chore(v4): show prowler cloud + version upgrade

2026-08-21 05:13:00 +00:00 · 2026-08-13 13:02:57 +02:00
186 changed files with 4787 additions and 16287 deletions
@@ -62,7 +62,7 @@ jobs:

      - name: Install Poetry
        run: |
-          pipx install poetry==1.8.5
+          pipx install poetry
          pipx inject poetry poetry-bumpversion

      - name: Get Prowler version
@@ -11,7 +11,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@v3.88.18
+        uses: trufflesecurity/trufflehog@v3.85.0
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
@@ -22,7 +22,7 @@ jobs:
      - uses: actions/checkout@v4
      - name: Test if changes are in not ignored paths
        id: are-non-ignored-files-changed
-        uses: tj-actions/changed-files@v46
+        uses: tj-actions/changed-files@v45
        with:
          files: ./**
          files_ignore: |
@@ -36,7 +36,7 @@ jobs:
        if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
        run: |
          python -m pip install --upgrade pip
-          pipx install poetry==1.8.5
+          pipx install poetry
      - name: Set up Python ${{ matrix.python-version }}
        if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
        uses: actions/setup-python@v5
@@ -37,7 +37,7 @@ jobs:

      - name: Install dependencies
        run: |
-          pipx install poetry==1.8.5
+          pipx install poetry

      - name: Setup Python
        uses: actions/setup-python@v5
@@ -1,4 +1,4 @@
-FROM python:3.12.9-alpine3.20
+FROM python:3.12-alpine

 LABEL maintainer="https://github.com/prowler-cloud/prowler"

@@ -532,8 +532,8 @@ def get_bar_graph(df, column_name):

    # Cut the text if it is too long
    for i in range(len(colums)):
-        if len(colums[i]) > 43:
-            colums[i] = colums[i][:43] + "..."
+        if len(colums[i]) > 15:
+            colums[i] = colums[i][:15] + "..."

    fig = px.bar(
        df,
@@ -47,7 +47,6 @@ The following list includes all the AWS checks with configurable variables that
 | `ecr_repositories_scan_vulnerabilities_in_latest_image`       | `ecr_repository_vulnerability_minimum_severity`  | String          |
 | `eks_cluster_uses_a_supported_version`                        | `eks_cluster_oldest_version_supported`           | String          |
 | `eks_control_plane_logging_all_types_enabled`                 | `eks_required_log_types`                         | List of Strings |
-| `elasticache_redis_cluster_backup_enabled`                    | `minimum_snapshot_retention_period`              | Integer         |
 | `elb_is_in_multiple_az`                                       | `elb_min_azs`                                    | Integer         |
 | `elbv2_is_in_multiple_az`                                     | `elbv2_min_azs`                                  | Integer         |
 | `guardduty_is_enabled`                                        | `mute_non_default_regions`                       | Boolean         |
@@ -2,6 +2,7 @@
 # -*- coding: utf-8 -*-

 import sys
+import threading
 from os import environ

 from colorama import Fore, Style
@@ -10,11 +11,16 @@ from colorama import init as colorama_init
 from prowler.config.config import (
    csv_file_suffix,
    get_available_compliance_frameworks,
+    get_available_update,
    html_file_suffix,
    json_asff_file_suffix,
    json_ocsf_file_suffix,
 )
-from prowler.lib.banner import print_banner
+from prowler.lib.banner import (
+    print_banner,
+    print_prowler_cloud_banner,
+    print_update_notice,
+)
 from prowler.lib.check.check import (
    exclude_checks_to_run,
    exclude_services_to_run,
@@ -118,6 +124,18 @@ def prowler():
    if args.no_color:
        colorama_init(strip=True)

+    # Check in the background whether a newer Prowler release is available;
+    # the result is printed at the end of the scan so the check never adds
+    # latency. Skipped with --no-banner/--only-logs and via
+    # PROWLER_NO_VERSION_CHECK/DO_NOT_TRACK (handled in get_available_update).
