|
|
|
@@ -1,962 +0,0 @@
|
|
|
|
|
import { ProviderType } from "@/types/providers";
|
|
|
|
|
|
|
|
|
|
const checksByProvider = async (provider_type: string) => {
|
|
|
|
|
const checksByProvider: Record<ProviderType, string[]> = {
|
|
|
|
|
aws: [
|
|
|
|
|
"accessanalyzer_enabled",
|
|
|
|
|
"accessanalyzer_enabled_without_findings",
|
|
|
|
|
"account_maintain_current_contact_details",
|
|
|
|
|
"account_maintain_different_contact_details_to_security_billing_and_operations",
|
|
|
|
|
"account_security_contact_information_is_registered",
|
|
|
|
|
"account_security_questions_are_registered_in_the_aws_account",
|
|
|
|
|
"acm_certificates_expiration_check",
|
|
|
|
|
"acm_certificates_transparency_logs_enabled",
|
|
|
|
|
"acm_certificates_with_secure_key_algorithms",
|
|
|
|
|
"apigateway_restapi_authorizers_enabled",
|
|
|
|
|
"apigateway_restapi_cache_encrypted",
|
|
|
|
|
"apigateway_restapi_client_certificate_enabled",
|
|
|
|
|
"apigateway_restapi_logging_enabled",
|
|
|
|
|
"apigateway_restapi_public",
|
|
|
|
|
"apigateway_restapi_public_with_authorizer",
|
|
|
|
|
"apigateway_restapi_tracing_enabled",
|
|
|
|
|
"apigateway_restapi_waf_acl_attached",
|
|
|
|
|
"apigatewayv2_api_access_logging_enabled",
|
|
|
|
|
"apigatewayv2_api_authorizers_enabled",
|
|
|
|
|
"appstream_fleet_default_internet_access_disabled",
|
|
|
|
|
"appstream_fleet_maximum_session_duration",
|
|
|
|
|
"appstream_fleet_session_disconnect_timeout",
|
|
|
|
|
"appstream_fleet_session_idle_disconnect_timeout",
|
|
|
|
|
"appsync_field_level_logging_enabled",
|
|
|
|
|
"appsync_graphql_api_no_api_key_authentication",
|
|
|
|
|
"athena_workgroup_encryption",
|
|
|
|
|
"athena_workgroup_enforce_configuration",
|
|
|
|
|
"athena_workgroup_logging_enabled",
|
|
|
|
|
"autoscaling_find_secrets_ec2_launch_configuration",
|
|
|
|
|
"autoscaling_group_capacity_rebalance_enabled",
|
|
|
|
|
"autoscaling_group_elb_health_check_enabled",
|
|
|
|
|
"autoscaling_group_launch_configuration_no_public_ip",
|
|
|
|
|
"autoscaling_group_launch_configuration_requires_imdsv2",
|
|
|
|
|
"autoscaling_group_multiple_az",
|
|
|
|
|
"autoscaling_group_multiple_instance_types",
|
|
|
|
|
"autoscaling_group_using_ec2_launch_template",
|
|
|
|
|
"awslambda_function_inside_vpc",
|
|
|
|
|
"awslambda_function_invoke_api_operations_cloudtrail_logging_enabled",
|
|
|
|
|
"awslambda_function_no_secrets_in_code",
|
|
|
|
|
"awslambda_function_no_secrets_in_variables",
|
|
|
|
|
"awslambda_function_not_publicly_accessible",
|
|
|
|
|
"awslambda_function_url_cors_policy",
|
|
|
|
|
"awslambda_function_url_public",
|
|
|
|
|
"awslambda_function_using_supported_runtimes",
|
|
|
|
|
"awslambda_function_vpc_multi_az",
|
|
|
|
|
"backup_plans_exist",
|
|
|
|
|
"backup_recovery_point_encrypted",
|
|
|
|
|
"backup_reportplans_exist",
|
|
|
|
|
"backup_vaults_encrypted",
|
|
|
|
|
"backup_vaults_exist",
|
|
|
|
|
"bedrock_agent_guardrail_enabled",
|
|
|
|
|
"bedrock_guardrail_prompt_attack_filter_enabled",
|
|
|
|
|
"bedrock_guardrail_sensitive_information_filter_enabled",
|
|
|
|
|
"bedrock_model_invocation_logging_enabled",
|
|
|
|
|
"bedrock_model_invocation_logs_encryption_enabled",
|
|
|
|
|
"cloudformation_stack_cdktoolkit_bootstrap_version",
|
|
|
|
|
"cloudformation_stack_outputs_find_secrets",
|
|
|
|
|
"cloudformation_stacks_termination_protection_enabled",
|
|
|
|
|
"cloudfront_distributions_custom_ssl_certificate",
|
|
|
|
|
"cloudfront_distributions_default_root_object",
|
|
|
|
|
"cloudfront_distributions_field_level_encryption_enabled",
|
|
|
|
|
"cloudfront_distributions_geo_restrictions_enabled",
|
|
|
|
|
"cloudfront_distributions_https_enabled",
|
|
|
|
|
"cloudfront_distributions_https_sni_enabled",
|
|
|
|
|
"cloudfront_distributions_logging_enabled",
|
|
|
|
|
"cloudfront_distributions_multiple_origin_failover_configured",
|
|
|
|
|
"cloudfront_distributions_origin_traffic_encrypted",
|
|
|
|
|
"cloudfront_distributions_s3_origin_access_control",
|
|
|
|
|
"cloudfront_distributions_s3_origin_non_existent_bucket",
|
|
|
|
|
"cloudfront_distributions_using_deprecated_ssl_protocols",
|
|
|
|
|
"cloudfront_distributions_using_waf",
|
|
|
|
|
"cloudtrail_bucket_requires_mfa_delete",
|
|
|
|
|
"cloudtrail_cloudwatch_logging_enabled",
|
|
|
|
|
"cloudtrail_insights_exist",
|
|
|
|
|
"cloudtrail_kms_encryption_enabled",
|
|
|
|
|
"cloudtrail_log_file_validation_enabled",
|
|
|
|
|
"cloudtrail_logs_s3_bucket_access_logging_enabled",
|
|
|
|
|
"cloudtrail_logs_s3_bucket_is_not_publicly_accessible",
|
|
|
|
|
"cloudtrail_multi_region_enabled",
|
|
|
|
|
"cloudtrail_multi_region_enabled_logging_management_events",
|
|
|
|
|
"cloudtrail_s3_dataevents_read_enabled",
|
|
|
|
|
"cloudtrail_s3_dataevents_write_enabled",
|
|
|
|
|
"cloudtrail_threat_detection_enumeration",
|
|
|
|
|
"cloudtrail_threat_detection_llm_jacking",
|
|
|
|
|
"cloudtrail_threat_detection_privilege_escalation",
|
|
|
|
|
"cloudwatch_alarm_actions_alarm_state_configured",
|
|
|
|
|
"cloudwatch_alarm_actions_enabled",
|
|
|
|
|
"cloudwatch_changes_to_network_acls_alarm_configured",
|
|
|
|
|
"cloudwatch_changes_to_network_gateways_alarm_configured",
|
|
|
|
|
"cloudwatch_changes_to_network_route_tables_alarm_configured",
|
|
|
|
|
"cloudwatch_changes_to_vpcs_alarm_configured",
|
|
|
|
|
"cloudwatch_cross_account_sharing_disabled",
|
|
|
|
|
"cloudwatch_log_group_kms_encryption_enabled",
|
|
|
|
|
"cloudwatch_log_group_no_secrets_in_logs",
|
|
|
|
|
"cloudwatch_log_group_not_publicly_accessible",
|
|
|
|
|
"cloudwatch_log_group_retention_policy_specific_days_enabled",
|
|
|
|
|
"cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
|
|
|
|
|
"cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
|
|
|
|
|
"cloudwatch_log_metric_filter_authentication_failures",
|
|
|
|
|
"cloudwatch_log_metric_filter_aws_organizations_changes",
|
|
|
|
|
"cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk",
|
|
|
|
|
"cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
|
|
|
|
|
"cloudwatch_log_metric_filter_policy_changes",
|
|
|
|
|
"cloudwatch_log_metric_filter_root_usage",
|
|
|
|
|
