-ecr-using-ecr-lifecycle-policy-995eae2f5b8d",
+ "https://blog.stackademic.com/title-implementing-lifecycle-policies-in-aws-ecr-a-practical-guide-3860b612b477",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ECR/lifecycle-policy-in-use.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecr put-lifecycle-policy --repository-name --lifecycle-policy-text [--registry-id ]",
- "NativeIaC": "",
- "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ECR/lifecycle-policy-in-use.html",
- "Terraform": ""
+ "CLI": "aws ecr put-lifecycle-policy --repository-name --lifecycle-policy-text '{\"rules\":[{\"rulePriority\":1,\"selection\":{\"tagStatus\":\"untagged\",\"countType\":\"imageCountMoreThan\",\"countNumber\":1},\"action\":{\"type\":\"expire\"}}]}'",
+ "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::ECR::Repository\n Properties:\n # Critical: Adding a lifecycle policy makes the repo PASS this check\n LifecyclePolicy:\n # Critical: The policy content; any valid rule satisfies the requirement\n LifecyclePolicyText: >-\n {\"rules\":[{\"rulePriority\":1,\"selection\":{\"tagStatus\":\"untagged\",\"countType\":\"imageCountMoreThan\",\"countNumber\":1},\"action\":{\"type\":\"expire\"}}]}\n```",
+ "Other": "1. Open the AWS Console and go to Amazon ECR > Repositories\n2. Select the target repository\n3. From Actions, choose \"Lifecycle policies\"\n4. Click \"Create rule\"\n5. Set Image status: Untagged, Match criteria: Image count more than = 1, Action: Expire\n6. Click \"Save\" to apply the lifecycle policy",
+ "Terraform": "```hcl\nresource \"aws_ecr_lifecycle_policy\" \"\" {\n repository = \"\"\n # Critical: The policy ensures a lifecycle policy is configured for the repo\n policy = <",
+ "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::ECR::Repository\n Properties:\n RepositoryPolicyText:\n Version: \"2012-10-17\"\n Statement:\n - Effect: Allow\n Principal:\n AWS: \"arn:aws:iam:::root\" # Critical: restricts access to a specific AWS account; removes public (*) access\n Action: \"ecr:*\"\n```",
+ "Other": "1. In the AWS Console, go to Amazon ECR > Repositories\n2. Select the repository\n3. Open the Permissions tab and click Edit\n4. Remove any statement with Principal set to \"*\", or replace it with specific AWS ARN(s) (e.g., arn:aws:iam:::root)\n5. Save changes",
+ "Terraform": "```hcl\nresource \"aws_ecr_repository_policy\" \"\" {\n repository = \"\"\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { AWS = \"arn:aws:iam:::root\" } # Critical: restricts access to a specific AWS principal; removes public (*) access\n Action = \"ecr:*\"\n }]\n })\n}\n```"
},
"Recommendation": {
- "Text": "Ensure the repository and its contents are not publicly accessible",
- "Url": "https://docs.aws.amazon.com/AmazonECR/latest/public/security_iam_service-with-iam.html"
+ "Text": "Apply **least privilege** to repository policies:\n- Avoid `Principal:\"*\"` and block anonymous access\n- Grant minimal actions to specific accounts/roles\n- Require authenticated pulls/pushes via IAM\n- Use **private connectivity** (e.g., VPC endpoints)\n- Add **defense in depth** with image scanning and signing",
+ "Url": "https://hub.prowler.com/check/ecr_repositories_not_publicly_accessible"
}
},
"Categories": [
- "internet-exposed"
+ "internet-exposed",
+ "container-security"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.metadata.json b/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.metadata.json
index 5307cb7c3e..120b6c6dff 100644
--- a/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.metadata.json
+++ b/prowler/providers/aws/services/ecr/ecr_repositories_scan_images_on_push_enabled/ecr_repositories_scan_images_on_push_enabled.metadata.json
@@ -1,32 +1,40 @@
{
"Provider": "aws",
"CheckID": "ecr_repositories_scan_images_on_push_enabled",
- "CheckTitle": "[DEPRECATED] Check if ECR image scan on push is enabled",
+ "CheckTitle": "[DEPRECATED] ECR repository has image scanning on push enabled",
"CheckType": [
- "Identify",
- "Vulnerability, patch, and version management"
+ "Software and Configuration Checks/Vulnerabilities/CVE",
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
],
"ServiceName": "ecr",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsEcrRepository",
- "Description": "[DEPRECATED] Check if ECR image scan on push is enabled",
- "Risk": "Amazon ECR image scanning helps in identifying software vulnerabilities in your container images. Amazon ECR uses the Common Vulnerabilities and Exposures (CVEs) database from the open-source Clair project and provides a list of scan findings. ",
+ "Description": "[DEPRECATED]\n**Amazon ECR repositories** are evaluated for **image scanning on push**; when configured, new image uploads automatically trigger a vulnerability scan (`scan_on_push`).",
+ "Risk": "Without **scan on push**, images with known CVEs can enter registries and reach runtime unnoticed, undermining **integrity** and **confidentiality** through exploitable packages. Attackers may achieve code execution and lateral movement. Delayed detection increases operational risk and extends remediation timelines.",
"RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ECR/scan-on-push.html",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic-enabling.html",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecr create-repository --repository-name --image-scanning-configuration scanOnPush=true--region ",
- "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_8#cli-command",
- "Other": "",
- "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_8#fix---buildtime"
+ "CLI": "aws ecr put-image-scanning-configuration --repository-name --image-scanning-configuration scanOnPush=true",
+ "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::ECR::Repository\n Properties:\n ImageScanningConfiguration:\n ScanOnPush: true # Critical: enables image scanning on push for this repository\n```",
+ "Other": "1. Open the AWS Console and go to Amazon ECR\n2. Click Repositories and select the target repository\n3. Click Edit\n4. Enable the Scan on push toggle\n5. Click Save",
+ "Terraform": "```hcl\nresource \"aws_ecr_repository\" \"\" {\n name = \"\"\n\n image_scanning_configuration {\n scan_on_push = true # Critical: enables scanning on image push\n }\n}\n```"
},
"Recommendation": {
- "Text": "Enable ECR image scanning and review the scan findings for information about the security of the container images that are being deployed.",
- "Url": "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html"
+ "Text": "Enable **image scanning on push** (`scan_on_push`) for all repositories and use findings as promotion gates. Prefer **continuous/enhanced scanning** for defense in depth, set severity thresholds, and block or quarantine noncompliant images. Integrate results with CI/CD and adopt **shift-left** vulnerability management.",
+ "Url": "https://hub.prowler.com/check/ecr_repositories_scan_images_on_push_enabled"
}
},
- "Categories": [],
+ "Categories": [
+ "container-security"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.metadata.json b/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.metadata.json
index 5f786129f2..ab7d6cd04e 100644
--- a/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.metadata.json
+++ b/prowler/providers/aws/services/ecr/ecr_repositories_scan_vulnerabilities_in_latest_image/ecr_repositories_scan_vulnerabilities_in_latest_image.metadata.json
@@ -1,32 +1,42 @@
{
"Provider": "aws",
"CheckID": "ecr_repositories_scan_vulnerabilities_in_latest_image",
- "CheckTitle": "Check if ECR image scan found vulnerabilities in the newest image version",
+ "CheckTitle": "ECR repository latest image is scanned with no vulnerabilities at or above the configured minimum severity",
"CheckType": [
- "Identify",
- "Vulnerability, patch, and version management"
+ "Software and Configuration Checks/Vulnerabilities/CVE",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
],
"ServiceName": "ecr",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsEcrRepository",
- "Description": "Check if ECR image scan found vulnerabilities in the newest image version",
- "Risk": "Amazon ECR image scanning helps in identifying software vulnerabilities in your container images. Amazon ECR uses the Common Vulnerabilities and Exposures (CVEs) database from the open-source Clair project and provides a list of scan findings.",
+ "Description": "**Amazon ECR repositories** are assessed on the most recent pushed image to confirm a vulnerability scan exists, completed successfully, and that no results meet or exceed the configured minimum severity (e.g., `CRITICAL`, `HIGH`, `MEDIUM`).",
+ "Risk": "Unscanned or high-severity findings in container images expose workloads to exploitation of known CVEs.\n\nAttackers can gain code execution, exfiltrate data, alter services, or disrupt operations, enabling **lateral movement** and supply-chain compromise-impacting **confidentiality**, **integrity**, and **availability**.",
"RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://www.geeksforgeeks.org/devops/how-to-manage-image-security-and-vulnerabilities-in-ecr/",
+ "https://aws.amazon.com/blogs/aws/amazon-inspector-enhances-container-security-by-mapping-amazon-ecr-images-to-running-containers/",
+ "https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-enhanced.html",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic.html"
+ ],
"Remediation": {
"Code": {
"CLI": "",
- "NativeIaC": "",
- "Other": "",
- "Terraform": ""
+ "NativeIaC": "```yaml\n# Enable scan on push so the latest image is automatically scanned\nResources:\n EcrRepository:\n Type: AWS::ECR::Repository\n Properties:\n RepositoryName: \n ImageScanningConfiguration:\n ScanOnPush: true # CRITICAL: ensures each pushed image is scanned so the latest has scan results\n```",
+ "Other": "1. In the AWS Console, go to ECR > Repositories > \n2. Click Edit and enable Scan on push, then Save\n3. Rebuild the container image to remove vulnerabilities and push a new tag to the repository\n4. Open the image details and click Scan image (if not auto-scanned)\n5. Confirm Findings show 0 vulnerabilities at or above the required severity",
+ "Terraform": "```hcl\n# Enable scan on push so the latest image is automatically scanned\nresource \"aws_ecr_repository\" \"\" {\n name = \"\"\n\n image_scanning_configuration {\n scan_on_push = true # CRITICAL: ensures each pushed image is scanned so the latest has scan results\n }\n}\n```"
