diff --git a/checks/check_extra7181 b/checks/check_extra7181
new file mode 100644
index 0000000000..8b22776741
--- /dev/null
+++ b/checks/check_extra7181
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7181="7.181"
+CHECK_TITLE_extra7181="[extra7181] Directory Service monitoring with CloudWatch logs"
+CHECK_SCORED_extra7181="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7181="EXTRA"
+CHECK_SEVERITY_extra7181="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7181="AwsDirectoryService"
+CHECK_ALTERNATE_extra7181="extra7181"
+CHECK_SERVICENAME_extra7181="ds"
+CHECK_RISK_cextra7181="As a best practice, monitor your organization to ensure that changes are logged. This helps you to ensure that any unexpected change can be investigated and unwanted changes can be rolled back."
+CHECK_REMEDIATION_extra7181="It is recommended that that the export of logs is enabled"
+CHECK_DOC_extra7181="CHECK_DOC_extra7181='https://docs.aws.amazon.com/directoryservice/latest/admin-guide/incident-response.html'"
+CHECK_CAF_EPIC_extra7181="Infrastructure Security"
+
+extra7181(){
+  for regx in $REGIONS; do
+    DIRECTORY_SERVICE_IDS=$("${AWSCLI}" ds describe-directories $PROFILE_OPT --region "${regx}" --query 'DirectoryDescriptions[*].DirectoryId[]' --output text 2>&1)
+    if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${DIRECTORY_SERVICE_IDS}"; then
+        textInfo "${regx}: Access Denied trying to describe directories" "${regx}"
+        continue
+    fi
+
+    if [[ ${DIRECTORY_SERVICE_IDS} ]]; then
+        for DIRECTORY_ID in ${DIRECTORY_SERVICE_IDS}; do
+            DIRECTORY_SERVICE_MONITORING=$("${AWSCLI}" ds list-log-subscriptions ${PROFILE_OPT} --region "${regx}" --directory-id "${DIRECTORY_ID}" --query 'LogSubscriptions' --output text 2>&1)
+            if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${DIRECTORY_SERVICE_MONITORING}"; then
+                textInfo "${regx}: Access Denied trying to list Directory Service log subscriptions" "${regx}"
+                continue
+            fi
+            if [[ "${DIRECTORY_SERVICE_MONITORING}" ]]; then
+              textPass "${regx}: Directory Service ${DIRECTORY_ID} have log forwarding to CloudWatch enabled" "${regx}" "${DIRECTORY_ID}"
+            else 
+              textFail "${regx}: Directory Service ${DIRECTORY_ID} does not have log forwarding to CloudWatch enabled" "${regx}" "${DIRECTORY_ID}"     
+            fi
+      done
+    else
+      textInfo "${regx}: No Directory Service found" "${regx}" 
+    fi
+  done
+}
diff --git a/checks/check_extra7182 b/checks/check_extra7182
new file mode 100644
index 0000000000..5e5a3d2d90
--- /dev/null
+++ b/checks/check_extra7182
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+CHECK_ID_extra7182="7.182"
+CHECK_TITLE_extra7182="[extra7182] Directory Service SNS Notifications"
+CHECK_SCORED_extra7182="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7182="EXTRA"
+CHECK_SEVERITY_extra7182="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7182="AwsDirectoryService"
+CHECK_ALTERNATE_check7182="extra7182"
+CHECK_SERVICENAME_extra7182="ds"
+CHECK_RISK_cextra7182="As a best practice, monitor status of Directory Service. This helps to avoid late actions to fix Directory Service issues"
+CHECK_REMEDIATION_extra7182="It is recommended set up SNS messaging to send email or text messages when the status of your directory changes"
+CHECK_DOC_extra7182="https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_enable_notifications.html"
+CHECK_CAF_EPIC_extra7182="Infrastructure Security"
+
+extra7182(){
+  for regx in $REGIONS; do
+    DIRECTORY_SERVICE_IDS=$("${AWSCLI}" ds describe-directories ${PROFILE_OPT} --region "${regx}" --query 'DirectoryDescriptions[*].DirectoryId[]' --output text 2>&1)
+    if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${DIRECTORY_SERVICE_IDS}"; then