"cloudwatch_log_metric_filter_security_group_changes",
|
|
|
|
|
"cloudwatch_log_metric_filter_sign_in_without_mfa",
|
|
|
|
|
"cloudwatch_log_metric_filter_unauthorized_api_calls",
|
|
|
|
|
"codeartifact_packages_external_public_publishing_disabled",
|
|
|
|
|
"codebuild_project_logging_enabled",
|
|
|
|
|
"codebuild_project_no_secrets_in_variables",
|
|
|
|
|
"codebuild_project_older_90_days",
|
|
|
|
|
"codebuild_project_s3_logs_encrypted",
|
|
|
|
|
"codebuild_project_source_repo_url_no_sensitive_credentials",
|
|
|
|
|
"codebuild_project_user_controlled_buildspec",
|
|
|
|
|
"codebuild_report_group_export_encrypted",
|
|
|
|
|
"cognito_identity_pool_guest_access_disabled",
|
|
|
|
|
"cognito_user_pool_advanced_security_enabled",
|
|
|
|
|
"cognito_user_pool_blocks_compromised_credentials_sign_in_attempts",
|
|
|
|
|
"cognito_user_pool_blocks_potential_malicious_sign_in_attempts",
|
|
|
|
|
"cognito_user_pool_client_prevent_user_existence_errors",
|
|
|
|
|
"cognito_user_pool_client_token_revocation_enabled",
|
|
|
|
|
"cognito_user_pool_deletion_protection_enabled",
|
|
|
|
|
"cognito_user_pool_mfa_enabled",
|
|
|
|
|
"cognito_user_pool_password_policy_lowercase",
|
|
|
|
|
"cognito_user_pool_password_policy_minimum_length_14",
|
|
|
|
|
"cognito_user_pool_password_policy_number",
|
|
|
|
|
"cognito_user_pool_password_policy_symbol",
|
|
|
|
|
"cognito_user_pool_password_policy_uppercase",
|
|
|
|
|
"cognito_user_pool_self_registration_disabled",
|
|
|
|
|
"cognito_user_pool_temporary_password_expiration",
|
|
|
|
|
"cognito_user_pool_waf_acl_attached",
|
|
|
|
|
"config_recorder_all_regions_enabled",
|
|
|
|
|
"config_recorder_using_aws_service_role",
|
|
|
|
|
"datasync_task_logging_enabled",
|
|
|
|
|
"directconnect_connection_redundancy",
|
|
|
|
|
"directconnect_virtual_interface_redundancy",
|
|
|
|
|
"directoryservice_directory_log_forwarding_enabled",
|
|
|
|
|
"directoryservice_directory_monitor_notifications",
|
|
|
|
|
"directoryservice_directory_snapshots_limit",
|
|
|
|
|
"directoryservice_ldap_certificate_expiration",
|
|
|
|
|
"directoryservice_radius_server_security_protocol",
|
|
|
|
|
"directoryservice_supported_mfa_radius_enabled",
|
|
|
|
|
"dlm_ebs_snapshot_lifecycle_policy_exists",
|
|
|
|
|
"dms_endpoint_mongodb_authentication_enabled",
|
|
|
|
|
"dms_endpoint_neptune_iam_authorization_enabled",
|
|
|
|
|
"dms_endpoint_redis_in_transit_encryption_enabled",
|
|
|
|
|
"dms_endpoint_ssl_enabled",
|
|
|
|
|
"dms_instance_minor_version_upgrade_enabled",
|
|
|
|
|
"dms_instance_multi_az_enabled",
|
|
|
|
|
"dms_instance_no_public_access",
|
|
|
|
|
"dms_replication_task_source_logging_enabled",
|
|
|
|
|
"dms_replication_task_target_logging_enabled",
|
|
|
|
|
"documentdb_cluster_backup_enabled",
|
|
|
|
|
"documentdb_cluster_cloudwatch_log_export",
|
|
|
|
|
"documentdb_cluster_deletion_protection",
|
|
|
|
|
"documentdb_cluster_multi_az_enabled",
|
|
|
|
|
"documentdb_cluster_public_snapshot",
|
|
|
|
|
"documentdb_cluster_storage_encrypted",
|
|
|
|
|
"drs_job_exist",
|
|
|
|
|
"dynamodb_accelerator_cluster_encryption_enabled",
|
|
|
|
|
"dynamodb_accelerator_cluster_in_transit_encryption_enabled",
|
|
|
|
|
"dynamodb_accelerator_cluster_multi_az",
|
|
|
|
|
"dynamodb_table_autoscaling_enabled",
|
|
|
|
|
"dynamodb_table_cross_account_access",
|
|
|
|
|
"dynamodb_table_deletion_protection_enabled",
|
|
|
|
|
"dynamodb_table_protected_by_backup_plan",
|
|
|
|
|
"dynamodb_tables_kms_cmk_encryption_enabled",
|
|
|
|
|
"dynamodb_tables_pitr_enabled",
|
|
|
|
|
"ec2_ami_public",
|
|
|
|
|
"ec2_client_vpn_endpoint_connection_logging_enabled",
|
|
|
|
|
"ec2_ebs_default_encryption",
|
|
|
|
|
"ec2_ebs_public_snapshot",
|
|
|
|
|
"ec2_ebs_snapshot_account_block_public_access",
|
|
|
|
|
"ec2_ebs_snapshots_encrypted",
|
|
|
|
|
"ec2_ebs_volume_encryption",
|
|
|
|
|
"ec2_ebs_volume_protected_by_backup_plan",
|
|
|
|
|
"ec2_ebs_volume_snapshots_exists",
|
|
|
|
|
"ec2_elastic_ip_shodan",
|
|
|
|
|
"ec2_elastic_ip_unassigned",
|
|
|
|
|
"ec2_instance_account_imdsv2_enabled",
|
|
|
|
|
"ec2_instance_detailed_monitoring_enabled",
|
|
|
|
|
"ec2_instance_imdsv2_enabled",
|
|
|
|
|
"ec2_instance_internet_facing_with_instance_profile",
|
|
|
|
|
"ec2_instance_managed_by_ssm",
|
|
|
|
|
"ec2_instance_older_than_specific_days",
|
|
|
|
|
"ec2_instance_paravirtual_type",
|
|
|
|
|
"ec2_instance_port_cassandra_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_cifs_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_elasticsearch_kibana_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_ftp_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_kafka_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_kerberos_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_ldap_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_memcached_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_mongodb_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_mysql_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_oracle_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_postgresql_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_rdp_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_redis_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_sqlserver_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_ssh_exposed_to_internet",
|
|
|
|
|
"ec2_instance_port_telnet_exposed_to_internet",
|
|
|
|
|
"ec2_instance_profile_attached",
|
|
|
|
|
"ec2_instance_public_ip",
|
|
|
|
|
"ec2_instance_secrets_user_data",
|
|
|
|
|
"ec2_instance_uses_single_eni",
|
|
|
|
|
"ec2_launch_template_imdsv2_required",
|
|
|
|
|
"ec2_launch_template_no_public_ip",
|
|
|
|
|
"ec2_launch_template_no_secrets",
|
|
|
|
|
"ec2_networkacl_allow_ingress_any_port",
|
|
|
|
|
"ec2_networkacl_allow_ingress_tcp_port_22",
|
|
|
|
|
"ec2_networkacl_allow_ingress_tcp_port_3389",
|
|
|
|
|
"ec2_networkacl_unused",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_all_ports",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_any_port",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
|
|
|
|
|
"ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23",