},
"Recommendation": {
- "Text": "Open the Amazon ECR console. Then look for vulnerabilities and fix them.",
- "Url": "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html#describe-scan-findings"
+ "Text": "Enable **continuous scanning** for repositories and enforce deployment gates at your policy threshold (e.g., `MEDIUM`+).\n\nRebuild images with patched components and updated bases, keep images minimal, and apply **least privilege**. Use **image signing** and CI/CD checks so only scanned, compliant images can run.",
+ "Url": "https://hub.prowler.com/check/ecr_repositories_scan_vulnerabilities_in_latest_image"
}
},
- "Categories": [],
+ "Categories": [
+ "container-security"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.metadata.json b/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.metadata.json
index 99eb6a7fa0..b5cca3cbbf 100644
--- a/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.metadata.json
+++ b/prowler/providers/aws/services/ecr/ecr_repositories_tag_immutability/ecr_repositories_tag_immutability.metadata.json
@@ -1,31 +1,39 @@
{
"Provider": "aws",
"CheckID": "ecr_repositories_tag_immutability",
- "CheckTitle": "ECR repositories should have tag immutability configured",
+ "CheckTitle": "ECR repository has image tag immutability enabled",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
],
"ServiceName": "ecr",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecr:{region}:{account-id}:repository/{repository-name}",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsEcrRepository",
- "Description": "This control checks whether a ECR repository has tag immutability enabled. The control fails if a ECR repository has tag immutability disabled and passes if tag immutability is set to IMMUTABLE.",
- "Risk": "Disabling tag immutability in an ECR repository increases the risk of image tampering by allowing tags to be overridden, which can lead to deploying unintended images and security vulnerabilities.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecr-private-tag-immutability-enabled.html",
+ "Description": "Amazon ECR repositories are assessed for **image tag immutability**. Repositories permitting tag updates (`MUTABLE`) are identified; those enforcing immutable tags (such as `IMMUTABLE`) are recognized.",
+ "Risk": "Mutable tags allow replacing the image behind a trusted tag, undermining release **integrity**. This enables supply-chain injection, unintended rollouts, and backdoored deployments, harming **availability**. Malicious images can exfiltrate data, impacting **confidentiality**.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecr-private-tag-immutability-enabled.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-2",
+ "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html"
+ ],
"Remediation": {
"Code": {
"CLI": "aws ecr put-image-tag-mutability --repository-name --image-tag-mutability IMMUTABLE",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecr-controls.html#ecr-2",
- "Terraform": ""
+ "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::ECR::Repository\n Properties:\n ImageTagMutability: IMMUTABLE # Critical: enables tag immutability to prevent tag overwrites\n```",
+ "Other": "1. Open the Amazon ECR console\n2. Go to Repositories (Private) and select the repository\n3. Click Actions > Edit\n4. Set Image tag immutability to Immutable\n5. Click Save",
+ "Terraform": "```hcl\nresource \"aws_ecr_repository\" \"\" {\n name = \"\"\n image_tag_mutability = \"IMMUTABLE\" # Critical: enables tag immutability to prevent tag overwrites\n}\n```"
},
"Recommendation": {
- "Text": "Enable tag immutability on your ECR repositories to prevent image tags from being overwritten.",
- "Url": "https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-tag-mutability.html"
+ "Text": "Enable **tag immutability** so tags map to a single artifact. Use **versioned tags** per build, block retagging in CI/CD, and apply **least privilege** for push actions. Layer **image signing** and admission controls to run only trusted images. *If exceptions are needed, keep them narrow and monitored.*",
+ "Url": "https://hub.prowler.com/check/ecr_repositories_tag_immutability"
}
},
- "Categories": [],
+ "Categories": [
+ "container-security"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.metadata.json b/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.metadata.json
index 6f24b9b645..6e4f0d0456 100644
--- a/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_cluster_container_insights_enabled/ecs_cluster_container_insights_enabled.metadata.json
@@ -1,28 +1,38 @@
{
"Provider": "aws",
"CheckID": "ecs_cluster_container_insights_enabled",
- "CheckTitle": "ECS clusters should use Container Insights",
+ "CheckTitle": "ECS cluster has Container Insights enabled or enhanced",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:cluster/{cluster-name}",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsEcsCluster",
- "Description": "This control checks if ECS clusters use Container Insights. This control fails if Container Insights are not set up for a cluster.",
- "Risk": "Without Container Insights, important performance metrics and diagnostic information from containerized applications may not be captured, which can hinder monitoring and troubleshooting.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-container-insights-enabled.html",
+ "Description": "**ECS clusters** have CloudWatch **Container Insights** configured via the `containerInsights` setting, accepting `enabled` or `enhanced` values to emit cluster, service, task, and container telemetry.",
+ "Risk": "Without **Container Insights**, ECS operations lack **telemetry** to spot failures and anomalies. Missed CPU/memory/network spikes and restart loops degrade **availability** and delay response. Absent baselines impede detecting abuse (e.g., **cryptomining** or data egress bursts), risking **confidentiality** and unexpected **costs**.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-12",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/cloudwatch-container-insights.html",
+ "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-metrics-ECS.html",
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-container-insights-enabled.html",
+ "https://aws.amazon.com/blogs/aws/container-insights-with-enhanced-observability-now-available-in-amazon-ecs/",
+ "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/deploy-container-insights-ECS-cluster.html",
+ "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContainerInsights.html"
+ ],
"Remediation": {
"Code": {
"CLI": "aws ecs update-cluster-settings --cluster --settings name=containerInsights,value=enabled",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-12",
- "Terraform": ""
+ "NativeIaC": "```yaml\n# CloudFormation: Enable Container Insights on an ECS cluster\nResources:\n :\n Type: AWS::ECS::Cluster\n Properties:\n ClusterSettings:\n - Name: containerInsights # Critical: enables CloudWatch Container Insights for the cluster\n Value: enabled # Critical: setting that passes the check\n```",
+ "Other": "1. Open the Amazon ECS console\n2. Go to Clusters and select the target cluster\n3. Click Update cluster\n4. Under CloudWatch Container Insights, enable Container Insights (or Enhanced)\n5. Click Save changes",
+ "Terraform": "```hcl\n# Terraform: Enable Container Insights on an ECS cluster\nresource \"aws_ecs_cluster\" \"\" {\n name = \"\"\n\n setting {\n name = \"containerInsights\" # Critical: enables CloudWatch Container Insights for the cluster\n value = \"enabled\" # Critical: setting that passes the check\n }\n}\n```"
},
"Recommendation": {
- "Text": "Enable Container Insights for your ECS clusters to collect and monitor key performance metrics and diagnostic data from your containers.",
- "Url": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/deploy-container-insights-ECS-cluster.html"
+ "Text": "Enable **Container Insights** on all clusters-prefer `enhanced` for deeper visibility. Apply at account level for new clusters and enforce via automation.\n\nUse **least privilege** for access to metrics/logs, encrypt logs, and set **alarms** on critical metrics. Correlate with app logs and tracing for **defense in depth** and faster incident detection.",
+ "Url": "https://hub.prowler.com/check/ecs_cluster_container_insights_enabled"
}
},
"Categories": [
diff --git a/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.metadata.json b/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.metadata.json
index b3d25e494c..4977818073 100644
--- a/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_service_fargate_latest_platform_version/ecs_service_fargate_latest_platform_version.metadata.json
@@ -1,32 +1,41 @@
{
"Provider": "aws",
"CheckID": "ecs_service_fargate_latest_platform_version",
- "CheckTitle": "ECS Fargate services should run on the latest Fargate platform version",
+ "CheckTitle": "ECS Fargate service uses the latest Fargate platform version",
"CheckType": [
"Software and Configuration Checks/AWS Security Best Practices"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:service/{service-name}",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsEcsService",
- "Description": "This control checks if Amazon ECS Fargate services are running the latest Fargate platform version. The control fails if the platform version is not the latest.",
- "Risk": "Not running the latest Fargate platform version may expose your services to security vulnerabilities and bugs that are resolved in newer versions.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-fargate-latest-platform-version.html",
+ "Description": "**ECS Fargate services** use the **latest Fargate platform version** via `platformVersion`=`LATEST` or an explicit value matching the current release for their `platformFamily` (Linux/Windows).",
+ "Risk": "Running on an outdated platform leaves known CVEs in the kernel/runtime unpatched, risking:\n- **Confidentiality**: data exposure via container escape\n- **Integrity**: privilege escalation and tampering\n- **Availability**: crashes/DoS and instability under load",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://servian.dev/setting-up-fargate-for-ecs-exec-8f5cc8d7d80e",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform-fargate.html",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ECS/platform-version.html",