+        textInfo "${regx}: Access Denied trying to describe directories" "${regx}"
+        continue
+    fi
+    
+    if [[ ${DIRECTORY_SERVICE_IDS} ]]; then
+        for DIRECTORY_ID in ${DIRECTORY_SERVICE_IDS}; do
+            DIRECTORY_SERVICE_MONITORING=$("${AWSCLI}" ds describe-event-topics ${PROFILE_OPT} --region "${regx}" --directory-id "${DIRECTORY_ID}" --query 'EventTopics' --output text 2>&1)
+            if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${DIRECTORY_SERVICE_MONITORING}"; then
+                textInfo "${regx}: Access Denied trying to describe Directory Service event topics" "${regx}"
+                continue
+            fi
+            if [[ "${DIRECTORY_SERVICE_MONITORING}" ]]; then
+                textPass "${regx}: Directory Service ${DIRECTORY_ID} have SNS messaging enabled" "${regx}" "${DIRECTORY_ID}"
+            else 
+                textFail "${regx}: Directory Service ${DIRECTORY_ID} does not have SNS messaging enabled" "${regx}" "${DIRECTORY_ID}"     
+            fi
+        done
+    else
+        textInfo "${regx}: No Directory Service found" "${regx}"
+    fi
+  done
+}
diff --git a/checks/check_extra7183 b/checks/check_extra7183
new file mode 100644
index 0000000000..834bac346a
--- /dev/null
+++ b/checks/check_extra7183
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+
+CHECK_ID_extra7183="7.183"
+CHECK_TITLE_extra7183="[extra7183] Directory Service LDAP Certificates expiration"
+CHECK_SCORED_extra7183="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7183="EXTRA"
+CHECK_SEVERITY_extra7183="Medium"
+CHECK_ASFF_RESOURCE_TYPE_extra7183="AwsDirectoryService"
+CHECK_ALTERNATE_check7183="extra7183"
+CHECK_SERVICENAME_extra7183="ds"
+CHECK_RISK_cextra7183="Expired certificates can impact service availability."
+CHECK_REMEDIATION_extra7183="Monitor certificate expiration and take automated action to alarm responsible team for taking care of the replacement or remove."
+CHECK_DOC_extra7183="https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_ldap.html"
+CHECK_CAF_EPIC_extra7183="Data Protection"
+
+extra7183(){
+    local DAYS_TO_EXPIRE_THRESHOLD=90
+    for regx in $REGIONS; do
+        DIRECTORY_SERVICE_IDS=$("${AWSCLI}" ds describe-directories ${PROFILE_OPT} --region "${regx}" --query 'DirectoryDescriptions[*].DirectoryId[]' --output text 2>&1)
+        if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${DIRECTORY_SERVICE_IDS}"; then
+            textInfo "${regx}: Access Denied trying to describe directories" "${regx}"
+            continue
+        fi
+
+        if [[ ${DIRECTORY_SERVICE_IDS} ]]; then
+            for DIRECTORY_ID in ${DIRECTORY_SERVICE_IDS}; do
+                CERT_DATA=$("${AWSCLI}" ds list-certificates ${PROFILE_OPT} --region "${regx}" --directory-id "${DIRECTORY_ID}" --query 'CertificatesInfo[*].[CertificateId,ExpiryDateTime]' --output text 2>&1)
+                if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${CERT_DATA}"; then
+                    textInfo "${regx}: Access Denied trying to list certificates" "${regx}"
+                    continue
+                fi
+                if [[ ${CERT_DATA} ]]; then
+                    echo "${CERT_DATA}" | while read -r CERTIFICATE_ID NOTAFTER; do
+                        EXPIRES_DATE=$(timestamp_to_date "${NOTAFTER}")
+                        if [[ ${EXPIRES_DATE} == "" ]] 
+                        then
+                            textInfo "${regx}: LDAP Certificate ${CERTIFICATE_ID} has an incorrect timestamp format: ${NOTAFTER}" "${regx}" "${CERTIFICATE_ID}"
+                        else
+                            COUNTER_DAYS=$(how_many_days_from_today "${EXPIRES_DATE}")
+                            if [[ "${COUNTER_DAYS}" -le "${DAYS_TO_EXPIRE_THRESHOLD}" ]]; then