+    available_update = {}
+    update_check_thread = threading.Thread(
+        target=lambda: available_update.update(latest=get_available_update()),
+        daemon=True,
+    )
+    if not args.no_banner and not args.only_logs:
+        update_check_thread.start()
+
    if not args.no_banner:
        legend = args.verbose or getattr(args, "fixer", None)
        print_banner(legend)
@@ -719,6 +737,15 @@ def prowler():
                    f"\nDetailed compliance results are in {Fore.YELLOW}{output_options.output_directory}/compliance/{Style.RESET_ALL}\n"
                )

+    # Promote Prowler Cloud as the last thing the user sees after the results,
+    # preceded by an update notice when a newer release is available
+    if not args.no_banner and not args.only_logs:
+        if update_check_thread.is_alive():
+            update_check_thread.join(timeout=2)
+        if available_update.get("latest"):
+            print_update_notice(available_update["latest"])
+        print_prowler_cloud_banner()
+
    # If custom checks were passed, remove the modules
    if checks_folder:
        remove_custom_checks_module(checks_folder, provider)
@@ -28,9 +28,7 @@
          "Service": "ebs"
        }
      ],
-      "Checks": [
-        "ec2_ebs_volume_snapshots_exists"
-      ]
+      "Checks": []
    },
    {
      "Id": "1.0.3",
@@ -44,8 +42,7 @@
        }
      ],
      "Checks": [
-        "ec2_ebs_default_encryption",
-        "ec2_ebs_volume_encryption"
+        "ec2_ebs_default_encryption"
      ]
    },
    {
@@ -90,9 +87,7 @@
        }
      ],
      "Checks": [
-        "iam_user_mfa_enabled_console_access",
-        "iam_user_hardware_mfa_enabled",
-        "iam_root_mfa_enabled"
+        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
@@ -107,9 +102,7 @@
        }
      ],
      "Checks": [
-        "iam_user_mfa_enabled_console_access",
-        "iam_user_hardware_mfa_enabled",
-        "iam_root_mfa_enabled"
+        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
@@ -124,9 +117,7 @@
        }
      ],
      "Checks": [
-        "iam_root_mfa_enabled",
-        "iam_root_hardware_mfa_enabled",
-        "iam_user_mfa_enabled_console_access"
+        "iam_root_mfa_enabled"
      ]
    },
    {
@@ -171,10 +162,7 @@
        }
      ],
      "Checks": [
-        "rds_instance_no_public_access",
-        "s3_bucket_public_access",
-        "s3_bucket_public_list_acl",
-        "s3_account_level_public_access_blocks"
+        "rds_instance_no_public_access"
      ]
    },
    {
@@ -204,8 +192,7 @@
        }
      ],
      "Checks": [
-        "rds_instance_storage_encrypted",
-        "rds_instance_transport_encrypted"
+        "rds_instance_storage_encrypted"
      ]
    },
    {
@@ -455,8 +455,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.",
@@ -477,8 +476,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -499,8 +497,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -521,8 +518,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -544,8 +540,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -566,8 +561,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.2. Elastic Compute Cloud (EC2)",
+          "Section": "2.2. Elastic Compute Cloud (EC2)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -584,13 +578,11 @@
      "Id": "2.3.1",
      "Description": "Ensure that encryption is enabled for RDS Instances",
      "Checks": [
-        "rds_instance_storage_encrypted",
-        "rds_instance_transport_encrypted"
+        "rds_instance_storage_encrypted"
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -455,8 +455,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Amazon S3 provides a variety of no, or low, cost encryption options to protect data at rest.",
@@ -477,8 +476,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -499,8 +497,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -521,8 +518,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -544,8 +540,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -566,8 +561,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.2. Elastic Compute Cloud (EC2)",
+          "Section": "2.2. Elastic Compute Cloud (EC2)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -584,13 +578,11 @@
      "Id": "2.3.1",
      "Description": "Ensure that encryption is enabled for RDS Instances",
      "Checks": [
-        "rds_instance_storage_encrypted",
-        "rds_instance_transport_encrypted"
+        "rds_instance_storage_encrypted"
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -611,8 +603,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
@@ -633,8 +624,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.",
@@ -655,8 +645,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.4 Elastic File System (EFS)",
+          "Section": "2.4 Elastic File System (EFS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "EFS data should be encrypted at rest using AWS KMS (Key Management Service).",
@@ -303,9 +303,7 @@
    {
      "Id": "1.22",
      "Description": "Ensure access to AWSCloudShellFullAccess is restricted",
-      "Checks": [
-        "iam_policy_cloudshell_admin_not_attached"
-      ],
+      "Checks": [],
      "Attributes": [
        {
          "Section": "1. Identity and Access Management",
@@ -476,8 +474,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -494,13 +491,11 @@
      "Id": "2.1.2",
      "Description": "Ensure MFA Delete is enabled on S3 buckets",
      "Checks": [
-        "s3_bucket_no_mfa_delete",
-        "cloudtrail_bucket_requires_mfa_delete"
+        "s3_bucket_no_mfa_delete"
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -521,8 +516,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -544,8 +538,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -566,8 +559,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.2. Elastic Compute Cloud (EC2)",
+          "Section": "2.2. Elastic Compute Cloud (EC2)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -584,13 +576,11 @@
      "Id": "2.3.1",
      "Description": "Ensure that encryption is enabled for RDS Instances",
      "Checks": [
-        "rds_instance_storage_encrypted",
-        "rds_instance_transport_encrypted"
+        "rds_instance_storage_encrypted"
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -611,8 +601,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
@@ -633,8 +622,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to any publicly accessible RDS database instance, you must disable the database Publicly Accessible flag and update the VPC security group associated with the instance.",
@@ -655,8 +643,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.4 Elastic File System (EFS)",
+          "Section": "2.4 Elastic File System (EFS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "EFS data should be encrypted at rest using AWS KMS (Key Management Service).",
@@ -1351,8 +1338,7 @@
      "Id": "5.6",
      "Description": "Ensure that EC2 Metadata Service only allows IMDSv2",
      "Checks": [
-        "ec2_instance_imdsv2_enabled",
-        "ec2_instance_account_imdsv2_enabled"
+        "ec2_instance_imdsv2_enabled"
      ],
      "Attributes": [
        {
@@ -474,8 +474,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "At the Amazon S3 bucket level, you can configure permissions through a bucket policy making the objects accessible only through HTTPS.",
@@ -496,8 +495,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -518,8 +516,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Amazon S3 buckets can contain sensitive data, that for security purposes should be discovered, monitored, classified and protected. Macie along with other 3rd party tools can automatically provide an inventory of Amazon S3 buckets.",
@@ -541,8 +538,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.1. Simple Storage Service (S3)",
+          "Section": "2.1. Simple Storage Service (S3)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.",
@@ -563,8 +559,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.2. Elastic Compute Cloud (EC2)",