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-fargate-latest-platform-version.html",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-10"
+ ],
"Remediation": {
"Code": {
"CLI": "aws ecs update-service --cluster --service --platform-version LATEST",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-10",
- "Terraform": ""
+ "NativeIaC": "```yaml\n# CloudFormation: set ECS Fargate service to latest platform version\nResources:\n :\n Type: AWS::ECS::Service\n Properties:\n Cluster: \n TaskDefinition: \n LaunchType: FARGATE\n PlatformVersion: LATEST # Critical: use the latest Fargate platform version\n NetworkConfiguration:\n AwsvpcConfiguration:\n Subnets:\n - \n```",
+ "Other": "1. In the AWS Console, go to Amazon ECS\n2. Open your cluster and select the service\n3. Click Update\n4. Set Platform version to LATEST\n5. Click Update service (or Deploy) to apply",
+ "Terraform": "```hcl\n# ECS Fargate service using the latest platform version\nresource \"aws_ecs_service\" \"\" {\n name = \"\"\n cluster = \"\"\n task_definition = \"\"\n launch_type = \"FARGATE\"\n platform_version = \"LATEST\" # Critical: ensures the latest Fargate platform version\n\n network_configuration {\n subnets = [\"\"]\n }\n}\n```"
},
"Recommendation": {
- "Text": "Update your ECS Fargate services to the latest platform version to ensure they are running in a secure and optimized environment.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html"
+ "Text": "- Prefer `platformVersion` `LATEST` to receive patches.\n- If pinning, monitor releases and redeploy quickly to the current version.\n- Automate updates with staged rollouts in CI/CD.\n- Apply **defense in depth** and **least privilege** to limit runtime exploit impact.",
+ "Url": "https://hub.prowler.com/check/ecs_service_fargate_latest_platform_version"
}
},
"Categories": [
- "vulnerabilities"
+ "vulnerabilities",
+ "container-security"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.metadata.json b/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.metadata.json
index 42b7f36cb1..30b9b0f4ba 100644
--- a/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_service_no_assign_public_ip/ecs_service_no_assign_public_ip.metadata.json
@@ -1,28 +1,34 @@
{
"Provider": "aws",
"CheckID": "ecs_service_no_assign_public_ip",
- "CheckTitle": "ECS services should not assign public IPs automatically",
+ "CheckTitle": "ECS service does not have automatic public IP assignment",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:service/{service-name}",
+ "ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "AwsEcsService",
- "Description": "This control checks whether Amazon ECS services are configured to automatically assign public IP addresses. The control fails if AssignPublicIP is ENABLED and passes if it is DISABLED.",
- "Risk": "Having public IP addresses assigned to ECS services automatically can expose services to the internet, increasing the risk of unauthorized access, data breaches, and cyberattacks.",
- "RelatedUrl": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html",
+ "Description": "**ECS services** are assessed for automatic public IP assignment via the `assignPublicIp` setting in their network configuration.\n\nThe finding indicates whether tasks launched by the service receive a public IP or are limited to private addressing.",
+ "Risk": "Automatic **public IPs** make tasks directly reachable from the Internet, enabling:\n- Port scanning and remote exploitation\n- Brute-force against admin endpoints\n- Data exfiltration via exposed APIs\nThis jeopardizes **confidentiality**, **integrity**, and **availability**, and can facilitate lateral movement within the VPC.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-2",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/Welcome.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecs update-service --cluster --service --network-configuration 'awsvpcConfiguration={assignPublicIp=DISABLED}'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-2",
- "Terraform": ""
+ "CLI": "aws ecs update-service --cluster --service --network-configuration \"awsvpcConfiguration={subnets=[],assignPublicIp=DISABLED}\"",
+ "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::ECS::Service\n Properties:\n Cluster: \n TaskDefinition: \n NetworkConfiguration:\n AwsvpcConfiguration:\n Subnets:\n - \n AssignPublicIp: DISABLED # Critical: disables automatic public IP assignment for the service\n```",
+ "Other": "1. In the AWS Console, go to ECS > Clusters and open your cluster\n2. Select the service and click Update\n3. Under Networking (awsvpc), set Assign public IP to Disabled\n4. Click Update service to apply",
+ "Terraform": "```hcl\nresource \"aws_ecs_service\" \"\" {\n name = \"\"\n cluster = \"\"\n task_definition = \"\"\n\n network_configuration {\n subnets = [\"\"]\n assign_public_ip = false # Critical: disables automatic public IP assignment\n }\n}\n```"
},
"Recommendation": {
- "Text": "Disable automatic public IP address assignment for your ECS services to ensure they are not publicly accessible.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security.html"
+ "Text": "Disable `assignPublicIp` to keep tasks private. Expose services through **load balancers** or **private endpoints**, restrict ingress with **least-privilege** security groups, and route egress via **NAT**. Apply **defense in depth** (WAF, TLS, monitoring) and segment networks to minimize blast radius.",
+ "Url": "https://hub.prowler.com/check/ecs_service_no_assign_public_ip"
}
},
"Categories": [
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.metadata.json
index 9e320892f6..25f0db5512 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.metadata.json
@@ -1,32 +1,39 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_containers_readonly_access",
- "CheckTitle": "ECS containers should be limited to read-only access to root filesystems",
+ "CheckTitle": "ECS task definition has all containers with read-only root filesystems",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/CIS Host Hardening Benchmarks"
],
"ServiceName": "ecs",
- "SubServiceName": "taskDefinition",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-definition/{task-definition-name}",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "This control checks if Amazon ECS containers are limited to read-only access to mounted root filesystems. The control fails if the readonlyRootFilesystem parameter is set to false or if the parameter doesn't exist in the container definition.",
- "Risk": "If ECS containers have write access to root filesystems, it increases the risk of filesystem tampering and exploitation of vulnerabilities, violating the principle of least privilege.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-containers-readonly-access.html",
+ "Description": "Amazon ECS task definitions specify whether container root filesystems are **read-only** via `readonlyRootFilesystem`. Containers where this setting is absent or set to `false` effectively have write access to the root filesystem.",
+ "Risk": "A **writable root filesystem** enables runtime tampering and persistence. Attackers can modify binaries or configs, drop implants, or delete critical files, degrading **integrity** and **availability**. Access to writable paths can also expose secrets and logs, eroding **confidentiality** and complicating incident response.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-containers-readonly-access.html",
+ "https://docs.aws.amazon.com/AmazonECS/latest/userguide/task_definition_parameters.html#container_definition_readonly",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-5"
+ ],
"Remediation": {
"Code": {
"CLI": "aws ecs register-task-definition --family --container-definitions '[{\"name\":\"\",\"image\":\"\",\"readonlyRootFilesystem\":true}]'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-5",
- "Terraform": ""
+ "NativeIaC": "```yaml\n# CloudFormation: ECS task definition with read-only root filesystem\nResources:\n :\n Type: AWS::ECS::TaskDefinition\n Properties:\n Family: \n ContainerDefinitions:\n - Name: \n Image: \n ReadonlyRootFilesystem: true # Critical: enforces read-only root FS for the container\n```",
+ "Other": "1. In the AWS Console, go to Amazon ECS > Task Definitions\n2. Select the task family and click Create new revision\n3. For each container, edit and enable Read-only root filesystem (readonlyRootFilesystem = true)\n4. Click Create to register the new revision\n5. (If needed) Update services to use the new revision",
+ "Terraform": "```hcl\n# ECS task definition with read-only root filesystem\nresource \"aws_ecs_task_definition\" \"\" {\n family = \"\"\n container_definitions = jsonencode([\n {\n name = \"\"\n image = \"\"\n readonlyRootFilesystem = true # Critical: enforces read-only root FS for the container\n }\n ])\n}\n```"
},
"Recommendation": {
- "Text": "Ensure that containers have read-only access to their root filesystems to limit write access and reduce the attack surface.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/userguide/task_definition_parameters.html#container_definition_readonly"
+ "Text": "Enforce `readonlyRootFilesystem: true` for containers.\n- Grant write access only via specific volumes required by the app\n- Apply **least privilege** and **defense in depth**: run as non-root, drop unnecessary capabilities, and keep images immutable so runtime writes aren't needed",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_containers_readonly_access"
}
},
"Categories": [
- "vulnerabilities"
+ "container-security"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.metadata.json
index b296ca930c..a872858f01 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.metadata.json
@@ -1,32 +1,40 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_host_namespace_not_shared",
- "CheckTitle": "ECS task definitions should not share the host's process namespace",
+ "CheckTitle": "ECS task definition does not share the host's process namespace with its containers",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/CIS Host Hardening Benchmarks",