|
|
|
|
|
"ec2_securitygroup_allow_wide_open_public_ipv4",
|
|
|
|
|
"ec2_securitygroup_default_restrict_traffic",
|
|
|
|
|
"ec2_securitygroup_from_launch_wizard",
|
|
|
|
|
"ec2_securitygroup_not_used",
|
|
|
|
|
"ec2_securitygroup_with_many_ingress_egress_rules",
|
|
|
|
|
"ec2_transitgateway_auto_accept_vpc_attachments",
|
|
|
|
|
"ecr_registry_scan_images_on_push_enabled",
|
|
|
|
|
"ecr_repositories_lifecycle_policy_enabled",
|
|
|
|
|
"ecr_repositories_not_publicly_accessible",
|
|
|
|
|
"ecr_repositories_scan_images_on_push_enabled",
|
|
|
|
|
"ecr_repositories_scan_vulnerabilities_in_latest_image",
|
|
|
|
|
"ecr_repositories_tag_immutability",
|
|
|
|
|
"ecs_cluster_container_insights_enabled",
|
|
|
|
|
"ecs_service_fargate_latest_platform_version",
|
|
|
|
|
"ecs_service_no_assign_public_ip",
|
|
|
|
|
"ecs_task_definitions_containers_readonly_access",
|
|
|
|
|
"ecs_task_definitions_host_namespace_not_shared",
|
|
|
|
|
"ecs_task_definitions_host_networking_mode_users",
|
|
|
|
|
"ecs_task_definitions_logging_block_mode",
|
|
|
|
|
"ecs_task_definitions_logging_enabled",
|
|
|
|
|
"ecs_task_definitions_no_environment_secrets",
|
|
|
|
|
"ecs_task_definitions_no_privileged_containers",
|
|
|
|
|
"ecs_task_set_no_assign_public_ip",
|
|
|
|
|
"efs_access_point_enforce_root_directory",
|
|
|
|
|
"efs_access_point_enforce_user_identity",
|
|
|
|
|
"efs_encryption_at_rest_enabled",
|
|
|
|
|
"efs_have_backup_enabled",
|
|
|
|
|
"efs_mount_target_not_publicly_accessible",
|
|
|
|
|
"efs_multi_az_enabled",
|
|
|
|
|
"efs_not_publicly_accessible",
|
|
|
|
|
"eks_cluster_kms_cmk_encryption_in_secrets_enabled",
|
|
|
|
|
"eks_cluster_network_policy_enabled",
|
|
|
|
|
"eks_cluster_not_publicly_accessible",
|
|
|
|
|
"eks_cluster_private_nodes_enabled",
|
|
|
|
|
"eks_cluster_uses_a_supported_version",
|
|
|
|
|
"eks_control_plane_logging_all_types_enabled",
|
|
|
|
|
"elasticache_cluster_uses_public_subnet",
|
|
|
|
|
"elasticache_redis_cluster_auto_minor_version_upgrades",
|
|
|
|
|
"elasticache_redis_cluster_automatic_failover_enabled",
|
|
|
|
|
"elasticache_redis_cluster_backup_enabled",
|
|
|
|
|
"elasticache_redis_cluster_in_transit_encryption_enabled",
|
|
|
|
|
"elasticache_redis_cluster_multi_az_enabled",
|
|
|
|
|
"elasticache_redis_cluster_rest_encryption_enabled",
|
|
|
|
|
"elasticache_redis_replication_group_auth_enabled",
|
|
|
|
|
"elasticbeanstalk_environment_cloudwatch_logging_enabled",
|
|
|
|
|
"elasticbeanstalk_environment_enhanced_health_reporting",
|
|
|
|
|
"elasticbeanstalk_environment_managed_updates_enabled",
|
|
|
|
|
"elb_connection_draining_enabled",
|
|
|
|
|
"elb_cross_zone_load_balancing_enabled",
|
|
|
|
|
"elb_desync_mitigation_mode",
|
|
|
|
|
"elb_insecure_ssl_ciphers",
|
|
|
|
|
"elb_internet_facing",
|
|
|
|
|
"elb_is_in_multiple_az",
|
|
|
|
|
"elb_logging_enabled",
|
|
|
|
|
"elb_ssl_listeners",
|
|
|
|
|
"elb_ssl_listeners_use_acm_certificate",
|
|
|
|
|
"elbv2_cross_zone_load_balancing_enabled",
|
|
|
|
|
"elbv2_deletion_protection",
|
|
|
|
|
"elbv2_desync_mitigation_mode",
|
|
|
|
|
"elbv2_insecure_ssl_ciphers",
|
|
|
|
|
"elbv2_internet_facing",
|
|
|
|
|
"elbv2_is_in_multiple_az",
|
|
|
|
|
"elbv2_listeners_underneath",
|
|
|
|
|
"elbv2_logging_enabled",
|
|
|
|
|
"elbv2_nlb_tls_termination_enabled",
|
|
|
|
|
"elbv2_ssl_listeners",
|
|
|
|
|
"elbv2_waf_acl_attached",
|
|
|
|
|
"emr_cluster_account_public_block_enabled",
|
|
|
|
|
"emr_cluster_master_nodes_no_public_ip",
|
|
|
|
|
"emr_cluster_publicly_accesible",
|
|
|
|
|
"eventbridge_bus_cross_account_access",
|
|
|
|
|
"eventbridge_bus_exposed",
|
|
|
|
|
"eventbridge_global_endpoint_event_replication_enabled",
|
|
|
|
|
"eventbridge_schema_registry_cross_account_access",
|
|
|
|
|
"firehose_stream_encrypted_at_rest",
|
|
|
|
|
"fms_policy_compliant",
|
|
|
|
|
"fsx_file_system_copy_tags_to_backups_enabled",
|
|
|
|
|
"fsx_file_system_copy_tags_to_volumes_enabled",
|
|
|
|
|
"fsx_windows_file_system_multi_az_enabled",
|
|
|
|
|
"glacier_vaults_policy_public_access",
|
|
|
|
|
"glue_data_catalogs_connection_passwords_encryption_enabled",
|
|
|
|
|
"glue_data_catalogs_metadata_encryption_enabled",
|
|
|
|
|
"glue_data_catalogs_not_publicly_accessible",
|
|
|
|
|
"glue_database_connections_ssl_enabled",
|
|
|
|
|
"glue_development_endpoints_cloudwatch_logs_encryption_enabled",
|
|
|
|
|
"glue_development_endpoints_job_bookmark_encryption_enabled",
|
|
|
|
|
"glue_development_endpoints_s3_encryption_enabled",
|
|
|
|
|
"glue_etl_jobs_amazon_s3_encryption_enabled",
|
|
|
|
|
"glue_etl_jobs_cloudwatch_logs_encryption_enabled",
|
|
|
|
|
"glue_etl_jobs_job_bookmark_encryption_enabled",
|
|
|
|
|
"glue_etl_jobs_logging_enabled",
|
|
|
|
|
"glue_ml_transform_encrypted_at_rest",
|
|
|
|
|
"guardduty_centrally_managed",
|
|
|
|
|
"guardduty_ec2_malware_protection_enabled",
|
|
|
|
|
"guardduty_eks_audit_log_enabled",
|
|
|
|
|
"guardduty_eks_runtime_monitoring_enabled",
|
|
|
|
|
"guardduty_is_enabled",
|
|
|
|
|
"guardduty_lambda_protection_enabled",
|
|
|
|
|
"guardduty_no_high_severity_findings",
|
|
|
|
|
"guardduty_rds_protection_enabled",
|
|
|
|
|
"guardduty_s3_protection_enabled",
|
|
|
|
|
"iam_administrator_access_with_mfa",
|
|
|
|
|
"iam_avoid_root_usage",
|
|
|
|
|
"iam_aws_attached_policy_no_administrative_privileges",
|
|
|
|
|
"iam_check_saml_providers_sts",
|
|
|
|
|
"iam_customer_attached_policy_no_administrative_privileges",
|
|
|
|
|
"iam_customer_unattached_policy_no_administrative_privileges",
|
|
|
|
|
"iam_group_administrator_access_policy",
|
|
|
|
|
"iam_inline_policy_allows_privilege_escalation",
|
|
|
|
|
"iam_inline_policy_no_administrative_privileges",
|
|
|
|
|
"iam_inline_policy_no_full_access_to_cloudtrail",
|
|
|
|
|
"iam_inline_policy_no_full_access_to_kms",
|
|
|
|
|
"iam_no_custom_policy_permissive_role_assumption",
|
|
|
|
|
"iam_no_expired_server_certificates_stored",
|
|
|
|
|
"iam_no_root_access_key",
|
|
|
|
|
"iam_password_policy_expires_passwords_within_90_days_or_less",
|
|
|
|
|
"iam_password_policy_lowercase",
|
|
|
|
|
"iam_password_policy_minimum_length_14",
|
|
|
|