+                                textFail "${regx}: LDAP Certificate ${CERTIFICATE_ID} configured at ${DIRECTORY_ID} is about to expire in ${COUNTER_DAYS} days!" "${regx}" "${CERTIFICATE_ID}"
+                            else
+                                textPass "${regx}: LDAP Certificate ${CERTIFICATE_ID} configured at ${DIRECTORY_ID} expires in ${COUNTER_DAYS} days" "${regx}" "${CERTIFICATE_ID}"
+                            fi
+                        fi
+                    done
+                else
+                    textFail "${regx}: Directory Service ${DIRECTORY_ID} does not have a LDAP Certificate configured" "${regx}" "${DIRECTORY_ID}"    
+                fi
+            done
+        else
+            textInfo "${regx}: No Directory Service found" "${regx}"
+        fi
+    done
+}
diff --git a/checks/check_extra7184 b/checks/check_extra7184
new file mode 100644
index 0000000000..5e9293fad6
--- /dev/null
+++ b/checks/check_extra7184
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+
+
+CHECK_ID_extra7184="7.184"
+CHECK_TITLE_extra7184="[extra7184] Directory Service Manual Snapshot Limit"
+CHECK_SCORED_extra7184="NOT_SCORED"
+CHECK_CIS_LEVEL_extra7184="EXTRA"
+CHECK_SEVERITY_extra7184="Low"
+CHECK_ASFF_RESOURCE_TYPE_extra7184="AwsDirectoryService"
+CHECK_ALTERNATE_check7184="extra7184"
+CHECK_SERVICENAME_extra7184="ds"
+CHECK_RISK_extra7184="A limit reached can bring unwanted results. The maximum number of manual snapshots is a hard limit"
+CHECK_REMEDIATION_extra7184="Monitor manual snapshots limit to ensure capacity when you need it."
+CHECK_DOC_extra7184="https://docs.aws.amazon.com/general/latest/gr/ds_region.html"
+CHECK_CAF_EPIC_extra7184="Infrastructure Security"
+
+extra7184(){
+    local THRESHOLD="2"
+    for regx in ${REGIONS}; do
+        DIRECTORY_SERVICE_IDS=$("${AWSCLI}" ds describe-directories ${PROFILE_OPT} --region "${regx}" --query 'DirectoryDescriptions[*].DirectoryId[]' --output text 2>&1)
+        if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${DIRECTORY_SERVICE_IDS}"; then
+            textInfo "${regx}: Access Denied trying to describe directories" "${regx}"
+            continue
+        fi
+
+        if [[ ${DIRECTORY_SERVICE_IDS} ]]; then
+            for DIRECTORY_ID in ${DIRECTORY_SERVICE_IDS}; do
+                LIMIT_DATA=$("${AWSCLI}" ds get-snapshot-limits ${PROFILE_OPT} --region "${regx}" --directory-id "${DIRECTORY_ID}" --query 'SnapshotLimits' --output text 2>&1)
+                if grep -q -E 'AccessDenied|UnauthorizedOperation|AuthorizationError' <<< "${LIMIT_DATA}"; then
+                    textInfo "${regx}: Access Denied trying to get Directiory Service snapshot limits" "${regx}"
+                    continue
+                fi
+                echo "${LIMIT_DATA}" | while read -r CURRENT_SNAPSHOTS_COUNT SNAPSHOTS_LIMIT SNAPSHOTS_LIMIT_REACHED; do
+                    if [[ ${SNAPSHOTS_LIMIT_REACHED} == "true" ]] 
+                    then
+                        textFail "${regx}: Directory Service ${DIRECTORY_ID} reached ${SNAPSHOTS_LIMIT} Snapshots Limit" "${regx}" "${DIRECTORY_ID}"
+                    else 
+                        LIMIT_REMAIN=$(("${SNAPSHOTS_LIMIT}" - "${CURRENT_SNAPSHOTS_COUNT}"))
+                        if [[ "${LIMIT_REMAIN}" -le "${THRESHOLD}" ]]; then
+                            textFail "${regx}: Directory Service ${DIRECTORY_ID} is about to reach ${SNAPSHOTS_LIMIT} snapshots which is the limit" "${regx}" "${DIRECTORY_ID}"
+                        else
+                            textPass "${regx}: Directory Service ${DIRECTORY_ID} is using ${CURRENT_SNAPSHOTS_COUNT} out of ${SNAPSHOTS_LIMIT} from the Snapshot Limit" "${regx}" "{$DIRECTORY_ID}"
+                        fi
+                    fi
+                done
+            done
+        else
+            textInfo "${regx}: No Directory Service found" "${regx}"
+        fi
+    done
+}
diff --git a/groups/group26_ds b/groups/group26_ds