+          "Section": "2.2. Elastic Compute Cloud (EC2)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service. While disabled by default, forcing encryption at EBS volume creation is supported.",
@@ -585,8 +580,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Amazon RDS encrypted DB instances use the industry standard AES-256 encryption algorithm to encrypt your data on the server that hosts your Amazon RDS DB instances. After your data is encrypted, Amazon RDS handles authentication of access and decryption of your data transparently with a minimal impact on performance.",
@@ -607,8 +601,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure that RDS database instances have the Auto Minor Version Upgrade flag enabled in order to receive automatically minor engine upgrades during the specified maintenance window. So, RDS instances can get the new features, bug fixes, and security patches for their database engines.",
@@ -629,8 +622,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.3. Relational Database Service (RDS)",
+          "Section": "2.3. Relational Database Service (RDS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure and verify that RDS database instances provisioned in your AWS account do restrict unauthorized access in order to minimize security risks. To restrict access to anypublicly accessible RDS database instance, you must disable the database PubliclyAccessible flag and update the VPC security group associated with the instance",
@@ -651,8 +643,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Storage",
-          "SubSection": "2.4 Elastic File System (EFS)",
+          "Section": "2.4 Elastic File System (EFS)",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "EFS data should be encrypted at rest using AWS KMS (Key Management Service).",
@@ -2932,7 +2932,7 @@
      ]
    },
    {
-      "Id": "op.pl.2.r1.aws.warch.1",
+      "Id": "op.pl.2.aws.warch.1",
      "Description": "Sistema de gestión",
      "Attributes": [
        {
@@ -2956,7 +2956,7 @@
      "Checks": []
    },
    {
-      "Id": "op.pl.2.r2.aws.warch.1",
+      "Id": "op.pl.2.aws.warch.1",
      "Description": "Sistema de gestión de la seguridad con mejora continua",
      "Attributes": [
        {
@@ -2980,7 +2980,7 @@
      "Checks": []
    },
    {
-      "Id": "op.pl.2.r3.aws.warch.1",
+      "Id": "op.pl.2.aws.warch.1",
      "Description": "Validación de datos",
      "Attributes": [
        {
@@ -4304,6 +4304,32 @@
      ],
      "Checks": []
    },
+    {
+      "Id": "op.mon.3.aws.cwl.1",
+      "Description": "Vigilancia",
+      "Attributes": [
+        {
+          "IdGrupoControl": "op.mon.3",
+          "Marco": "operacional",
+          "Categoria": "monitorización del sistema",
+          "DescripcionControl": "Deberá asegurarse que todos los servicios que se utilicen en la arquitectura de la aplicación desplegada en AWS estén generando logs",
+          "Nivel": "alto",
+          "Tipo": "requisito",
+          "Dimensiones": [
+            "confidencialidad",
+            "integridad",
+            "trazabilidad",
+            "autenticidad",
+            "disponibilidad"
+          ],
+          "ModoEjecucion": "automatico",
+          "Dependencias": []
+        }
+      ],
+      "Checks": [
+        "cloudtrail_cloudwatch_logging_enabled"
+      ]
+    },
    {
      "Id": "mp.com.2.aws.vpn.1",
      "Description": "Protección de la confidencialidad",
@@ -12,8 +12,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.1 Security Defaults",
+          "Section": "1.1 Security Defaults",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Security defaults in Azure Active Directory (Azure AD) make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks. Security defaults is available to everyone. The goal is to ensure that all organizations have a basic level of security",
@@ -35,8 +34,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.1 Security Defaults",
+          "Section": "1.1 Security Defaults",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as; • Service Co-Administrators • Subscription Owners • Contributors",
@@ -58,8 +56,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.1 Security Defaults",
+          "Section": "1.1 Security Defaults",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable multi-factor authentication for all non-privileged users.",
@@ -79,8 +76,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.1 Security Defaults",
+          "Section": "1.1 Security Defaults",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Do not allow users to remember multi-factor authentication on devices.",
@@ -102,8 +98,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Azure Active Directory Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.",
@@ -123,8 +118,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "CAUTION: If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues. Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined.",
@@ -144,8 +138,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.",
@@ -165,8 +158,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.",
@@ -186,8 +178,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.",
@@ -207,8 +198,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.",
@@ -230,7 +220,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Require administrators or appropriately delegated users to create new tenants.",
@@ -250,7 +240,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "This recommendation extends guest access review by utilizing the Azure AD Privileged Identity Management feature provided in Azure AD Premium P2. Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources a a guest user.",
@@ -270,7 +260,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Azure AD is extended to include Azure AD B2B collaboration, allowing you to invite people from outside your organization to be guest users in your cloud account and sign in with their own work, school, or social identities. Guest users allow you to share your company's applications and services with users from any other organization, while maintaining control over your own corporate data. Work with external partners, large or small, even if they don't have Azure AD or an IT department. A simple invitation and redemption process lets partners use their own credentials to access your company's resources as a guest user. Guest users in every subscription should be review on a regular basis to ensure that inactive and unneeded accounts are removed.",
@@ -290,7 +280,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Ensures that two alternate forms of identification are provided before allowing a password reset.",
@@ -310,7 +300,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Azure provides a Global Banned Password policy that applies to Azure administrative and normal user accounts. This is not applied to user accounts that are synced from an on-premise Active Directory unless Azure AD Connect is used and you enable EnforceCloudPasswordPolicyForPasswordSyncedUsers. Please see the list in default values on the specifics of this policy. To further password security, it is recommended to further define a custom banned password policy.",
@@ -330,7 +320,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Ensure that the number of days before users are asked to re-confirm their authentication information is not set to 0.",
@@ -350,7 +340,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Ensure that users are notified on their primary and secondary emails on password resets.",
@@ -370,7 +360,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Ensure that all Global Administrators are notified if any other administrator resets their password.",
@@ -392,7 +382,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Require administrators to provide consent for applications before use.",
@@ -414,7 +404,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Allow users to provide consent for selected permissions when a request is coming from a verified publisher.",