|
"iam_password_policy_number",
|
|
|
|
|
"iam_password_policy_reuse_24",
|
|
|
|
|
"iam_password_policy_symbol",
|
|
|
|
|
"iam_password_policy_uppercase",
|
|
|
|
|
"iam_policy_allows_privilege_escalation",
|
|
|
|
|
"iam_policy_attached_only_to_group_or_roles",
|
|
|
|
|
"iam_policy_cloudshell_admin_not_attached",
|
|
|
|
|
"iam_policy_no_full_access_to_cloudtrail",
|
|
|
|
|
"iam_policy_no_full_access_to_kms",
|
|
|
|
|
"iam_role_administratoraccess_policy",
|
|
|
|
|
"iam_role_cross_account_readonlyaccess_policy",
|
|
|
|
|
"iam_role_cross_service_confused_deputy_prevention",
|
|
|
|
|
"iam_root_credentials_management_enabled",
|
|
|
|
|
"iam_root_hardware_mfa_enabled",
|
|
|
|
|
"iam_root_mfa_enabled",
|
|
|
|
|
"iam_rotate_access_key_90_days",
|
|
|
|
|
"iam_securityaudit_role_created",
|
|
|
|
|
"iam_support_role_created",
|
|
|
|
|
"iam_user_accesskey_unused",
|
|
|
|
|
"iam_user_administrator_access_policy",
|
|
|
|
|
"iam_user_console_access_unused",
|
|
|
|
|
"iam_user_hardware_mfa_enabled",
|
|
|
|
|
"iam_user_mfa_enabled_console_access",
|
|
|
|
|
"iam_user_no_setup_initial_access_key",
|
|
|
|
|
"iam_user_two_active_access_key",
|
|
|
|
|
"iam_user_with_temporary_credentials",
|
|
|
|
|
"inspector2_active_findings_exist",
|
|
|
|
|
"inspector2_is_enabled",
|
|
|
|
|
"kafka_cluster_encryption_at_rest_uses_cmk",
|
|
|
|
|
"kafka_cluster_enhanced_monitoring_enabled",
|
|
|
|
|
"kafka_cluster_in_transit_encryption_enabled",
|
|
|
|
|
"kafka_cluster_is_public",
|
|
|
|
|
"kafka_cluster_mutual_tls_authentication_enabled",
|
|
|
|
|
"kafka_cluster_unrestricted_access_disabled",
|
|
|
|
|
"kafka_cluster_uses_latest_version",
|
|
|
|
|
"kafka_connector_in_transit_encryption_enabled",
|
|
|
|
|
"kinesis_stream_data_retention_period",
|
|
|
|
|
"kinesis_stream_encrypted_at_rest",
|
|
|
|
|
"kms_cmk_are_used",
|
|
|
|
|
"kms_cmk_not_deleted_unintentionally",
|
|
|
|
|
"kms_cmk_not_multi_region",
|
|
|
|
|
"kms_cmk_rotation_enabled",
|
|
|
|
|
"kms_key_not_publicly_accessible",
|
|
|
|
|
"lightsail_database_public",
|
|
|
|
|
"lightsail_instance_automated_snapshots",
|
|
|
|
|
"lightsail_instance_public",
|
|
|
|
|
"lightsail_static_ip_unused",
|
|
|
|
|
"macie_automated_sensitive_data_discovery_enabled",
|
|
|
|
|
"macie_is_enabled",
|
|
|
|
|
"memorydb_cluster_auto_minor_version_upgrades",
|
|
|
|
|
"mq_broker_active_deployment_mode",
|
|
|
|
|
"mq_broker_auto_minor_version_upgrades",
|
|
|
|
|
"mq_broker_cluster_deployment_mode",
|
|
|
|
|
"mq_broker_logging_enabled",
|
|
|
|
|
"mq_broker_not_publicly_accessible",
|
|
|
|
|
"neptune_cluster_backup_enabled",
|
|
|
|
|
"neptune_cluster_copy_tags_to_snapshots",
|
|
|
|
|
"neptune_cluster_deletion_protection",
|
|
|
|
|
"neptune_cluster_iam_authentication_enabled",
|
|
|
|
|
"neptune_cluster_integration_cloudwatch_logs",
|
|
|
|
|
"neptune_cluster_multi_az",
|
|
|
|
|
"neptune_cluster_public_snapshot",
|
|
|
|
|
"neptune_cluster_snapshot_encrypted",
|
|
|
|
|
"neptune_cluster_storage_encrypted",
|
|
|
|
|
"neptune_cluster_uses_public_subnet",
|
|
|
|
|
"networkfirewall_deletion_protection",
|
|
|
|
|
"networkfirewall_in_all_vpc",
|
|
|
|
|
"networkfirewall_logging_enabled",
|
|
|
|
|
"networkfirewall_multi_az",
|
|
|
|
|
"networkfirewall_policy_default_action_fragmented_packets",
|
|
|
|
|
"networkfirewall_policy_default_action_full_packets",
|
|
|
|
|
"networkfirewall_policy_rule_group_associated",
|
|
|
|
|
"opensearch_service_domains_access_control_enabled",
|
|
|
|
|
"opensearch_service_domains_audit_logging_enabled",
|
|
|
|
|
"opensearch_service_domains_cloudwatch_logging_enabled",
|
|
|
|
|
"opensearch_service_domains_encryption_at_rest_enabled",
|
|
|
|
|
"opensearch_service_domains_fault_tolerant_data_nodes",
|
|
|
|
|
"opensearch_service_domains_fault_tolerant_master_nodes",
|
|
|
|
|
"opensearch_service_domains_https_communications_enforced",
|
|
|
|
|
"opensearch_service_domains_internal_user_database_enabled",
|
|
|
|
|
"opensearch_service_domains_node_to_node_encryption_enabled",
|
|
|
|
|
"opensearch_service_domains_not_publicly_accessible",
|
|
|
|
|
"opensearch_service_domains_updated_to_the_latest_service_software_version",
|
|
|
|
|
"opensearch_service_domains_use_cognito_authentication_for_kibana",
|
|
|
|
|
"organizations_account_part_of_organizations",
|
|
|
|
|
"organizations_delegated_administrators",
|
|
|
|
|
"organizations_opt_out_ai_services_policy",
|
|
|
|
|
"organizations_scp_check_deny_regions",
|
|
|
|
|
"organizations_tags_policies_enabled_and_attached",
|
|
|
|
|
"rds_cluster_backtrack_enabled",
|
|
|
|
|
"rds_cluster_copy_tags_to_snapshots",
|
|
|
|
|
"rds_cluster_critical_event_subscription",
|
|
|
|
|
"rds_cluster_default_admin",
|
|
|
|
|
"rds_cluster_deletion_protection",
|
|
|
|
|
"rds_cluster_iam_authentication_enabled",
|
|
|
|
|
"rds_cluster_integration_cloudwatch_logs",
|
|
|
|
|
"rds_cluster_minor_version_upgrade_enabled",
|
|
|
|
|
"rds_cluster_multi_az",
|
|
|
|
|
"rds_cluster_non_default_port",
|
|
|
|
|
"rds_cluster_protected_by_backup_plan",
|
|
|
|
|
"rds_cluster_storage_encrypted",
|
|
|
|
|
"rds_instance_backup_enabled",
|
|
|
|
|
"rds_instance_certificate_expiration",
|
|
|
|
|
"rds_instance_copy_tags_to_snapshots",
|
|
|
|
|
"rds_instance_critical_event_subscription",
|
|
|
|
|
"rds_instance_default_admin",
|
|
|
|
|
"rds_instance_deletion_protection",
|
|
|
|
|
"rds_instance_deprecated_engine_version",
|
|
|
|
|
"rds_instance_enhanced_monitoring_enabled",
|
|
|
|
|
"rds_instance_event_subscription_parameter_groups",
|
|
|
|
|
"rds_instance_event_subscription_security_groups",
|
|
|
|
|
"rds_instance_iam_authentication_enabled",
|
|
|
|
|
"rds_instance_inside_vpc",
|
|
|
|
|
"rds_instance_integration_cloudwatch_logs",
|
|
|
|
|
"rds_instance_minor_version_upgrade_enabled",
|
|
|
|
|
"rds_instance_multi_az",
|
|
|
|
|
"rds_instance_no_public_access",
|
|
|
|
|
"rds_instance_non_default_port",
|
|
|
|
|
"rds_instance_protected_by_backup_plan",
|
|
|
|
|
"rds_instance_storage_encrypted",
|
|
|
|
|
"rds_instance_transport_encrypted",
|
|
|
|
|
"rds_snapshots_encrypted",
|
|
|
|
|
"rds_snapshots_public_access",