new file mode 100644
index 0000000000..c77ee2af80
--- /dev/null
+++ b/groups/group26_ds
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Prowler - the handy cloud security tool (copyright 2020) by Toni de la Fuente
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy
+# of the License at http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+
+GROUP_ID[26]='ds'
+GROUP_NUMBER[26]='26.0'
+GROUP_TITLE[26]='Amazon Directory Service related security checks - [ds] ******************'
+GROUP_RUN_BY_DEFAULT[26]='N' # run it when execute_all is called
+GROUP_CHECKS[26]='extra7181,extra7182,extra7183,extra7184'
\ No newline at end of file
diff --git a/groups/group7_extras b/groups/group7_extras
index 5f6c1661e1..1429a3a612 100644
--- a/groups/group7_extras
+++ b/groups/group7_extras
@@ -15,7 +15,7 @@ GROUP_ID[7]='extras'
 GROUP_NUMBER[7]='7.0'
 GROUP_TITLE[7]='Extras - all non CIS specific checks - [extras] ****************'
 GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called
-GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773,extra774,extra775,extra776,extra777,extra778,extra779,extra780,extra781,extra782,extra783,extra784,extra785,extra786,extra787,extra788,extra791,extra792,extra793,extra794,extra795,extra796,extra797,extra798,extra799,extra7100,extra7101,extra7102,extra7103,extra7104,extra7105,extra7106,extra7107,extra7108,extra7109,extra7110,extra7111,extra7112,extra7113,extra7114,extra7115,extra7116,extra7117,extra7118,extra7119,extra7120,extra7121,extra7122,extra7123,extra7124,extra7125,extra7126,extra7127,extra7128,extra7129,extra7130,extra7131,extra7132,extra7133,extra7134,extra7135,extra7136,extra7137,extra7138,extra7139,extra7140,extra7141,extra7142,extra7143,extra7144,extra7145,extra7146,extra7147,extra7148,extra7149,extra7150,extra7151,extra7152,extra7153,extra7154,extra7155,extra7156,extra7157,extra7158,extra7159,extra7160,extra7161,extra7162,extra7163,extra7164,extra7165,extra7166,extra7167,extra7168,extra7169,extra7170,extra7171,extra7172,extra7173,extra7174,extra7175,extra7176,extra7177,extra7178,extra7179,extra7180'
+GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773,extra774,extra775,extra776,extra777,extra778,extra779,extra780,extra781,extra782,extra783,extra784,extra785,extra786,extra787,extra788,extra791,extra792,extra793,extra794,extra795,extra796,extra797,extra798,extra799,extra7100,extra7101,extra7102,extra7103,extra7104,extra7105,extra7106,extra7107,extra7108,extra7109,extra7110,extra7111,extra7112,extra7113,extra7114,extra7115,extra7116,extra7117,extra7118,extra7119,extra7120,extra7121,extra7122,extra7123,extra7124,extra7125,extra7126,extra7127,extra7128,extra7129,extra7130,extra7131,extra7132,extra7133,extra7134,extra7135,extra7136,extra7137,extra7138,extra7139,extra7140,extra7141,extra7142,extra7143,extra7144,extra7145,extra7146,extra7147,extra7148,extra7149,extra7150,extra7151,extra7152,extra7153,extra7154,extra7155,extra7156,extra7157,extra7158,extra7159,extra7160,extra7161,extra7162,extra7163,extra7164,extra7165,extra7166,extra7167,extra7168,extra7169,extra7170,extra7171,extra7172,extra7173,extra7174,extra7175,extra7176,extra7177,extra7178,extra7179,extra7180,extra7181,extra7182,extra7183,extra7184'
 
 # Extras 759 and 760 (lambda variables and code secrets finder are not included)
 # to run detect-secrets use `./prowler -g secrets`
diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json
index b2f02eab25..1ed3c31f9e 100644
--- a/iam/prowler-additions-policy.json
+++ b/iam/prowler-additions-policy.json
@@ -3,7 +3,9 @@
     "Statement": [
         {
             "Action": [
-                "ds:ListAuthorizedApplications",
+                "ds:Get*",
+                "ds:Describe*",
+                "ds:List*",
                 "ec2:GetEbsEncryptionByDefault",
                 "ecr:Describe*",
                 "elasticfilesystem:DescribeBackupPolicy",