@@ -434,7 +424,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Require administrators to provide consent for the apps before use.",
@@ -456,7 +446,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Require administrators or appropriately delegated users to register third-party applications.",
@@ -478,7 +468,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Limit guest user permissions.",
@@ -500,7 +490,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Restrict invitations to users with specific administrative roles only.",
@@ -520,7 +510,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Restrict access to the Azure AD administration portal to administrators only. NOTE: This only affects access to the Azure AD administrator's web portal. This setting does not prohibit privileged users from using other methods such as Rest API or Powershell to obtain sensitive information from Azure AD.",
@@ -540,7 +530,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Restricts group creation to administrators with permissions only.",
@@ -562,7 +552,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Restrict security group creation to administrators only.",
@@ -582,7 +572,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Restrict security group management to administrators only.",
@@ -604,7 +594,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Restrict Microsoft 365 group creation to administrators only.",
@@ -624,7 +614,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Joining or registering devices to the active directory should require Multi-factor authentication.",
@@ -646,7 +636,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "The principle of least privilege should be followed and only necessary privileges should be assigned instead of allowing full administrative access.",
@@ -668,7 +658,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Resource locking is a powerful protection mechanism that can prevent inadvertent modification/deletion of resources within Azure subscriptions/Resource Groups and is a recommended NIST configuration.",
@@ -688,7 +678,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1. Identity and Access Management",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Users who are set as subscription owners are able to make administrative changes to the subscriptions and move them into and out of Azure Active Directories.",
@@ -710,8 +700,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -733,8 +722,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -756,8 +744,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Databases enables threat detection for the instances running your database software. This provides threat intelligence, anomaly detection, and behavior analytics in the Azure Microsoft Defender for Cloud. Instead of being enabled on services like Platform as a Service (PaaS), this implementation will run within your instances as Infrastructure as a Service (IaaS) on the Operating Systems hosting your databases.",
@@ -779,8 +766,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Azure SQL Databases  enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, andbehavior analytics in the Microsoft Defender for Cloud.",
@@ -802,8 +788,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -825,8 +810,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Open-source relational databases enables threat detection for Open-source relational databases, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -848,8 +832,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -871,8 +854,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Containers enables threat detection for Container Registries including Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -894,8 +876,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Defender for Azure Cosmos DB scans all incoming network requests for threats to your Azure Cosmos DB resources.",
@@ -917,8 +898,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -940,8 +920,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Defender for DNS scans all network traffic exiting from within a subscription.",
@@ -963,8 +942,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Defender for Resource Manager scans incoming administrative requests to change your infrastructure from both CLI and the Azure portal.",
@@ -986,8 +964,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Ensure that the latest OS patches for all virtual machines are applied.",
@@ -1009,8 +986,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "None of the settings offered by ASC Default policy should be set to effect Disabled.",
@@ -1032,8 +1008,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Enable automatic provisioning of the monitoring agent to collect security data.",
@@ -1055,8 +1030,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable automatic provisioning of vulnerability assessment for machines on both Azure and hybrid (Arc enabled) machines.",
@@ -1076,8 +1050,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable automatic provisioning of the Microsoft Defender for Containers components.",
@@ -1099,8 +1072,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Enable security alert emails to subscription owners.",
@@ -1122,8 +1094,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.",
@@ -1145,8 +1116,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enables emailing security alerts to the subscription owner or other designated security contact.",
@@ -1168,8 +1138,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "This integration setting enables Microsoft Defender for Cloud Apps (formerly 'Microsoft Cloud App Security' or 'MCAS' - see additional info) to communicate with Microsoft Defender for Cloud.",
@@ -1191,8 +1160,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "This integration setting enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud. IMPORTANT: When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable. 1. For server 2019 & above if defender is installed (default for these server SKU's) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal. 2. If the new unified agent is required for server SKU's of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned.",
@@ -1214,8 +1182,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.2 Microsoft Defender for IoT",
+          "Section": "2.2 Microsoft Defender for IoT",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Defender for IoT acts as a central security hub for IoT devices within your organization.",
@@ -1557,8 +1524,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable auditing on SQL Servers.",
@@ -1580,8 +1546,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure that no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP).",
@@ -1603,8 +1568,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Transparent Data Encryption (TDE) with Customer-managed key support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties. With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with Customer-managed key support for TDE, the DEK can be protected with an asymmetric key that is stored in the Azure Key Vault. The Azure Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data for additional security. Based on business needs or criticality of data/databases hosted on a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (Customer-managed key).",
@@ -1626,8 +1590,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Use Azure Active Directory Authentication for authentication with SQL Database to manage credentials in a single place.",
@@ -1649,8 +1612,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable Transparent Data Encryption on every SQL server.",
@@ -1672,8 +1634,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "SQL Server Audit Retention should be configured to be greater than 90 days.",
@@ -1695,8 +1656,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
+          "Section": "4.2 SQL Server - Microsoft Defender for SQL",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Enable 'Microsoft Defender for SQL' on critical SQL Servers.",