|
|
|
|
|
"redshift_cluster_audit_logging",
|
|
|
|
|
"redshift_cluster_automated_snapshot",
|
|
|
|
|
"redshift_cluster_automatic_upgrades",
|
|
|
|
|
"redshift_cluster_encrypted_at_rest",
|
|
|
|
|
"redshift_cluster_enhanced_vpc_routing",
|
|
|
|
|
"redshift_cluster_in_transit_encryption_enabled",
|
|
|
|
|
"redshift_cluster_multi_az_enabled",
|
|
|
|
|
"redshift_cluster_non_default_database_name",
|
|
|
|
|
"redshift_cluster_non_default_username",
|
|
|
|
|
"redshift_cluster_public_access",
|
|
|
|
|
"resourceexplorer2_indexes_found",
|
|
|
|
|
"route53_dangling_ip_subdomain_takeover",
|
|
|
|
|
"route53_domains_privacy_protection_enabled",
|
|
|
|
|
"route53_domains_transferlock_enabled",
|
|
|
|
|
"route53_public_hosted_zones_cloudwatch_logging_enabled",
|
|
|
|
|
"s3_access_point_public_access_block",
|
|
|
|
|
"s3_account_level_public_access_blocks",
|
|
|
|
|
"s3_bucket_acl_prohibited",
|
|
|
|
|
"s3_bucket_cross_account_access",
|
|
|
|
|
"s3_bucket_cross_region_replication",
|
|
|
|
|
"s3_bucket_default_encryption",
|
|
|
|
|
"s3_bucket_event_notifications_enabled",
|
|
|
|
|
"s3_bucket_kms_encryption",
|
|
|
|
|
"s3_bucket_level_public_access_block",
|
|
|
|
|
"s3_bucket_lifecycle_enabled",
|
|
|
|
|
"s3_bucket_no_mfa_delete",
|
|
|
|
|
"s3_bucket_object_lock",
|
|
|
|
|
"s3_bucket_object_versioning",
|
|
|
|
|
"s3_bucket_policy_public_write_access",
|
|
|
|
|
"s3_bucket_public_access",
|
|
|
|
|
"s3_bucket_public_list_acl",
|
|
|
|
|
"s3_bucket_public_write_acl",
|
|
|
|
|
"s3_bucket_secure_transport_policy",
|
|
|
|
|
"s3_bucket_server_access_logging_enabled",
|
|
|
|
|
"s3_multi_region_access_point_public_access_block",
|
|
|
|
|
"sagemaker_endpoint_config_prod_variant_instances",
|
|
|
|
|
"sagemaker_models_network_isolation_enabled",
|
|
|
|
|
"sagemaker_models_vpc_settings_configured",
|
|
|
|
|
"sagemaker_notebook_instance_encryption_enabled",
|
|
|
|
|
"sagemaker_notebook_instance_root_access_disabled",
|
|
|
|
|
"sagemaker_notebook_instance_vpc_settings_configured",
|
|
|
|
|
"sagemaker_notebook_instance_without_direct_internet_access_configured",
|
|
|
|
|
"sagemaker_training_jobs_intercontainer_encryption_enabled",
|
|
|
|
|
"sagemaker_training_jobs_network_isolation_enabled",
|
|
|
|
|
"sagemaker_training_jobs_volume_and_output_encryption_enabled",
|
|
|
|
|
"sagemaker_training_jobs_vpc_settings_configured",
|
|
|
|
|
"secretsmanager_automatic_rotation_enabled",
|
|
|
|
|
"secretsmanager_not_publicly_accessible",
|
|
|
|
|
"secretsmanager_secret_rotated_periodically",
|
|
|
|
|
"secretsmanager_secret_unused",
|
|
|
|
|
"securityhub_enabled",
|
|
|
|
|
"servicecatalog_portfolio_shared_within_organization_only",
|
|
|
|
|
"ses_identity_not_publicly_accessible",
|
|
|
|
|
"shield_advanced_protection_in_associated_elastic_ips",
|
|
|
|
|
"shield_advanced_protection_in_classic_load_balancers",
|
|
|
|
|
"shield_advanced_protection_in_cloudfront_distributions",
|
|
|
|
|
"shield_advanced_protection_in_global_accelerators",
|
|
|
|
|
"shield_advanced_protection_in_internet_facing_load_balancers",
|
|
|
|
|
"shield_advanced_protection_in_route53_hosted_zones",
|
|
|
|
|
"sns_subscription_not_using_http_endpoints",
|
|
|
|
|
"sns_topics_kms_encryption_at_rest_enabled",
|
|
|
|
|
"sns_topics_not_publicly_accessible",
|
|
|
|
|
"sqs_queues_not_publicly_accessible",
|
|
|
|
|
"sqs_queues_server_side_encryption_enabled",
|
|
|
|
|
"ssm_document_secrets",
|
|
|
|
|
"ssm_documents_set_as_public",
|
|
|
|
|
"ssm_managed_compliant_patching",
|
|
|
|
|
"ssmincidents_enabled_with_plans",
|
|
|
|
|
"stepfunctions_statemachine_logging_enabled",
|
|
|
|
|
"storagegateway_fileshare_encryption_enabled",
|
|
|
|
|
"storagegateway_gateway_fault_tolerant",
|
|
|
|
|
"transfer_server_in_transit_encryption_enabled",
|
|
|
|
|
"trustedadvisor_errors_and_warnings",
|
|
|
|
|
"trustedadvisor_premium_support_plan_subscribed",
|
|
|
|
|
"vpc_different_regions",
|
|
|
|
|
"vpc_endpoint_connections_trust_boundaries",
|
|
|
|
|
"vpc_endpoint_for_ec2_enabled",
|
|
|
|
|
"vpc_endpoint_multi_az_enabled",
|
|
|
|
|
"vpc_endpoint_services_allowed_principals_trust_boundaries",
|
|
|
|
|
"vpc_flow_logs_enabled",
|
|
|
|
|
"vpc_peering_routing_tables_with_least_privilege",
|
|
|
|
|
"vpc_subnet_different_az",
|
|
|
|
|
"vpc_subnet_no_public_ip_by_default",
|
|
|
|
|
"vpc_subnet_separate_private_public",
|
|
|
|
|
"vpc_vpn_connection_tunnels_up",
|
|
|
|
|
"waf_global_rule_with_conditions",
|
|
|
|
|
"waf_global_rulegroup_not_empty",
|
|
|
|
|
"waf_global_webacl_logging_enabled",
|
|
|
|
|
"waf_global_webacl_with_rules",
|
|
|
|
|
"waf_regional_rule_with_conditions",
|
|
|
|
|
"waf_regional_rulegroup_not_empty",
|
|
|
|
|
"waf_regional_webacl_with_rules",
|
|
|
|
|
"wafv2_webacl_logging_enabled",
|
|
|
|
|
"wafv2_webacl_rule_logging_enabled",
|
|
|
|
|
"wafv2_webacl_with_rules",
|
|
|
|
|
"wellarchitected_workload_no_high_or_medium_risks",
|
|
|
|
|
"workspaces_volume_encryption_enabled",
|
|
|
|
|
"workspaces_vpc_2private_1public_subnets_nat",
|
|
|
|
|
],
|
|
|
|
|
gcp: [
|
|
|
|
|
"apikeys_api_restrictions_configured",
|
|
|
|
|
"apikeys_key_exists",
|
|
|
|
|
"apikeys_key_rotated_in_90_days",
|
|
|
|
|
"artifacts_container_analysis_enabled",
|
|
|
|
|
"bigquery_dataset_cmk_encryption",
|
|
|
|
|
"bigquery_dataset_public_access",
|
|
|
|
|
"bigquery_table_cmk_encryption",
|
|
|
|
|
"cloudsql_instance_automated_backups",
|
|
|
|
|
"cloudsql_instance_mysql_local_infile_flag",
|
|
|
|
|
"cloudsql_instance_mysql_skip_show_database_flag",
|
|
|
|
|
"cloudsql_instance_postgres_enable_pgaudit_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_connections_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_disconnections_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_error_verbosity_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_min_duration_statement_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_min_error_statement_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_min_messages_flag",
|
|
|
|
|
"cloudsql_instance_postgres_log_statement_flag",
|
|
|
|
|
"cloudsql_instance_private_ip_assignment",
|
|
|
|
|