+ "TTPs/Privilege Escalation",
+ "TTPs/Discovery"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-definition/{task-definition-name}",
+ "ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "This control checks if Amazon ECS task definitions are configured to share a host's process namespace with its containers. The control fails if the task definition shares the host's process namespace.",
- "Risk": "Sharing the host's process namespace with containers exposes host processes, potentially allowing unauthorized access or manipulation of host-level processes, undermining container isolation.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-pid-mode-check.html",
+ "Description": "**ECS task definitions** where `pidMode` is `host` are configured to share the host's **process namespace** with containers, rather than using isolated task or private namespaces.",
+ "Risk": "**Host PID sharing** lets containers view and interact with host processes, eroding isolation.\n- Confidentiality: process enumeration and metadata leakage\n- Integrity/Availability: signal or `ptrace` tampering, killing services\n\nEnables lateral movement and privilege escalation from a compromised container.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-3",
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-pid-mode-check.html",
+ "https://docs.aws.amazon.com/AmazonECS/latest/userguide/task_definition_parameters.html#container_definition_pid_mode"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecs register-task-definition --family --container-definitions '[{\"name\":\"\",\"image\":\"\",\"pidMode\":\"task\"}]'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-3",
- "Terraform": ""
+ "CLI": "aws ecs register-task-definition --family --pid-mode task --container-definitions '[{\"name\":\"\",\"image\":\"\"}]'",
+ "NativeIaC": "```yaml\n# CloudFormation: ECS Task Definition without host PID namespace\nResources:\n :\n Type: AWS::ECS::TaskDefinition\n Properties:\n Family: \n ContainerDefinitions:\n - Name: \n Image: \n PidMode: task # Critical: ensures containers use task PID namespace, not host\n```",
+ "Other": "1. In the AWS Console, go to Amazon ECS > Task Definitions\n2. Select the task definition and click Create new revision\n3. Set Process namespace sharing (PID mode) to Task (not Host)\n4. Save the new revision\n5. (If the previous Host PID revision remains active) Select that revision and click Deregister",
+ "Terraform": "```hcl\n# ECS Task Definition without host PID namespace\nresource \"aws_ecs_task_definition\" \"example\" {\n family = \"\"\n container_definitions = jsonencode([{ name = \"\", image = \"\" }])\n pid_mode = \"task\" # Critical: prevents sharing the host's process namespace\n}\n```"
},
"Recommendation": {
- "Text": "Avoid sharing the host's process namespace with containers to maintain process isolation and enhance security.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/userguide/task_definition_parameters.html#container_definition_pid_mode"
+ "Text": "Prefer **isolated PID namespaces**: set `pidMode=task` or use the default per-container namespace. Avoid `host` PID sharing except for tightly controlled diagnostics.\n\nApply **least privilege**: non-root users, minimal capabilities, read-only filesystems; and **defense in depth** with network and runtime controls.",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_host_namespace_not_shared"
}
},
"Categories": [
- "vulnerabilities"
+ "container-security"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.metadata.json
index 6c1121ceb4..4c393a92bf 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.metadata.json
@@ -1,32 +1,45 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_host_networking_mode_users",
- "CheckTitle": "Amazon ECS task definitions should have secure networking modes and user definitions",
+ "CheckTitle": "Amazon ECS task definition does not use host network mode, or non-privileged containers specify a non-root user",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+ "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/CIS Host Hardening Benchmarks",
+ "TTPs/Privilege Escalation",
+ "TTPs/Lateral Movement"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:region:account-id:task-definition/resource-id",
+ "ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "This control checks whether an active Amazon ECS task definition with host networking mode has privileged or user container definitions. The control fails for task definitions that have host network mode and container definitions of privileged=false or empty, and user=root or empty.",
- "Risk": "If ECS tasks are configured with host networking and either lack a defined user or run with elevated privileges, this can lead to privilege escalation, unauthorized access to resources, and increased exposure to vulnerabilities.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-user-for-host-mode-check.html",
+ "Description": "**Amazon ECS task definitions** in `host` network mode are assessed for containers where `privileged=false` and the container `user` is `root` or unset.",
+ "Risk": "Sharing the host network lets containers reach host interfaces directly. Running as **root** (or with no user set) increases the chance to bind low ports, sniff traffic, or impersonate services, and makes kernel flaws more exploitable-enabling data exfiltration, tampering, and outages, impacting **confidentiality**, **integrity**, and **availability**.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-6",
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-user-for-host-mode-check.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecs update-task-definition --task-definition --network-mode awsvpc --requires-compatibilities FARGATE --user ",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-6",
- "Terraform": ""
+ "CLI": "",
+ "NativeIaC": "```yaml\n# CloudFormation: ECS task definition not using host network mode\nResources:\n :\n Type: AWS::ECS::TaskDefinition\n Properties:\n NetworkMode: awsvpc # CRITICAL: avoids host mode to pass the check\n ContainerDefinitions:\n - Name: \n Image: \n```",
+ "Other": "1. Open the Amazon ECS console and go to Task definitions\n2. Select the task definition and choose the latest revision\n3. Click Create new revision\n4. Set Network mode to awsvpc (not host)\n5. Save the revision and, if used by a service, update the service to this new revision\n6. If you must keep host mode: edit each non-privileged container and set User to a non-root value (e.g., 1000) and save a new revision",
+ "Terraform": "```hcl\n# ECS task definition not using host network mode\nresource \"aws_ecs_task_definition\" \"\" {\n family = \"\"\n network_mode = \"awsvpc\" # CRITICAL: avoids host mode to pass the check\n container_definitions = jsonencode([\n {\n name = \"\"\n image = \"nginx\"\n }\n ])\n}\n```"
},
"Recommendation": {
- "Text": "Ensure your ECS task definitions use the awsvpc networking mode and have secure user configurations when using host networking mode.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html"
+ "Text": "Prefer **`awsvpc`** for isolation. If `host` is required, enforce **least privilege**:\n- Run as a non-root `user`\n- Avoid `privileged` unless strictly justified\n- Limit capabilities and exposed ports\n\nApply **defense in depth** with network segmentation and minimal IAM permissions.",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_host_networking_mode_users"
}
},
"Categories": [
- "trustboundaries"
+ "container-security",
+ "trust-boundaries"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.metadata.json
index 73c84fd933..8929b8b7e8 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.metadata.json
@@ -1,32 +1,39 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_logging_block_mode",
- "CheckTitle": "ECS task definitions containers should have a logging configured with non blocking mode",
+ "CheckTitle": "ECS task definition has container logging in non-blocking mode",
"CheckType": [
- "Resilience"
+ "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+ "Effects/Denial of Service"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-definition/{task-definition-name}",
+ "ResourceIdTemplate": "",
"Severity": "low",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "This control checks if the latest active Amazon ECS task definition has a logging configuration set to non blocking mode.",
- "Risk": "When logs cannot be immediately sent to Amazon CloudWatch, calls from container code to write to stdout or stderr will block and halt execution of the code. The logging thread in the application will block, which may prevent the application from functioning and lead to health check failures and task termination. Container startup fails if the required log group or log stream cannot be created.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-log-configuration.html",
+ "Description": "**ECS task definition containers** use **non-blocking logging mode** via the `logConfiguration.mode` option on the latest active revision",
+ "Risk": "**Blocking log mode** can stall writes to stdout/stderr, making containers unresponsive, failing health checks, and causing task restarts or startup failures if log groups/streams can't be created. This reduces **availability** and may trigger cascading instability across dependent services.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-log-configuration.html",
+ "https://www.amazonaws.cn/en/blog-selection/preventing-log-loss-with-non-blocking-mode-in-the-awslogs-container-log-driver/",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html#specify-log-config"
+ ],
"Remediation": {
"Code": {
"CLI": "aws ecs register-task-definition --family --container-definitions '[{\"name\":\"\",\"image\":\"\",\"logConfiguration\":{\"logDriver\":\"awslogs\",\"options\":{\"awslogs-group\":\"\",\"awslogs-region\":\"\",\"awslogs-stream-prefix\":\"ecs\",\"mode\":\"non-blocking\"}}}]'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/awssupport/latest/user/fault-tolerance-checks.html#amazon-ec2-awslogs-driver-blockingmode",
- "Terraform": ""