@@ -1718,8 +1678,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
+          "Section": "4.2 SQL Server - Microsoft Defender for SQL",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Enable Vulnerability Assessment (VA) service scans for critical SQL servers and corresponding SQL databases.",
@@ -1741,8 +1700,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
+          "Section": "4.2 SQL Server - Microsoft Defender for SQL",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Enable Vulnerability Assessment (VA) service scans for critical SQL servers and corresponding SQL databases.",
@@ -1764,8 +1722,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
+          "Section": "4.2 SQL Server - Microsoft Defender for SQL",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Configure 'Send scan reports to' with email addresses of concerned data owners/stakeholders for a critical SQL servers",
@@ -1787,8 +1744,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.2 SQL Server - Microsoft Defender for SQL",
+          "Section": "4.2 SQL Server - Microsoft Defender for SQL",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners'.",
@@ -1810,8 +1766,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable SSL connection on PostgreSQL Servers.",
@@ -1833,8 +1788,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable log_checkpoints on PostgreSQL Servers.",
@@ -1856,8 +1810,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable log_connections on PostgreSQL Servers.",
@@ -1879,8 +1832,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable log_disconnections on PostgreSQL Servers.",
@@ -1902,8 +1854,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable connection_throttling on PostgreSQL Servers.",
@@ -1925,8 +1876,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure log_retention_days on PostgreSQL Servers is set to an appropriate value.",
@@ -1948,8 +1898,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Disable access from Azure services to PostgreSQL Database Server.",
@@ -1969,8 +1918,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server",
+          "Section": "4.3 PostgreSQL Database Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Azure Database for PostgreSQL servers should be created with 'infrastructure double encryption' enabled.",
@@ -1992,8 +1940,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable SSL connection on MYSQL Servers.",
@@ -2015,8 +1962,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure TLS version on MySQL flexible servers is set to the default value.",
@@ -2038,8 +1984,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable audit_log_enabled on MySQL Servers.",
@@ -2061,8 +2006,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Set audit_log_enabled to include CONNECTION on MySQL Servers.",
@@ -2084,8 +2028,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.5 Cosmos DB",
+          "Section": "4.5 Cosmos DB",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint.",
@@ -2107,8 +2050,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.5 Cosmos DB",
+          "Section": "4.5 Cosmos DB",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Private endpoints limit network traffic to approved sources.",
@@ -2130,8 +2072,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.5 Cosmos DB",
+          "Section": "4.5 Cosmos DB",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Cosmos DB can use tokens or AAD for client authentication which in turn will use Azure RBAC for authorization. Using AAD is significantly more secure because AAD handles the credentials and allows for MFA and centralized management, and the Azure RBAC better integrated with the rest of Azure.",
@@ -2153,8 +2094,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Enable Diagnostic settings for exporting activity logs. Diagnos tic settings are available for each individual resource within a subscription. Settings should be configured for allappropriate resources for your environment.",
@@ -2176,8 +2116,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Prerequisite: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: 'Ensure that a 'Diagnostic Setting' exists.' The diagnostic setting should be configured to log the appropriate activities from the control/management plane.",
@@ -2199,8 +2138,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "The storage account container containing the activity log export should not be publicly accessible.",
@@ -2222,8 +2160,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).",
@@ -2245,8 +2182,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.",
@@ -2268,8 +2204,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Ensure that network flow logs are captured and fed into a central log analytics workspace.",
@@ -2291,8 +2226,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable AppServiceHTTPLogs diagnostic log category for Azure App Service instances to ensure all http requests are captured and centrally logged.",
@@ -2314,8 +2248,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create Policy Assignment event.",
@@ -2337,8 +2270,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Policy Assignment event.",
@@ -2360,8 +2292,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an Activity Log Alert for the Create or Update Network Security Group event.",
@@ -2383,8 +2314,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Network Security Group event.",
@@ -2406,8 +2336,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create or Update Security Solution event.",
@@ -2429,8 +2358,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Security Solution event.",
@@ -2452,8 +2380,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create or Update SQL Server Firewall Rule event.",
@@ -2475,8 +2402,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the 'Delete SQL Server Firewall Rule.'",
@@ -2498,8 +2424,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create or Update Public IP Addresses rule.",
@@ -2521,8 +2446,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Public IP Address rule.",
@@ -2542,7 +2466,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5.3 Configuring Application Insights",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Resource Logs capture activity to the data access plane while the Activity log is a subscription-level log for the control plane. Resource-level diagnostic logs provide insight into operations that were performed within that resource itself; for example, reading or updating a secret from a Key Vault. Currently, 95 Azure resources support Azure Monitoring (See the more information section for a complete list), including Network Security Groups, Load Balancers, Key Vault, AD, Logic Apps, and CosmosDB. The content of these logs varies by resource type. A number of back-end services were not configured to log and store Resource Logs for certain activities or for a sufficient length. It is crucial that monitoring is correctly configured to log all relevant activities and retain those logs for a sufficient length of time. Given that the mean time to detection in an enterprise is 240 days, a minimum retention period of two years is recommended.",
@@ -2562,7 +2486,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
+          "Section": "5.3 Configuring Application Insights",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "The use of Basic or Free SKUs in Azure whilst cost effective have significant limitations in terms of what can be monitored and what support can be realized from Microsoft. Typically, these SKU’s do not have a service SLA and Microsoft will usually refuse to provide support for them. Consequently Basic/Free SKUs should never be used for production workloads.",
@@ -2584,8 +2508,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.3 Configuring Application Insights",