"cloudsql_instance_public_access",
|
|
|
|
|
"cloudsql_instance_public_ip",
|
|
|
|
|
"cloudsql_instance_sqlserver_contained_database_authentication_flag",
|
|
|
|
|
"cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag",
|
|
|
|
|
"cloudsql_instance_sqlserver_external_scripts_enabled_flag",
|
|
|
|
|
"cloudsql_instance_sqlserver_remote_access_flag",
|
|
|
|
|
"cloudsql_instance_sqlserver_trace_flag",
|
|
|
|
|
"cloudsql_instance_sqlserver_user_connections_flag",
|
|
|
|
|
"cloudsql_instance_sqlserver_user_options_flag",
|
|
|
|
|
"cloudsql_instance_ssl_connections",
|
|
|
|
|
"cloudstorage_bucket_log_retention_policy_lock",
|
|
|
|
|
"cloudstorage_bucket_public_access",
|
|
|
|
|
"cloudstorage_bucket_uniform_bucket_level_access",
|
|
|
|
|
"compute_firewall_rdp_access_from_the_internet_allowed",
|
|
|
|
|
"compute_firewall_ssh_access_from_the_internet_allowed",
|
|
|
|
|
"compute_instance_block_project_wide_ssh_keys_disabled",
|
|
|
|
|
"compute_instance_confidential_computing_enabled",
|
|
|
|
|
"compute_instance_default_service_account_in_use",
|
|
|
|
|
"compute_instance_default_service_account_in_use_with_full_api_access",
|
|
|
|
|
"compute_instance_encryption_with_csek_enabled",
|
|
|
|
|
"compute_instance_ip_forwarding_is_enabled",
|
|
|
|
|
"compute_instance_public_ip",
|
|
|
|
|
"compute_instance_serial_ports_in_use",
|
|
|
|
|
"compute_instance_shielded_vm_enabled",
|
|
|
|
|
"compute_loadbalancer_logging_enabled",
|
|
|
|
|
"compute_network_default_in_use",
|
|
|
|
|
"compute_network_dns_logging_enabled",
|
|
|
|
|
"compute_network_not_legacy",
|
|
|
|
|
"compute_project_os_login_enabled",
|
|
|
|
|
"compute_public_address_shodan",
|
|
|
|
|
"compute_subnet_flow_logs_enabled",
|
|
|
|
|
"dataproc_encrypted_with_cmks_disabled",
|
|
|
|
|
"dns_dnssec_disabled",
|
|
|
|
|
"dns_rsasha1_in_use_to_key_sign_in_dnssec",
|
|
|
|
|
"dns_rsasha1_in_use_to_zone_sign_in_dnssec",
|
|
|
|
|
"gcr_container_scanning_enabled",
|
|
|
|
|
"gke_cluster_no_default_service_account",
|
|
|
|
|
"iam_account_access_approval_enabled",
|
|
|
|
|
"iam_audit_logs_enabled",
|
|
|
|
|
"iam_cloud_asset_inventory_enabled",
|
|
|
|
|
"iam_no_service_roles_at_project_level",
|
|
|
|
|
"iam_organization_essential_contacts_configured",
|
|
|
|
|
"iam_role_kms_enforce_separation_of_duties",
|
|
|
|
|
"iam_role_sa_enforce_separation_of_duties",
|
|
|
|
|
"iam_sa_no_administrative_privileges",
|
|
|
|
|
"iam_sa_no_user_managed_keys",
|
|
|
|
|
"iam_sa_user_managed_key_rotate_90_days",
|
|
|
|
|
"iam_sa_user_managed_key_unused",
|
|
|
|
|
"iam_service_account_unused",
|
|
|
|
|
"kms_key_not_publicly_accessible",
|
|
|
|
|
"kms_key_rotation_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
|
|
|
|
|
"logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
|
|
|
|
|
"logging_sink_created",
|
|
|
|
|
],
|
|
|
|
|
azure: [
|
|
|
|
|
"aisearch_service_not_publicly_accessible",
|
|
|
|
|
"aks_cluster_rbac_enabled",
|
|
|
|
|
"aks_clusters_created_with_private_nodes",
|
|
|
|
|
"aks_clusters_public_access_disabled",
|
|
|
|
|
"aks_network_policy_enabled",
|
|
|
|
|
"app_client_certificates_on",
|
|
|
|
|
"app_ensure_auth_is_set_up",
|
|
|
|
|
"app_ensure_http_is_redirected_to_https",
|
|
|
|
|
"app_ensure_java_version_is_latest",
|
|
|
|
|
"app_ensure_php_version_is_latest",
|
|
|
|
|
"app_ensure_python_version_is_latest",
|
|
|
|
|
"app_ensure_using_http20",
|
|
|
|
|
"app_ftp_deployment_disabled",
|
|
|
|
|
"app_function_access_keys_configured",
|
|
|
|
|
"app_function_application_insights_enabled",
|
|
|
|
|
"app_function_ftps_deployment_disabled",
|
|
|
|
|
"app_function_identity_is_configured",
|
|
|
|
|
"app_function_identity_without_admin_privileges",
|
|
|
|
|
"app_function_latest_runtime_version",
|
|
|
|
|
"app_function_not_publicly_accessible",
|
|
|
|
|
"app_function_vnet_integration_enabled",
|
|
|
|
|
"app_http_logs_enabled",
|
|
|
|
|
"app_minimum_tls_version_12",
|
|
|
|
|
"app_register_with_identity",
|
|
|
|
|
"appinsights_ensure_is_configured",
|
|
|
|
|
"containerregistry_admin_user_disabled",
|
|
|
|
|
"containerregistry_not_publicly_accessible",
|
|
|
|
|
"containerregistry_uses_private_link",
|
|
|
|
|
"cosmosdb_account_firewall_use_selected_networks",
|
|
|
|
|
"cosmosdb_account_use_aad_and_rbac",
|
|
|
|
|
"cosmosdb_account_use_private_endpoints",
|
|
|
|
|
"defender_additional_email_configured_with_a_security_contact",
|
|
|
|
|
"defender_assessments_vm_endpoint_protection_installed",
|
|
|
|
|
"defender_auto_provisioning_log_analytics_agent_vms_on",
|
|
|
|
|
"defender_auto_provisioning_vulnerabilty_assessments_machines_on",
|
|
|
|
|
"defender_container_images_resolved_vulnerabilities",
|
|
|
|
|
"defender_container_images_scan_enabled",
|
|
|
|
|
"defender_ensure_defender_for_app_services_is_on",
|
|
|
|
|
"defender_ensure_defender_for_arm_is_on",
|
|
|
|
|
"defender_ensure_defender_for_azure_sql_databases_is_on",
|
|
|
|
|
"defender_ensure_defender_for_containers_is_on",
|
|
|
|
|
"defender_ensure_defender_for_cosmosdb_is_on",
|
|
|
|
|
"defender_ensure_defender_for_databases_is_on",
|
|
|
|
|
"defender_ensure_defender_for_dns_is_on",
|
|
|
|
|
"defender_ensure_defender_for_keyvault_is_on",
|
|
|
|
|
"defender_ensure_defender_for_os_relational_databases_is_on",
|
|
|
|
|
"defender_ensure_defender_for_server_is_on",
|
|
|
|
|
"defender_ensure_defender_for_sql_servers_is_on",
|
|
|
|
|
"defender_ensure_defender_for_storage_is_on",
|
|
|
|
|
"defender_ensure_iot_hub_defender_is_on",
|
|
|
|
|
"defender_ensure_mcas_is_enabled",
|
|
|
|
|
"defender_ensure_notify_alerts_severity_is_high",
|
|
|
|
|
"defender_ensure_notify_emails_to_owners",
|
|
|
|
|
"defender_ensure_system_updates_are_applied",
|
|
|
|
|
"defender_ensure_wdatp_is_enabled",
|
|
|
|
|
"entra_conditional_access_policy_require_mfa_for_management_api",
|
|
|
|
|
"entra_global_admin_in_less_than_five_users",
|
|
|
|
|
"entra_non_privileged_user_has_mfa",
|
|
|
|
|
"entra_policy_default_users_cannot_create_security_groups",
|
|
|
|
|
"entra_policy_ensure_default_user_cannot_create_apps",
|
|
|
|
|
"entra_policy_ensure_default_user_cannot_create_tenants",
|
|