+ "NativeIaC": "```yaml\n# CloudFormation: ECS Task Definition with non-blocking container logging\nResources:\n :\n Type: AWS::ECS::TaskDefinition\n Properties:\n Family: \n ContainerDefinitions:\n - Name: \n Image: \n LogConfiguration:\n LogDriver: awslogs\n Options:\n awslogs-group: \n awslogs-region: \n awslogs-stream-prefix: ecs\n mode: non-blocking # CRITICAL: sets logging to non-blocking to pass the check\n```",
+ "Other": "1. Open the AWS Console and go to ECS > Task Definitions\n2. Select the failing task definition and choose Create new revision\n3. Edit the affected container > Log configuration\n4. Set Log driver to awslogs and add option: mode = non-blocking\n5. Ensure awslogs-group, awslogs-region, and (if needed) awslogs-stream-prefix are set\n6. Save and Create; the new revision will have non-blocking logging",
+ "Terraform": "```hcl\n# ECS Task Definition with container logging set to non-blocking\nresource \"aws_ecs_task_definition\" \"\" {\n family = \"\"\n\n # CRITICAL: \"mode\": \"non-blocking\" in logConfiguration options enforces non-blocking logging\n container_definitions = jsonencode([\n {\n name = \"\"\n image = \"\"\n logConfiguration = {\n logDriver = \"awslogs\"\n options = {\n awslogs-group = \"\"\n awslogs-region = \"\"\n awslogs-stream-prefix = \"ecs\"\n mode = \"non-blocking\" # CRITICAL: required to pass the check\n }\n }\n }\n ])\n}\n```"
},
"Recommendation": {
- "Text": "Configure logging in ECS task definition to non blocking mode to ensure any issues writing logs will not block or halt the container execution.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html#specify-log-config"
+ "Text": "Set `logConfiguration.mode` to `non-blocking` for all containers and size `max-buffer-size` to handle bursts. Keep log destinations in-Region to lower latency. Apply **defense in depth**: decouple application execution from logging, monitor log throughput, and design for backpressure so logging never blocks runtime.",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_logging_block_mode"
}
},
"Categories": [
- "logging"
+ "logging",
+ "resilience"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.metadata.json
index f639f04e8e..766d43a758 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.metadata.json
@@ -1,28 +1,34 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_logging_enabled",
- "CheckTitle": "ECS task definitions containers should have a logging configuration",
+ "CheckTitle": "ECS task definition has logging configured for all containers",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-definition/{task-definition-name}",
+ "ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "This control checks if the latest active Amazon ECS task definition has a logging configuration specified. The control fails if the task definition doesn't have the logConfiguration property defined or if the value for logDriver is null in at least one container definition.",
- "Risk": "Without a logging configuration, important data may be lost, making it difficult to troubleshoot issues, monitor performance, and ensure compliance with auditing requirements.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-log-configuration.html",
+ "Description": "**Amazon ECS task definition** containers specify a **logging configuration** with a non-null `logDriver` for every container in the latest active revision.",
+ "Risk": "Absent container logs erode visibility, letting intrusions, data exfiltration, and configuration tampering go undetected.\n\nMissing audit trails weaken confidentiality and integrity, hinder forensics, and increase MTTR during outages, impacting availability and compliance evidence.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-9",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html#specify-log-config",
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-task-definition-log-configuration.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecs register-task-definition --family --container-definitions '[{\"name\":\"\",\"image\":\"\",\"logConfiguration\":{\"logDriver\":\"awslogs\",\"options\":{\"awslogs-group\":\"\",\"awslogs-region\":\"\",\"awslogs-stream-prefix\":\"ecs\"}}}]'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-9",
- "Terraform": ""
+ "CLI": "aws ecs register-task-definition --family --container-definitions '[{\"name\":\"\",\"image\":\"\",\"logConfiguration\":{\"logDriver\":\"awslogs\",\"options\":{\"awslogs-group\":\"\",\"awslogs-region\":\"\"}}}]'",
+ "NativeIaC": "```yaml\n# CloudFormation: ECS task definition with logging enabled for the container\nResources:\n ExampleTaskDefinition:\n Type: AWS::ECS::TaskDefinition\n Properties:\n ContainerDefinitions:\n - Name: \"\"\n Image: \"\"\n LogConfiguration: # Critical: ensures container has logging configured\n LogDriver: awslogs # Critical: non-null log driver passes the check\n Options:\n awslogs-group: \"\" # Critical: CloudWatch Logs group\n awslogs-region: \"\"\n```",
+ "Other": "1. In the AWS Console, go to Amazon ECS > Task Definitions\n2. Select your task definition and click Create new revision\n3. For each container, open Edit and set Log configuration to awslogs\n4. Set Log group to the desired CloudWatch Logs group and select the Region\n5. Save and Create to register the new revision (ensure all containers have logging)",
+ "Terraform": "```hcl\n# ECS task definition with logging enabled for the container\nresource \"aws_ecs_task_definition\" \"\" {\n family = \"\"\n container_definitions = jsonencode([\n {\n name = \"\"\n image = \"\"\n logConfiguration = { # Critical: enables container logging\n logDriver = \"awslogs\" # Critical: non-null log driver passes the check\n options = {\n awslogs-group = \"\" # Critical: CloudWatch Logs group\n awslogs-region = \"\"\n }\n }\n }\n ])\n}\n```"
},
"Recommendation": {
- "Text": "Define a logging configuration in the ECS task definition to ensure important data is captured and available for debugging, monitoring, and auditing purposes.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html#specify-log-config"
+ "Text": "Implement centralized, tamper-resistant **container logging** for all tasks. Define a `logDriver` per container and ship logs to a managed destination with restricted access. Apply **least privilege**, encryption, and retention. Monitor and alert on anomalies. *If using external collectors, ensure equivalent coverage and durability.*",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_logging_enabled"
}
},
"Categories": [
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.metadata.json
index 55c51417a9..3bc94ce3f9 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.metadata.json
@@ -1,30 +1,34 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_no_environment_secrets",
- "CheckTitle": "Check if secrets exists in ECS task definitions environment variables",
+ "CheckTitle": "ECS task definition has no secrets in environment variables",
"CheckType": [
- "Protect",
- "Secure development",
- "Credentials not hard-coded"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Sensitive Data Identifications/Passwords",
+ "TTPs/Credential Access"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "critical",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "Check if secrets exists in ECS task definitions environment variables.",
- "Risk": "The use of a hard-coded password increases the possibility of password guessing. If hard-coded passwords are used, it is possible that malicious users gain access through the account in question.",
+ "Description": "**ECS task definitions** are analyzed for **plaintext secrets** placed in container `environment` variables. It identifies values that resemble credentials (keys, tokens, passwords) within container definitions.",
+ "Risk": "Exposed secrets in env vars undermine confidentiality via logs, task metadata, and introspection.\n\nWith container or read-only API access, attackers can reuse credentials to read databases, modify records (integrity), pivot to other services, and trigger outages or unauthorized costs (availability).",
"RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html"
+ ],
"Remediation": {
"Code": {
"CLI": "",
- "NativeIaC": "",
- "Other": "",
- "Terraform": ""
+ "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::ECS::TaskDefinition\n Properties:\n Family: \n ContainerDefinitions:\n - Name: app\n Image: \n Secrets: # Critical: use Secrets instead of plaintext env vars\n - Name: DB_PASSWORD # Critical: inject secret at runtime\n ValueFrom: # Critical: reference Secrets Manager/SSM parameter\n```",
+ "Other": "1. In the AWS Console, go to ECS > Task Definitions and open your task definition\n2. Create a new revision\n3. For each container, remove any sensitive values from Environment variables\n4. Under Environment variables, add a new entry in the Secrets section with Name (e.g., DB_PASSWORD) and ValueFrom pointing to your Secrets Manager/SSM parameter\n5. Save to create the new revision\n6. If using a service, update the service to use the new task definition revision and deploy",
+ "Terraform": "```hcl\nresource \"aws_ecs_task_definition\" \"\" {\n family = \"\"\n # Critical: define container secrets instead of plaintext env vars\n container_definitions = jsonencode([\n {\n name = \"app\"\n image = \"\"\n secrets = [\n { name = \"DB_PASSWORD\", valueFrom = \"\" } # Critical: inject secret at runtime\n ]\n }\n ])\n}\n```"
},
"Recommendation": {
- "Text": "Use Secrets Manager or Parameter Store to securely provide credentials to containers without hardcoding the secrets in code or passing them through environment variables. It is currently not possible to delete task definition revisions which contain plaintext secrets. AWS is looking into implementing this feature in 2023, and it is therefore recommended that all plaintext secrets are rotated at the same time as moving the secrets to Secrets Manager or Parameter Store.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/specifying-sensitive-data.html"
+ "Text": "Store secrets in **AWS Secrets Manager** or **SSM Parameter Store** and inject them at runtime instead of plaintext env vars.\n\nApply **least privilege** via task roles, enable regular **rotation**, avoid logging secret values, and prefer **ephemeral credentials** for downstream services.",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_no_environment_secrets"
}
},
"Categories": [
diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.metadata.json
index 79cb560d0b..976b2fba31 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.metadata.json
@@ -1,32 +1,39 @@
{
"Provider": "aws",
"CheckID": "ecs_task_definitions_no_privileged_containers",
- "CheckTitle": "ECS task definitions shouldn't have privileged containers",
+ "CheckTitle": "ECS task definition has no privileged containers",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/CIS Host Hardening Benchmarks",
+ "TTPs/Privilege Escalation"
],
"ServiceName": "ecs",
- "SubServiceName": "taskDefinition",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-definition/{task-definition-name}",
+ "SubServiceName": "",
+ "ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "AwsEcsTaskDefinition",
- "Description": "This control checks if the privileged parameter in the container definition of Amazon ECS Task Definitions is set to true. The control fails if this parameter is equal to true.",
- "Risk": "Running containers with elevated privileges increases the risk of privilege escalation attacks, potentially allowing unauthorized access to the host and other containers.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/ecs-containers-nonprivileged.html",
+ "Description": "**Amazon ECS task definitions** are evaluated for containers configured with **privileged mode** (`privileged: true`).\n\nThe outcome indicates whether any container definition enables this setting.",
+ "Risk": "**Privileged containers** can act with host-level root, breaking isolation. A foothold lets attackers achieve **container escape**, mount host devices, read secrets, alter configs, and control other workloads-impacting confidentiality, integrity, and availability via data theft, tampering, and service disruption.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/config/latest/developerguide/ecs-containers-nonprivileged.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-4",
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_security"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecs register-task-definition --family --container-definitions '[{\"name\":\"\",\"image\":\"\",\"privileged\":false}]'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-4",
- "Terraform": ""
+ "CLI": "aws ecs deregister-task-definition --task-definition :",
+ "NativeIaC": "```yaml\n# CloudFormation: ECS task definition with non-privileged container\nResources:\n :\n Type: AWS::ECS::TaskDefinition\n Properties:\n Family: \n ContainerDefinitions:\n - Name: \n Image: \n Privileged: false # Critical: ensures container is non-privileged to pass the check\n```",
+ "Other": "1. Open the Amazon ECS console and go to Task definitions\n2. Select the failing task definition family and open the failing revision\n3. Click Create new revision\n4. Edit the affected container and uncheck Privileged (set it to false)\n5. Click Create to register the new revision",
+ "Terraform": "```hcl\n# ECS task definition with non-privileged container\nresource \"aws_ecs_task_definition\" \"\" {\n family = \"\"\n container_definitions = jsonencode([\n {\n name = \"\"\n image = \"\"\n privileged = false # Critical: ensures container is non-privileged to pass the check\n }\n ])\n}\n```"
},
"Recommendation": {
- "Text": "Ensure that containers are running without elevated privileges to minimize the risk of privilege escalation.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_security"
+ "Text": "Run containers without elevated rights (`privileged: false`) and as non-root (`user`). Apply **least privilege**:\n- Grant only required Linux capabilities via `capDrop`/`capAdd`\n- Prefer `readonlyRootFilesystem: true`\n- Isolate networks and separate duties\n- Monitor with logging to support defense in depth",
+ "Url": "https://hub.prowler.com/check/ecs_task_definitions_no_privileged_containers"
}
},
"Categories": [
- "vulnerabilities"
+ "container-security"
],
"DependsOn": [],
"RelatedTo": [],
diff --git a/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.metadata.json b/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.metadata.json
index 5b593c9874..352d7a7683 100644
--- a/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.metadata.json
+++ b/prowler/providers/aws/services/ecs/ecs_task_set_no_assign_public_ip/ecs_task_set_no_assign_public_ip.metadata.json
@@ -1,28 +1,34 @@
{
"Provider": "aws",
"CheckID": "ecs_task_set_no_assign_public_ip",
- "CheckTitle": "ECS task sets should not automatically assign public IP addresses",
+ "CheckTitle": "ECS task set does not automatically assign a public IP address",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+ "Effects/Data Exposure"
],
"ServiceName": "ecs",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:ecs:{region}:{account-id}:task-set/{cluster-name}/{service-name}/{task-set-id}",
+ "ResourceIdTemplate": "",
"Severity": "high",
- "ResourceType": "AwsEcsTaskSet",
- "Description": "This control checks whether an Amazon ECS task set is configured to automatically assign public IP addresses. The control fails if AssignPublicIP is set to ENABLED.",
- "Risk": "A public IP address is reachable from the internet, potentially exposing resources associated with the ECS task set. ECS task sets shouldn't be publicly accessible, as this may allow unintended access to container application servers.",
- "RelatedUrl": "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskSet.html",
+ "ResourceType": "AwsEcsService",
+ "Description": "**ECS task sets** are assessed for **automatic public IP assignment** via `AssignPublicIP`. When set to `ENABLED`, tasks are given public addresses in their network configuration.",
+ "Risk": "Public IPs make tasks directly reachable from the Internet, enabling scanning, brute force, and exploit attempts.\n\nImpacts: **confidentiality** (data exposure), **integrity** (unauthorized actions), **availability** (DoS). Attackers can bypass internal controls and pivot for lateral movement.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html",
+ "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_TaskSet.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-16"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws ecs update-service --cluster --service --network-configuration 'awsvpcConfiguration={assignPublicIp=\"DISABLED\"}'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/ecs-controls.html#ecs-16",
- "Terraform": ""
+ "CLI": "",
+ "NativeIaC": "```yaml\n# CloudFormation to ensure ECS Task Set does not auto-assign public IP\nResources:\n :\n Type: AWS::ECS::TaskSet\n Properties:\n Cluster: \"\"\n Service: \"\"\n TaskDefinition: \"\"\n NetworkConfiguration:\n AwsvpcConfiguration:\n AssignPublicIp: DISABLED # CRITICAL: disables automatic public IP assignment\n Subnets:\n - \"\"\n```",
+ "Other": "1. In the AWS Console, go to ECS > Clusters > select your cluster\n2. Open your Service and choose Update (or Edit)\n3. In Networking, set Public IP assignment to Disabled\n4. Save/Deploy the update to create a new deployment/task set\n5. After the new task set is Primary and stable, delete the old task set that had Public IP enabled",
+ "Terraform": "```hcl\n# ECS Task Set with public IP assignment disabled\nresource \"aws_ecs_task_set\" \"\" {\n cluster = \"\"\n service = \"\"\n task_definition = \"\"\n\n network_configuration {\n subnets = [\"\"]\n assign_public_ip = false # CRITICAL: disables automatic public IP assignment\n }\n}\n```"
},
"Recommendation": {
- "Text": "Configure ECS task sets to not assign public IP addresses to prevent unintended public access to your containerized applications.",
- "Url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/update-task-definition-console-v2.html"
+ "Text": "Disable **automatic public IPs** on task sets.\n\nUse private subnets behind controlled entry points (load balancers, API gateways, or service discovery). Enforce **least privilege** security groups and **defense in depth**. Prefer private connectivity (VPC endpoints/VPN). *Expose only frontends, not tasks.*",
+ "Url": "https://hub.prowler.com/check/ecs_task_set_no_assign_public_ip"
}
},
"Categories": [
diff --git a/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.metadata.json b/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.metadata.json
index 1876ecc34c..0eaa0618f9 100644
--- a/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.metadata.json
+++ b/prowler/providers/aws/services/elb/elb_connection_draining_enabled/elb_connection_draining_enabled.metadata.json
@@ -1,31 +1,40 @@
{
"Provider": "aws",
"CheckID": "elb_connection_draining_enabled",
- "CheckTitle": "Classic Load Balancer Connection Draining Enabled",
+ "CheckTitle": "Classic Load Balancer has connection draining enabled",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+ "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
+ "Effects/Denial of Service"
],
"ServiceName": "elb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsElbLoadBalancer",
- "Description": "Checks if connection draining is enabled for Classic Load Balancers. Connection draining ensures that the load balancer stops sending requests to instances that are de-registering or unhealthy, while keeping existing connections open. This is particularly useful for instances in Auto Scaling groups, to ensure that connections aren't severed abruptly.",
- "Risk": "Disabling connection draining can lead to abrupt connection termination for users, impacting the user experience and potentially causing application errors.",
- "RelatedUrl": "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-conn-drain.html",
+ "Description": "**Classic Load Balancer** has **connection draining** enabled, so deregistering or unhealthy instances stop receiving new requests while existing connections are allowed to complete within the configured drain window.",
+ "Risk": "Without **connection draining**, instance removals or health failures can terminate in-flight requests, leading to partial transactions, broken sessions, and inconsistent application state. This reduces **availability** and can impact **data integrity** during deployments, scaling, or failover events.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://aws.amazon.com/blogs/aws/elb-connection-draining-remove-instances-from-service-with-care/",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/elb-connection-draining-enabled.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-7",