+          "Section": "5.3 Configuring Application Insights",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Application Insights within Azure act as an Application Performance Monitoring solution providing valuable data into how well an application performs and additional information when performing incident response. The types of log data collected include application metrics, telemetry data, and application trace logging data providing organizations with detailed information about application activity and application transactions. Both data sets help organizations adopt a proactive and retroactive means to handle security and performance related metrics within their modern applications.",
@@ -494,8 +494,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.1 Security Defaults Security Defaults",
+          "Section": "1.1 Security Defaults Security Defaults",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Security defaults in Microsoft Entra ID make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.  Security defaults is available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.",
@@ -517,8 +516,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.1 Security Defaults Security Defaults",
+          "Section": "1.1 Security Defaults Security Defaults",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Enable multi-factor authentication for all roles, groups, and users that have write access or permissions to Azure resources. These include custom created objects or built-in roles such as; - Service Co-Administrators - Subscription Owners - Contributors",
@@ -540,8 +538,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.1 Security Defaults Security Defaults",
+          "Section": "1.1 Security Defaults",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable multi-factor authentication for all non-privileged users.",
@@ -561,8 +558,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.1 Security Defaults Security Defaults",
+          "Section": "1.1 Security Defaults",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Do not allow users to remember multi-factor authentication on devices.",
@@ -584,8 +580,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Entra ID Conditional Access allows an organization to configure `Named locations` and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization.",
@@ -605,8 +600,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "**CAUTION**: If these policies are created without first auditing and testing the result, misconfiguration can potentially lock out administrators or create undesired access issues.  Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined.",
@@ -626,8 +620,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.",
@@ -647,8 +640,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on logins.",
@@ -668,8 +660,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "For designated users, they will be prompted to use their multi-factor authentication (MFA) process on login.",
@@ -691,8 +682,7 @@
      ],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "This recommendation ensures that users accessing the Windows Azure Service Management API (i.e. Azure Powershell, Azure CLI, Azure Resource Manager API, etc.) are required to use multifactor authentication (MFA) credentials when accessing resources through the Windows Azure Service Management API.",
@@ -712,8 +702,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "1.Identity and Access Management",
-          "SubSection": "1.2 Conditional Access",
+          "Section": "1.2 Conditional Access",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "This recommendation ensures that users accessing Microsoft Admin Portals (i.e. Microsoft 365 Admin, Microsoft 365 Defender, Exchange Admin Center, Azure Portal, etc.) are required to use multifactor authentication (MFA) credentials when logging into an Admin Portal.",
@@ -735,8 +724,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for Servers enables threat detection for Servers, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -758,8 +746,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for App Service enables threat detection for App Service, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -781,8 +768,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for Azure SQL Databases enables threat detection for Managed Instance Azure SQL databases, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.",
@@ -804,8 +790,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.",
@@ -827,8 +812,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for Open-source relational databases enables threat detection for Open-source relational databases, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -850,8 +834,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Microsoft Defender for Azure Cosmos DB scans all incoming network requests for threats to your Azure Cosmos DB resources.",
@@ -873,8 +856,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for Storage enables threat detection for Storage, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -896,8 +878,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for Containers enables threat detection for Container Registries including Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud. The following services will be enabled for container instances: - Defender agent in Azure - Azure Policy for Kubernetes - Agentless discovery for Kubernetes - Agentless container vulnerability assessment",
@@ -919,8 +900,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Turning on Microsoft Defender for Key Vault enables threat detection for Key Vault, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.",
@@ -942,8 +922,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "[**NOTE:** As of August 1, customers with an existing subscription to Defender for DNS can continue to use the service, but new subscribers will receive alerts about suspicious DNS activity as part of Defender for Servers P2.]  Microsoft Defender for DNS scans all network traffic exiting from within a subscription.",
@@ -965,8 +944,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Microsoft Defender for Resource Manager scans incoming administrative requests to change your infrastructure from both CLI and the Azure portal.",
@@ -988,8 +966,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure that the latest OS patches for all virtual machines are applied.",
@@ -1011,8 +988,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "The Microsoft Cloud Security Benchmark (or MCSB) is an Azure Policy Initiative containing many security policies to evaluate resource configuration against best practice recommendations. If a policy in the MCSB is set with effect type `Disabled`, it is not evaluated and may prevent administrators from being informed of valuable security recommendations.",
@@ -1034,8 +1010,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable automatic provisioning of the monitoring agent to collect security data.",
@@ -1057,8 +1032,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable automatic provisioning of vulnerability assessment for machines on both Azure and hybrid (Arc enabled) machines.",
@@ -1078,8 +1052,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Enable automatic provisioning of the Microsoft Defender for Containers components.",
@@ -1101,8 +1074,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable security alert emails to subscription owners.",
@@ -1124,8 +1096,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.",
@@ -1147,8 +1118,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enables emailing security alerts to the subscription owner or other designated security contact.",
@@ -1170,8 +1140,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "This integration setting enables Microsoft Defender for Cloud Apps (formerly 'Microsoft Cloud App Security' or 'MCAS' - see additional info) to communicate with Microsoft Defender for Cloud.",