|
|
|
"entra_policy_guest_invite_only_for_admin_roles",
|
|
|
|
|
"entra_policy_guest_users_access_restrictions",
|
|
|
|
|
"entra_policy_restricts_user_consent_for_apps",
|
|
|
|
|
"entra_policy_user_consent_for_verified_apps",
|
|
|
|
|
"entra_privileged_user_has_mfa",
|
|
|
|
|
"entra_security_defaults_enabled",
|
|
|
|
|
"entra_trusted_named_locations_exists",
|
|
|
|
|
"entra_user_with_vm_access_has_mfa",
|
|
|
|
|
"entra_users_cannot_create_microsoft_365_groups",
|
|
|
|
|
"iam_custom_role_has_permissions_to_administer_resource_locks",
|
|
|
|
|
"iam_subscription_roles_owner_custom_not_created",
|
|
|
|
|
"keyvault_key_expiration_set_in_non_rbac",
|
|
|
|
|
"keyvault_key_rotation_enabled",
|
|
|
|
|
"keyvault_logging_enabled",
|
|
|
|
|
"keyvault_non_rbac_secret_expiration_set",
|
|
|
|
|
"keyvault_private_endpoints",
|
|
|
|
|
"keyvault_rbac_enabled",
|
|
|
|
|
"keyvault_rbac_key_expiration_set",
|
|
|
|
|
"keyvault_rbac_secret_expiration_set",
|
|
|
|
|
"keyvault_recoverable",
|
|
|
|
|
"monitor_alert_create_policy_assignment",
|
|
|
|
|
"monitor_alert_create_update_nsg",
|
|
|
|
|
"monitor_alert_create_update_public_ip_address_rule",
|
|
|
|
|
"monitor_alert_create_update_security_solution",
|
|
|
|
|
"monitor_alert_create_update_sqlserver_fr",
|
|
|
|
|
"monitor_alert_delete_nsg",
|
|
|
|
|
"monitor_alert_delete_policy_assignment",
|
|
|
|
|
"monitor_alert_delete_public_ip_address_rule",
|
|
|
|
|
"monitor_alert_delete_security_solution",
|
|
|
|
|
"monitor_alert_delete_sqlserver_fr",
|
|
|
|
|
"monitor_diagnostic_setting_with_appropriate_categories",
|
|
|
|
|
"monitor_diagnostic_settings_exists",
|
|
|
|
|
"monitor_storage_account_with_activity_logs_cmk_encrypted",
|
|
|
|
|
"monitor_storage_account_with_activity_logs_is_private",
|
|
|
|
|
"mysql_flexible_server_audit_log_connection_activated",
|
|
|
|
|
"mysql_flexible_server_audit_log_enabled",
|
|
|
|
|
"mysql_flexible_server_minimum_tls_version_12",
|
|
|
|
|
"mysql_flexible_server_ssl_connection_enabled",
|
|
|
|
|
"network_bastion_host_exists",
|
|
|
|
|
"network_flow_log_captured_sent",
|
|
|
|
|
"network_flow_log_more_than_90_days",
|
|
|
|
|
"network_http_internet_access_restricted",
|
|
|
|
|
"network_public_ip_shodan",
|
|
|
|
|
"network_rdp_internet_access_restricted",
|
|
|
|
|
"network_ssh_internet_access_restricted",
|
|
|
|
|
"network_udp_internet_access_restricted",
|
|
|
|
|
"network_watcher_enabled",
|
|
|
|
|
"policy_ensure_asc_enforcement_enabled",
|
|
|
|
|
"postgresql_flexible_server_allow_access_services_disabled",
|
|
|
|
|
"postgresql_flexible_server_connection_throttling_on",
|
|
|
|
|
"postgresql_flexible_server_enforce_ssl_enabled",
|
|
|
|
|
"postgresql_flexible_server_log_checkpoints_on",
|
|
|
|
|
"postgresql_flexible_server_log_connections_on",
|
|
|
|
|
"postgresql_flexible_server_log_disconnections_on",
|
|
|
|
|
"postgresql_flexible_server_log_retention_days_greater_3",
|
|
|
|
|
"sqlserver_auditing_enabled",
|
|
|
|
|
"sqlserver_auditing_retention_90_days",
|
|
|
|
|
"sqlserver_azuread_administrator_enabled",
|
|
|
|
|
"sqlserver_microsoft_defender_enabled",
|
|
|
|
|
"sqlserver_recommended_minimal_tls_version",
|
|
|
|
|
"sqlserver_tde_encrypted_with_cmk",
|
|
|
|
|
"sqlserver_tde_encryption_enabled",
|
|
|
|
|
"sqlserver_unrestricted_inbound_access",
|
|
|
|
|
"sqlserver_va_emails_notifications_admins_enabled",
|
|
|
|
|
"sqlserver_va_periodic_recurring_scans_enabled",
|
|
|
|
|
"sqlserver_va_scan_reports_configured",
|
|
|
|
|
"sqlserver_vulnerability_assessment_enabled",
|
|
|
|
|
"storage_blob_public_access_level_is_disabled",
|
|
|
|
|
"storage_default_network_access_rule_is_denied",
|
|
|
|
|
"storage_ensure_azure_services_are_trusted_to_access_is_enabled",
|
|
|
|
|
"storage_ensure_encryption_with_customer_managed_keys",
|
|
|
|
|
"storage_ensure_minimum_tls_version_12",
|
|
|
|
|
"storage_ensure_private_endpoints_in_storage_accounts",
|
|
|
|
|
"storage_ensure_soft_delete_is_enabled",
|
|
|
|
|
"storage_infrastructure_encryption_is_enabled",
|
|
|
|
|
"storage_key_rotation_90_days",
|
|
|
|
|
"storage_secure_transfer_required_is_enabled",
|
|
|
|
|
"vm_ensure_attached_disks_encrypted_with_cmk",
|
|
|
|
|
"vm_ensure_unattached_disks_encrypted_with_cmk",
|
|
|
|
|
"vm_ensure_using_managed_disks",
|
|
|
|
|
"vm_trusted_launch_enabled",
|
|
|
|
|
],
|
|
|
|
|
kubernetes: [
|
|
|
|
|
"apiserver_always_pull_images_plugin",
|
|
|
|
|
"apiserver_anonymous_requests",
|
|
|
|
|
"apiserver_audit_log_maxage_set",
|
|
|
|
|
"apiserver_audit_log_maxbackup_set",
|
|
|
|
|
"apiserver_audit_log_maxsize_set",
|
|
|
|
|
"apiserver_audit_log_path_set",
|
|
|
|
|
"apiserver_auth_mode_include_node",
|
|
|
|
|
"apiserver_auth_mode_include_rbac",
|
|
|
|
|
"apiserver_auth_mode_not_always_allow",
|
|
|
|
|
"apiserver_client_ca_file_set",
|
|
|
|
|
"apiserver_deny_service_external_ips",
|
|
|
|
|
"apiserver_disable_profiling",
|
|
|
|
|
"apiserver_encryption_provider_config_set",
|
|
|
|
|
"apiserver_etcd_cafile_set",
|
|
|
|
|
"apiserver_etcd_tls_config",
|
|
|
|
|
"apiserver_event_rate_limit",
|
|
|
|
|
"apiserver_kubelet_cert_auth",
|
|
|
|
|
"apiserver_kubelet_tls_auth",
|
|
|
|
|
"apiserver_namespace_lifecycle_plugin",
|
|
|
|
|
"apiserver_no_always_admit_plugin",
|
|
|
|
|
"apiserver_no_token_auth_file",
|
|
|
|
|
"apiserver_node_restriction_plugin",
|
|
|
|
|
"apiserver_request_timeout_set",
|
|
|
|
|
"apiserver_security_context_deny_plugin",
|
|
|
|
|
"apiserver_service_account_key_file_set",
|
|
|
|
|
"apiserver_service_account_lookup_true",
|
|
|
|
|
"apiserver_service_account_plugin",
|
|
|
|
|
"apiserver_strong_ciphers_only",
|
|
|
|
|
"apiserver_tls_config",
|
|
|
|
|
"controllermanager_bind_address",
|
|
|
|
|
"controllermanager_disable_profiling",
|
|
|
|
|
"controllermanager_garbage_collection",
|
|
|
|
|
"controllermanager_root_ca_file_set",
|
|
|
|
|
"controllermanager_rotate_kubelet_server_cert",
|
|
|
|
|
"controllermanager_service_account_credentials",
|
|
|
|
|
"controllermanager_service_account_private_key_file",
|
|
|
|
|
"core_minimize_admission_hostport_containers",
|
|
|
|
|