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-conn-drain.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes '{'ConnectionDraining':{'Enabled':true,'Timeout':300}}'",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-7",
- "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/elb-connection-draining-enabled.html#"
+ "CLI": "aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes '{\"ConnectionDraining\":{\"Enabled\":true}}'",
+ "NativeIaC": "```yaml\n# CloudFormation: Enable connection draining on a Classic Load Balancer\nResources:\n :\n Type: AWS::ElasticLoadBalancing::LoadBalancer\n Properties:\n Listeners:\n - InstancePort: 80\n LoadBalancerPort: 80\n Protocol: HTTP\n AvailabilityZones:\n - us-east-1a\n ConnectionDrainingPolicy:\n Enabled: true # CRITICAL: turns on connection draining so in-flight requests complete\n # Timeout is optional; default 300s is used if omitted\n```",
+ "Other": "1. Open the EC2 console and go to Load Balancers (Classic)\n2. Select the Classic Load Balancer\n3. Choose the Attributes tab, then click Edit\n4. Check Enable connection draining (leave default timeout or set as needed)\n5. Click Save changes",
+ "Terraform": "```hcl\n# Terraform: Enable connection draining on a Classic Load Balancer\nresource \"aws_elb\" \"\" {\n name = \"\"\n availability_zones = [\"us-east-1a\"]\n\n listener {\n lb_port = 80\n lb_protocol = \"http\"\n instance_port = 80\n instance_protocol = \"http\"\n }\n\n connection_draining = true # CRITICAL: enables connection draining so existing connections complete\n # connection_draining_timeout can be omitted (defaults to 300s)\n}\n```"
},
"Recommendation": {
- "Text": "Enable connection draining for all Classic Load Balancers. This ensures that existing connections are not abruptly terminated when instances are removed from the load balancer.",
- "Url": ""
+ "Text": "Enable **connection draining** on all Classic Load Balancers and set a drain interval aligned to typical request latency. Coordinate autoscaling and deployments to allow graceful instance shutdowns. Monitor errors and retries to validate behavior and adjust the `timeout` conservatively to protect **availability** and **integrity**.",
+ "Url": "https://hub.prowler.com/check/elb_connection_draining_enabled"
}
},
- "Categories": [],
+ "Categories": [
+ "resilience"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.metadata.json b/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.metadata.json
index f107add36c..377c62fc03 100644
--- a/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.metadata.json
+++ b/prowler/providers/aws/services/elb/elb_cross_zone_load_balancing_enabled/elb_cross_zone_load_balancing_enabled.metadata.json
@@ -1,29 +1,40 @@
{
"Provider": "aws",
"CheckID": "elb_cross_zone_load_balancing_enabled",
- "CheckTitle": "Ensure Cross-Zone Load Balancing is Enabled for Classic Load Balancers (CLBs)",
- "CheckType": [],
+ "CheckTitle": "Classic Load Balancer has cross-zone load balancing enabled",
+ "CheckType": [
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Effects/Denial of Service",
+ "Effects/Resource Consumption"
+ ],
"ServiceName": "elb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsElbLoadBalancer",
- "Description": "Checks whether cross-zone load balancing is enabled for Classic Load Balancers (CLBs). Cross-zone load balancing ensures even distribution of traffic across all registered targets in all Availability Zones, improving fault tolerance and load distribution.",
- "Risk": "If cross-zone load balancing is not enabled, traffic may not be evenly distributed across Availability Zones, leading to over-utilization of resources in certain zones and potential application performance degradation or outages.",
- "RelatedUrl": "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-crosszone-lb.html",
+ "Description": "Classic Load Balancer with **cross-zone load balancing** distributes requests across registered targets in all enabled Availability Zones.\n\nThis evaluates whether that setting is `enabled`, instead of restricting distribution to targets within only the same zone.",
+ "Risk": "Without **cross-zone load balancing**, traffic can concentrate in one AZ due to DNS skew or uneven capacity, creating **hot spots**, timeouts, and latency. This degrades service **availability** and increases the chance of cascading failures during AZ impairment or instance loss.",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-9",
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-crosszone-lb.html",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/elb-cross-zone-load-balancing-enabled.html"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes \"CrossZoneLoadBalancing={Enabled=true}\"",
- "NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-9",
- "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/elb-cross-zone-load-balancing-enabled.html"
+ "CLI": "aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes \"{\\\"CrossZoneLoadBalancing\\\":{\\\"Enabled\\\":true}}\"",
+ "NativeIaC": "```yaml\n# CloudFormation: Enable cross-zone load balancing on a Classic Load Balancer\nResources:\n :\n Type: AWS::ElasticLoadBalancing::LoadBalancer\n Properties:\n CrossZone: true # Critical: enables cross-zone load balancing to pass the check\n Listeners:\n - LoadBalancerPort: 80\n InstancePort: 80\n Protocol: HTTP\n AvailabilityZones:\n - \n```",
+ "Other": "1. Open the AWS EC2 console\n2. Go to Load Balancing > Load Balancers and select your Classic Load Balancer\n3. Open the Attributes tab and click Edit\n4. Enable Cross-zone load balancing\n5. Click Save changes",
+ "Terraform": "```hcl\n# Terraform: Enable cross-zone load balancing on a Classic Load Balancer\nresource \"aws_elb\" \"\" {\n name = \"\"\n\n listener {\n lb_port = 80\n lb_protocol = \"http\"\n instance_port = 80\n instance_protocol = \"http\"\n }\n\n availability_zones = [\"\"]\n\n cross_zone_load_balancing = true # Critical: enables cross-zone load balancing to pass the check\n}\n```"
},
"Recommendation": {
- "Text": "Enable cross-zone load balancing for Classic Load Balancers to ensure even traffic distribution and enhance fault tolerance across Availability Zones.",
- "Url": "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-disable-crosszone-lb.html"
+ "Text": "Set `cross-zone load balancing` to `enabled` on Classic Load Balancers and use at least two AZs.\n\nBalance capacity per AZ, enforce robust health checks with autoscaling, and design for **high availability** so load remains evenly distributed during demand spikes or partial AZ outages.",
+ "Url": "https://hub.prowler.com/check/elb_cross_zone_load_balancing_enabled"
}
},
- "Categories": [],
+ "Categories": [
+ "resilience"
+ ],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""
diff --git a/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.metadata.json b/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.metadata.json
index f6d873fbd6..2dc68a2754 100644
--- a/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.metadata.json
+++ b/prowler/providers/aws/services/elb/elb_desync_mitigation_mode/elb_desync_mitigation_mode.metadata.json
@@ -1,28 +1,37 @@
{
"Provider": "aws",
"CheckID": "elb_desync_mitigation_mode",
- "CheckTitle": "Classic Load Balancer should be configured with defensive or strictest desync mitigation mode",
+ "CheckTitle": "Classic Load Balancer desync mitigation mode is defensive or strictest",
"CheckType": [
- "Software and Configuration Checks/AWS Security Best Practices"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "TTPs/Initial Access",
+ "TTPs/Defense Evasion"
],
"ServiceName": "elb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:aws:elasticloadbalancing:{region}:{account-id}:loadbalancer/{load-balancer-name}",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsElbLoadBalancer",
- "Description": "This control checks whether a Classic Load Balancer is configured with defensive or strictest desync mitigation mode. The control fails if the Classic Load Balancer isn't configured with defensive or strictest desync mitigation mode.",
- "Risk": "HTTP Desync issues can lead to request smuggling, making applications vulnerable to attacks such as request queue or cache poisoning, which could result in credential hijacking or unauthorized command execution.",
- "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/clb-desync-mode-check.html",
+ "Description": "**Classic Load Balancer** `desync_mitigation_mode` is evaluated to determine whether it is configured as **`defensive`** or **`strictest`**. Any other mode (such as `monitor`) is identified for attention.",
+ "Risk": "Without strict desync mitigation, **HTTP request smuggling** can occur, enabling:\n- Cache/queue poisoning (**integrity**)\n- Session hijacking and data exposure (**confidentiality**)\n- Unintended backend actions and abuse (**availability**)",
+ "RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html",
+ "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-14",
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/enable-configure-desync-mitigation-mode.html",
+ "https://support.icompaas.com/support/solutions/articles/62000233337-ensure-classic-load-balancer-is-configured-with-defensive-or-strictest-desync-mitigation-mode"
+ ],
"Remediation": {
"Code": {
- "CLI": "aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes '{\"DesyncMitigationMode\":\"defensive\"}'",
+ "CLI": "aws elb modify-load-balancer-attributes --load-balancer-name --load-balancer-attributes '{\"AdditionalAttributes\":[{\"Key\":\"elb.http.desyncmitigationmode\",\"Value\":\"defensive\"}]}'",
"NativeIaC": "",
- "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/elb-controls.html#elb-14",
- "Terraform": ""
+ "Other": "1. Open the AWS Management Console and go to EC2\n2. Under Load Balancing, select Load Balancers\n3. Select your Classic Load Balancer\n4. On the Attributes tab, click Edit\n5. Set Desync mitigation mode to Defensive or Strictest\n6. Click Save changes",
+ "Terraform": "```hcl\nresource \"aws_elb\" \"\" {\n name = \"\"\n availability_zones = [\"\"]\n\n listener {\n instance_port = 80\n instance_protocol = \"http\"\n lb_port = 80\n lb_protocol = \"http\"\n }\n\n desync_mitigation_mode = \"defensive\" # Critical: sets CLB desync mitigation to defensive to pass the check\n}\n```"