@@ -1193,8 +1162,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "This integration setting enables Microsoft Defender for Endpoint (formerly 'Advanced Threat Protection' or 'ATP' or 'WDATP' - see additional info) to communicate with Microsoft Defender for Cloud.  **IMPORTANT:** When enabling integration between DfE & DfC it needs to be taken into account that this will have some side effects that may be undesirable. 1. For server 2019 & above if defender is installed (default for these server SKU's) this will trigger a deployment of the new unified agent and link to any of the extended configuration in the Defender portal. 1. If the new unified agent is required for server SKU's of Win 2016 or Linux and lower there is additional integration that needs to be switched on and agents need to be aligned.",
@@ -1214,8 +1182,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.1 Microsoft Defender for Cloud",
+          "Section": "2.1 Microsoft Defender for Cloud",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "An organization's attack surface is the collection of assets with a public network identifier or URI that an external threat actor can see or access from outside your cloud. It is the set of points on the boundary of a system, a system element, system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, system component, or environment. The larger the attack surface, the harder it is to protect.  This tool can be configured to scan your organization's online infrastructure such as specified domains, hosts, CIDR blocks, and SSL certificates, and store them in an Inventory. Inventory items can be added, reviewed, approved, and removed, and may contain enrichments (insights) and additional information collected from the tool's different scan engines and open-source intelligence sources.  A Defender EASM workspace will generate an Inventory of publicly exposed assets by crawling and scanning the internet using _Seeds_ you provide when setting up the tool. Seeds can be FQDNs, IP CIDR blocks, and WHOIS records.  Defender EASM will generate Insights within 24-48 hours after Seeds are provided, and these insights include vulnerability data (CVEs), ports and protocols, and weak or expired SSL certificates that could be used by an attacker for reconnaisance or exploitation.  Results are classified High/Medium/Low and some of them include proposed mitigations.",
@@ -1237,8 +1204,7 @@
      ],
      "Attributes": [
        {
-          "Section": "2. Microsoft Defender",
-          "SubSection": "2.2 Microsoft Defender for IoT",
+          "Section": "2.2 Microsoft Defender for IoT",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Microsoft Defender for IoT acts as a central security hub for IoT devices within your organization.",
@@ -1620,8 +1586,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable auditing on SQL Servers.",
@@ -1643,8 +1608,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure that no SQL Databases allow ingress from 0.0.0.0/0 (ANY IP).",
@@ -1666,8 +1630,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Transparent Data Encryption (TDE) with Customer-managed key support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties.  With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with Customer-managed key support for TDE, the DEK can be protected with an asymmetric key that is stored in the Azure Key Vault. The Azure Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data for additional security.  Based on business needs or criticality of data/databases hosted on a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (Customer-managed key).",
@@ -1689,8 +1652,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Use Microsoft Entra authentication for authentication with SQL Database to manage credentials in a single place.",
@@ -1712,8 +1674,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable Transparent Data Encryption on every SQL server.",
@@ -1735,8 +1696,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.1 SQL Server - Auditing",
+          "Section": "4.1 SQL Server - Auditing",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "SQL Server Audit Retention should be configured to be greater than 90 days.",
@@ -1758,8 +1718,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable `SSL connection` on `PostgreSQL` Servers.",
@@ -1781,8 +1740,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable `log_checkpoints` on `PostgreSQL Servers`.",
@@ -1804,8 +1762,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable `log_connections` on `PostgreSQL Servers`.",
@@ -1827,8 +1784,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable `log_disconnections` on `PostgreSQL Servers`.",
@@ -1850,8 +1806,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable `connection_throttling` on `PostgreSQL Servers`.",
@@ -1873,8 +1828,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure `log_retention_days` on `PostgreSQL Servers` is set to an appropriate value.",
@@ -1896,8 +1850,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Disable access from Azure services to PostgreSQL Database Server.",
@@ -1917,8 +1870,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.3 PostgreSQL Database Server. Storage Accounts",
+          "Section": "4.3 PostgreSQL Database Server. Storage Accounts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Azure Database for PostgreSQL servers should be created with 'infrastructure double encryption' enabled.",
@@ -1940,8 +1892,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable `SSL connection` on `MYSQL` Servers.",
@@ -1963,8 +1914,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure `TLS version` on `MySQL flexible` servers is set to use TLS version 1.2 or higher.",
@@ -1986,8 +1936,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable audit_log_enabled on MySQL Servers.",
@@ -2009,8 +1958,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.4 MySQL Database",
+          "Section": "4.4 MySQL Database",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Set `audit_log_enabled` to include CONNECTION on MySQL Servers.",
@@ -2032,8 +1980,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.5 Cosmos DB",
+          "Section": "4.5 Cosmos DB",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Limiting your Cosmos DB to only communicate on whitelisted networks lowers its attack footprint.",
@@ -2055,8 +2002,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.5 Cosmos DB",
+          "Section": "4.5 Cosmos DB",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Private endpoints limit network traffic to approved sources.",
@@ -2078,8 +2024,7 @@
      ],
      "Attributes": [
        {
-          "Section": "4. Database Services",
-          "SubSection": "4.5 Cosmos DB",
+          "Section": "4.5 Cosmos DB",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Cosmos DB can use tokens or Entra ID for client authentication which in turn will use Azure RBAC for authorization. Using Entra ID is significantly more secure because Entra ID handles the credentials and allows for MFA and centralized management, and the Azure RBAC better integrated with the rest of Azure.",
@@ -2141,8 +2086,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "Enable Diagnostic settings for exporting activity logs. Diagnostic settings are available for each individual resource within a subscription. Settings should be configured for all appropriate resources for your environment.",
@@ -2164,8 +2108,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "**Prerequisite**: A Diagnostic Setting must exist. If a Diagnostic Setting does not exist, the navigation and options within this recommendation will not be available. Please review the recommendation at the beginning of this subsection titled: Ensure that a 'Diagnostic Setting' exists.  The diagnostic setting should be configured to log the appropriate activities from the control/management plane.",
@@ -2187,8 +2130,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).",
@@ -2210,8 +2152,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.",
@@ -2233,8 +2174,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Ensure that network flow logs are captured and fed into a central log analytics workspace.",