"core_minimize_admission_windows_hostprocess_containers",
|
|
|
|
|
"core_minimize_allowPrivilegeEscalation_containers",
|
|
|
|
|
"core_minimize_containers_added_capabilities",
|
|
|
|
|
"core_minimize_containers_capabilities_assigned",
|
|
|
|
|
"core_minimize_hostIPC_containers",
|
|
|
|
|
"core_minimize_hostNetwork_containers",
|
|
|
|
|
"core_minimize_hostPID_containers",
|
|
|
|
|
"core_minimize_net_raw_capability_admission",
|
|
|
|
|
"core_minimize_privileged_containers",
|
|
|
|
|
"core_minimize_root_containers_admission",
|
|
|
|
|
"core_no_secrets_envs",
|
|
|
|
|
"core_seccomp_profile_docker_default",
|
|
|
|
|
"etcd_client_cert_auth",
|
|
|
|
|
"etcd_no_auto_tls",
|
|
|
|
|
"etcd_no_peer_auto_tls",
|
|
|
|
|
"etcd_peer_client_cert_auth",
|
|
|
|
|
"etcd_peer_tls_config",
|
|
|
|
|
"etcd_tls_encryption",
|
|
|
|
|
"etcd_unique_ca",
|
|
|
|
|
"kubelet_authorization_mode",
|
|
|
|
|
"kubelet_client_ca_file_set",
|
|
|
|
|
"kubelet_conf_file_ownership",
|
|
|
|
|
"kubelet_conf_file_permissions",
|
|
|
|
|
"kubelet_config_yaml_ownership",
|
|
|
|
|
"kubelet_config_yaml_permissions",
|
|
|
|
|
"kubelet_disable_anonymous_auth",
|
|
|
|
|
"kubelet_disable_read_only_port",
|
|
|
|
|
"kubelet_event_record_qps",
|
|
|
|
|
"kubelet_manage_iptables",
|
|
|
|
|
"kubelet_rotate_certificates",
|
|
|
|
|
"kubelet_service_file_ownership_root",
|
|
|
|
|
"kubelet_service_file_permissions",
|
|
|
|
|
"kubelet_streaming_connection_timeout",
|
|
|
|
|
"kubelet_strong_ciphers_only",
|
|
|
|
|
"kubelet_tls_cert_and_key",
|
|
|
|
|
"rbac_cluster_admin_usage",
|
|
|
|
|
"rbac_minimize_csr_approval_access",
|
|
|
|
|
"rbac_minimize_node_proxy_subresource_access",
|
|
|
|
|
"rbac_minimize_pod_creation_access",
|
|
|
|
|
"rbac_minimize_pv_creation_access",
|
|
|
|
|
"rbac_minimize_secret_access",
|
|
|
|
|
"rbac_minimize_service_account_token_creation",
|
|
|
|
|
"rbac_minimize_webhook_config_access",
|
|
|
|
|
"rbac_minimize_wildcard_use_roles",
|
|
|
|
|
"scheduler_bind_address",
|
|
|
|
|
"scheduler_profiling",
|
|
|
|
|
],
|
|
|
|
|
m365: [
|
|
|
|
|
"admincenter_groups_not_public_visibility",
|
|
|
|
|
"admincenter_settings_password_never_expire",
|
|
|
|
|
"admincenter_users_admins_reduced_license_footprint",
|
|
|
|
|
"admincenter_users_between_two_and_four_global_admins",
|
|
|
|
|
"defender_antiphishing_policy_configured",
|
|
|
|
|
"defender_antispam_connection_filter_policy_empty_ip_allowlist",
|
|
|
|
|
"defender_antispam_connection_filter_policy_safe_list_off",
|
|
|
|
|
"defender_antispam_outbound_policy_configured",
|
|
|
|
|
"defender_antispam_outbound_policy_forwarding_disabled",
|
|
|
|
|
"defender_antispam_policy_inbound_no_allowed_domains",
|
|
|
|
|
"defender_chat_report_policy_configured",
|
|
|
|
|
"defender_domain_dkim_enabled",
|
|
|
|
|
"defender_malware_policy_common_attachments_filter_enabled",
|
|
|
|
|
"defender_malware_policy_comprehensive_attachments_filter_applied",
|
|
|
|
|
"defender_malware_policy_notifications_internal_users_malware_enabled",
|
|
|
|
|
"entra_admin_consent_workflow_enabled",
|
|
|
|
|
"entra_admin_portals_access_restriction",
|
|
|
|
|
"entra_admin_users_cloud_only",
|
|
|
|
|
"entra_admin_users_mfa_enabled",
|
|
|
|
|
"entra_admin_users_phishing_resistant_mfa_enabled",
|
|
|
|
|
"entra_admin_users_sign_in_frequency_enabled",
|
|
|
|
|
"entra_dynamic_group_for_guests_created",
|
|
|
|
|
"entra_identity_protection_sign_in_risk_enabled",
|
|
|
|
|
"entra_identity_protection_user_risk_enabled",
|
|
|
|
|
"entra_legacy_authentication_blocked",
|
|
|
|
|
"entra_managed_device_required_for_authentication",
|
|
|
|
|
"entra_managed_device_required_for_mfa_registration",
|
|
|
|
|
"entra_password_hash_sync_enabled",
|
|
|
|
|
"entra_policy_ensure_default_user_cannot_create_tenants",
|
|
|
|
|
"entra_policy_guest_invite_only_for_admin_roles",
|
|
|
|
|
"entra_policy_guest_users_access_restrictions",
|
|
|
|
|
"entra_policy_restricts_user_consent_for_apps",
|
|
|
|
|
"entra_thirdparty_integrated_apps_not_allowed",
|
|
|
|
|
"entra_users_mfa_enabled",
|
|
|
|
|
"exchange_external_email_tagging_enabled",
|
|
|
|
|
"exchange_mailbox_audit_bypass_disabled",
|
|
|
|
|
"exchange_mailbox_policy_additional_storage_restricted",
|
|
|
|
|
"exchange_organization_mailbox_auditing_enabled",
|
|
|
|
|
"exchange_organization_mailtips_enabled",
|
|
|
|
|
"exchange_organization_modern_authentication_enabled",
|
|
|
|
|
"exchange_roles_assignment_policy_addins_disabled",
|
|
|
|
|
"exchange_transport_config_smtp_auth_disabled",
|
|
|
|
|
"exchange_transport_rules_mail_forwarding_disabled",
|
|
|
|
|
"exchange_transport_rules_whitelist_disabled",
|
|
|
|
|
"exchange_user_mailbox_auditing_enabled",
|
|
|
|
|
"purview_audit_log_search_enabled",
|
|
|
|
|
"sharepoint_external_sharing_managed",
|
|
|
|
|
"sharepoint_external_sharing_restricted",
|
|
|
|
|
"sharepoint_guest_sharing_restricted",
|
|
|
|
|
"sharepoint_modern_authentication_required",
|
|
|
|
|
"sharepoint_onedrive_sync_restricted_unmanaged_devices",
|
|
|
|
|
"teams_email_sending_to_channel_disabled",
|
|
|
|
|
"teams_external_domains_restricted",
|
|
|
|
|
"teams_external_file_sharing_restricted",
|
|
|
|
|
"teams_external_users_cannot_start_conversations",
|
|
|
|
|
"teams_meeting_anonymous_user_join_disabled",
|
|
|
|
|
"teams_meeting_anonymous_user_start_disabled",
|
|
|
|
|
"teams_meeting_chat_anonymous_users_disabled",
|
|
|
|
|
"teams_meeting_dial_in_lobby_bypass_disabled",
|
|
|
|
|
"teams_meeting_external_chat_disabled",
|
|
|
|
|
"teams_meeting_external_control_disabled",
|
|
|
|
|
"teams_meeting_external_lobby_bypass_disabled",
|
|
|
|
|
"teams_meeting_presenters_restricted",
|
|
|
|
|
"teams_meeting_recording_disabled",
|
|
|
|
|
"teams_security_reporting_enabled",
|
|
|
|
|
"teams_unmanaged_communication_disabled",
|
|
|
|
|
],
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
return checksByProvider[provider_type as ProviderType] || [];
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
export const getLighthouseProviderChecks = async (provider_type: string) => {
|
|
|
|
|
return await checksByProvider(provider_type);
|
|
|
|
|
};
|
Chandrapal Badshah