},
"Recommendation": {
- "Text": "Configure the Classic Load Balancer with defensive or strictest desync mitigation mode to prevent security issues caused by HTTP desync.",
- "Url": "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/config-desync-mitigation-mode.html#update-desync-mitigation-mode"
+ "Text": "Set CLB desync mitigation to **`defensive`** or, where compatible, **`strictest`**. Validate in staging to avoid client breakage. Apply **defense in depth**: enforce strict header handling, pair with WAF controls, and monitor non-compliant request indicators.",
+ "Url": "https://hub.prowler.com/check/elb_desync_mitigation_mode"
}
},
"Categories": [],
diff --git a/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.metadata.json b/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.metadata.json
index 89418dd70e..95b16ec24c 100644
--- a/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.metadata.json
+++ b/prowler/providers/aws/services/elb/elb_insecure_ssl_ciphers/elb_insecure_ssl_ciphers.metadata.json
@@ -1,28 +1,38 @@
{
"Provider": "aws",
"CheckID": "elb_insecure_ssl_ciphers",
- "CheckTitle": "Check if Elastic Load Balancers have insecure SSL ciphers.",
+ "CheckTitle": "Elastic Load Balancer HTTPS listeners, if present, use the ELBSecurityPolicy-TLS-1-2-2017-01 policy",
"CheckType": [
- "Data Protection"
+ "Software and Configuration Checks/AWS Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+ "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+ "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
+ "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)"
],
"ServiceName": "elb",
"SubServiceName": "",
- "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
+ "ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "AwsElbLoadBalancer",
- "Description": "Check if Elastic Load Balancers have insecure SSL ciphers.",
- "Risk": "Using insecure ciphers could affect privacy of in transit information.",
+ "Description": "Elastic Load Balancer HTTPS listeners are assessed for use of a **strong TLS policy**. Listeners associated with `ELBSecurityPolicy-TLS-1-2-2017-01` are considered to negotiate only modern protocols and ciphers, avoiding legacy SSL/TLS and weak suites.",
+ "Risk": "Legacy TLS or weak ciphers allow downgrades and man-in-the-middle decryption or tampering. Attackers can capture credentials, inject responses, and pivot, undermining data-in-transit **confidentiality** and **integrity**, and risking **availability** through failed handshakes.",
"RelatedUrl": "",
+ "AdditionalURLs": [
+ "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/elb-security-policy.html",
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies",
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ssl-config-update.html",
+ "https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html"
+ ],
"Remediation": {
"Code": {
"CLI": "aws elb set-load-balancer-policies-of-listener --load-balancer-name --load-balancer-port 443 --policy-names ELBSecurityPolicy-TLS-1-2-2017-01",
- "NativeIaC": "",
- "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/ELB/elb-security-policy.html",
- "Terraform": "https://docs.prowler.com/checks/aws/general-policies/bc_aws_general_43#terraform"
+ "NativeIaC": "```yaml\n# CloudFormation: Classic ELB with TLS 1.2-only security policy on HTTPS listener\nResources:\n :\n Type: AWS::ElasticLoadBalancing::LoadBalancer\n Properties:\n AvailabilityZones:\n - \n Listeners:\n - LoadBalancerPort: 443\n InstancePort: 443\n Protocol: HTTPS\n InstanceProtocol: HTTPS\n SSLCertificateId: \n PolicyNames:\n - ELBSecurityPolicy-TLS-1-2-2017-01 # Critical: attach TLS 1.2-only policy to the HTTPS listener\n Policies:\n - PolicyName: ELBSecurityPolicy-TLS-1-2-2017-01 # Critical: create policy referencing the predefined TLS 1.2 policy\n PolicyType: SSLNegotiationPolicyType\n Attributes:\n - Name: Reference-Security-Policy\n Value: ELBSecurityPolicy-TLS-1-2-2017-01 # Critical: enforce TLS 1.2-only\n```",
+ "Other": "1. Open the AWS Management Console and go to EC2\n2. In the left menu, under Load Balancing, click Load Balancers\n3. Select your Classic Load Balancer\n4. On the Listeners tab, click Manage listeners (or Edit)\n5. Select the HTTPS (port 443) listener and under Security policy choose ELBSecurityPolicy-TLS-1-2-2017-01\n6. Click Save changes",
+ "Terraform": "```hcl\n# Create and attach TLS 1.2-only policy to a Classic ELB HTTPS listener\nresource \"aws_load_balancer_policy\" \"\" {\n load_balancer_name = \"\"\n policy_name = \"ELBSecurityPolicy-TLS-1-2-2017-01\" # Critical: policy named as required by the check\n policy_type_name = \"SSLNegotiationPolicyType\"\n\n policy_attributes {\n name = \"Reference-Security-Policy\"\n value = \"ELBSecurityPolicy-TLS-1-2-2017-01\" # Critical: reference the predefined TLS 1.2 policy\n }\n}\n\nresource \"aws_load_balancer_listener_policy\" \"\" {\n load_balancer_name = \"\"\n load_balancer_port = 443\n policy_names = [aws_load_balancer_policy.
+
+
+The architecture shows how AI assistants connect through the MCP protocol to access Prowler's three main components: Prowler Cloud/App for security operations, Prowler Hub for security knowledge, and Prowler Documentation for guidance and reference.
+
## Use Cases
The Prowler MCP Server enables powerful workflows through AI assistants:
diff --git a/docs/images/prowler_mcp_schema_dark.png b/docs/images/prowler_mcp_schema_dark.png
new file mode 100644
index 0000000000..7771557601
Binary files /dev/null and b/docs/images/prowler_mcp_schema_dark.png differ
diff --git a/docs/images/prowler_mcp_schema_light.png b/docs/images/prowler_mcp_schema_light.png
new file mode 100644
index 0000000000..c542d84ed2
Binary files /dev/null and b/docs/images/prowler_mcp_schema_light.png differ
diff --git a/docs/introduction.mdx b/docs/introduction.mdx
index 616ba34f53..603bd1afbd 100644
--- a/docs/introduction.mdx
+++ b/docs/introduction.mdx
@@ -28,7 +28,7 @@ The supported providers right now are:
| [AWS](/user-guide/providers/aws/getting-started-aws) | Official | UI, API, CLI |
| [Azure](/user-guide/providers/azure/getting-started-azure) | Official | UI, API, CLI |
| [Google Cloud](/user-guide/providers/gcp/getting-started-gcp) | Official | UI, API, CLI |
-| [Kubernetes](/user-guide/providers/kubernetes/in-cluster) | Official | UI, API, CLI |
+| [Kubernetes](/user-guide/providers/kubernetes/getting-started-k8s) | Official | UI, API, CLI |
| [M365](/user-guide/providers/microsoft365/getting-started-m365) | Official | UI, API, CLI |
| [Github](/user-guide/providers/github/getting-started-github) | Official | UI, API, CLI |
| [Oracle Cloud](/user-guide/providers/oci/getting-started-oci) | Official | UI, API, CLI |
diff --git a/docs/user-guide/cli/tutorials/compliance.mdx b/docs/user-guide/cli/tutorials/compliance.mdx
index da4d15e5c7..8754be6237 100644
--- a/docs/user-guide/cli/tutorials/compliance.mdx
+++ b/docs/user-guide/cli/tutorials/compliance.mdx
@@ -24,7 +24,7 @@ Standard results will be shown and additionally the framework information as the
**If Prowler can't find a resource related with a check from a compliance requirement, this requirement won't appear on the output**
-##Â List Available Compliance Frameworks
+## List Available Compliance Frameworks
To see which compliance frameworks are covered by Prowler, use the `--list-compliance` option:
@@ -34,7 +34,7 @@ prowler 
+
+To solve this issue, please activate the EU (Ireland) STS endpoint.
+
+
-* Authenticates as a service identity
-* Stable and auditable
-* Recommended for production
+
+ 
+ 
-Once chosen, enter the Provider UID for authentication:
-
-- **AWS**: Enter your AWS Account ID.
-- **GCP**: Enter your GCP Project ID.
-- **Azure**: Enter your Azure Subscription ID.
-- **Kubernetes**: Enter your Kubernetes Cluster context of your kubeconfig file.
-- **M365**: Enter your M365 Domain ID.
-
-Optionally, provide a **Provider Alias** for easier identification. Follow the instructions provided to add your credentials:
-
-### **Step 4.1: AWS Credentials**
-
-For AWS, enter your `AWS Account ID` and choose one of the following methods to connect:
-
-#### **Step 4.1.1: IAM Access Keys**
-
-1. Select `Connect via Credentials`.
-
- 
-
-2. Enter your `Access Key ID`, `Secret Access Key` and optionally a `Session Token`:
-
- 
-
-#### **Step 4.1.2: IAM Role**
-
-1. Select `Connect assuming IAM Role`.
-
- 
-
-2. Enter the `Role ARN` and any optional field like the AWS Access Keys to assume the role, the `External ID`, the `Role Session Name` or the `Session Duration`:
-
- 
-
-
-
----
-### **Step 4.3: GCP Credentials**
-
-For Google Cloud, first enter your `GCP Project ID` and then select the authentication method you want to use:
-
-- **Service Account Authentication** (**Recommended**)
-- **Application Default Credentials**
-
-**Service Account Authentication** is the recommended authentication method for automated systems and machine-to-machine interactions, like Prowler. For detailed information about this, refer to the [Google Cloud documentation](https://cloud.google.com/iam/docs/service-account-overview).
-
-
-
-If you are adding an **EKS**, **GKE**, **AKS** or external cluster, follow these additional steps to ensure proper authentication:
-
-**Make sure your cluster allow traffic from the Prowler Cloud IP address `52.48.254.174/32`**
-
-1. Apply the necessary Kubernetes resources to your EKS, GKE, AKS or external cluster (you can find the files in the [`kubernetes` directory of the Prowler repository](https://github.com/prowler-cloud/prowler/tree/master/kubernetes)):
-
- ```console
- kubectl apply -f kubernetes/prowler-sa.yaml
- kubectl apply -f kubernetes/prowler-role.yaml
- kubectl apply -f kubernetes/prowler-rolebinding.yaml
- ```
-
-2. Generate a long-lived token for authentication:
-
- ```console
- kubectl create token prowler-sa -n prowler-ns --duration=0
- ```
-
- - **Security Note:** The `--duration=0` option generates a non-expiring token, which may pose a security risk if not managed properly. Users should decide on an appropriate expiration time based on their security policies. If a limited-time token is preferred, set `--duration=