@@ -2256,8 +2196,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.1 Configuring Diagnostic Settings",
+          "Section": "5.1 Configuring Diagnostic Settings",
          "Profile": "Level 2",
          "AssessmentStatus": "Manual",
          "Description": "Enable AppServiceHTTPLogs diagnostic log category for Azure App Service instances to ensure all http requests are captured and centrally logged.",
@@ -2279,8 +2218,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create Policy Assignment event.",
@@ -2302,8 +2240,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Policy Assignment event.",
@@ -2325,8 +2262,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an Activity Log Alert for the Create or Update Network Security Group event.",
@@ -2348,8 +2284,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Network Security Group event.",
@@ -2371,8 +2306,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create or Update Security Solution event.",
@@ -2394,8 +2328,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Security Solution event.",
@@ -2417,8 +2350,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create or Update SQL Server Firewall Rule event.",
@@ -2440,8 +2372,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete SQL Server Firewall Rule.",
@@ -2463,8 +2394,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Create or Update Public IP Addresses rule.",
@@ -2486,8 +2416,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.2 Monitoring using Activity Log Alerts",
+          "Section": "5.2 Monitoring using Activity Log Alerts",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Create an activity log alert for the Delete Public IP Address rule.",
@@ -2509,8 +2438,7 @@
      ],
      "Attributes": [
        {
-          "Section": "5. Logging and Monitoring",
-          "SubSection": "5.3 Configuring Application Insights. Storage Accounts",
+          "Section": "5.3 Configuring Application Insights. Storage Accounts",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "Application Insights within Azure act as an Application Performance Monitoring solution providing valuable data into how well an application performs and additional information when performing incident response. The types of log data collected include application metrics, telemetry data, and application trace logging data providing organizations with detailed information about application activity and application transactions. Both data sets help organizations adopt a proactive and retroactive means to handle security and performance related metrics within their modern applications.",
@@ -3115,9 +3043,7 @@
    {
      "Id": "9.4",
      "Description": "Ensure that Register with Entra ID is enabled on App Service",
-      "Checks": [
-        "app_register_with_identity"
-      ],
+      "Checks": [],
      "Attributes": [
        {
          "Section": "9. AppService",
@@ -1292,8 +1292,7 @@
      "Checks": [],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6.1. MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Manual",
          "Description": "It is recommended to set a password for the administrative user (`root` by default) to prevent unauthorized access to the SQL database instances.  This recommendation is applicable only for MySQL Instances. PostgreSQL does not offer any setting for No Password from the cloud console.",
@@ -1314,8 +1313,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6.1. MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`",
@@ -1336,8 +1334,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.1. MySQL Database",
+          "Section": "6.1. MySQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.",
@@ -1358,8 +1355,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged. Valid values are: - `TERSE` - `DEFAULT` - `VERBOSE`  `TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information.  `VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error.  Ensure an appropriate value is set to 'DEFAULT' or stricter.",
@@ -1380,8 +1376,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. Ensure a value of `ERROR` or stricter is set.",
@@ -1402,8 +1397,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 2",
          "AssessmentStatus": "Automated",
          "Description": "The value of `log_statement` flag determined the SQL statements that are logged. Valid values are: - `none` - `ddl` - `mod` - `all`  The value `ddl` logs all data definition statements. The value `mod` logs all ddl statements, plus data-modifying statements.  The statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors. When using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.  A value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.",
@@ -1424,8 +1418,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Instance addresses can be public IP or private IP. Public IP means that the instance is accessible through the public internet. In contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC).  Limiting network access to your database will limit potential attacks.",
@@ -1446,8 +1439,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.",
@@ -1468,8 +1460,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication. This parameter cannot be changed after the session starts.",
@@ -1490,8 +1481,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.",
@@ -1512,8 +1502,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged. Ensure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.",
@@ -1534,8 +1523,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.2. PostgreSQL Database",
+          "Section": "6.2. PostgreSQL Database",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement. Messages for error statements are logged with the SQL statement. Valid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`. Each severity level includes the subsequent levels mentioned above. ERROR is considered the best practice setting. Changes should only be made in accordance with the organization's logging policy.",
@@ -1556,8 +1544,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.",
@@ -1578,8 +1565,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`",
@@ -1600,8 +1586,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -1622,8 +1607,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.",
@@ -1644,8 +1628,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.",
@@ -1666,8 +1649,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`.",
@@ -1688,8 +1670,7 @@
      ],
      "Attributes": [
        {
-          "Section": "6. Cloud SQL Database Services",
-          "SubSection": "6.3. SQL Server",
+          "Section": "6.3. SQL Server",
          "Profile": "Level 1",
          "AssessmentStatus": "Automated",
          "Description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.",
@@ -86,23 +86,50 @@ def get_default_mute_file_path(provider: str):
    return mutelist_path


-def check_current_version():
+def get_latest_release_version():
+    """Return the latest Prowler release tag name from GitHub, or None if it cannot be retrieved."""
    try:
-        prowler_version_string = f"Prowler {prowler_version}"
        release_response = requests.get(
            "https://api.github.com/repos/prowler-cloud/prowler/tags", timeout=1
        )
-        latest_version = release_response.json()[0]["name"]
+        return release_response.json()[0]["name"]
+    except Exception:
+        return None
+
+
+def get_available_update():
+    """Return the latest Prowler version if it is newer than the running one, None otherwise.
+
+    Honors the PROWLER_NO_VERSION_CHECK and DO_NOT_TRACK environment variables:
+    when either is set, no network call is made and None is returned.
+    """
+    if os.environ.get("PROWLER_NO_VERSION_CHECK") or os.environ.get("DO_NOT_TRACK"):
+        return None
+    latest_version = get_latest_release_version()
+    try:
+        if latest_version and version.parse(latest_version) > version.parse(
+            prowler_version
+        ):
+            return latest_version
+    except Exception:
+        return None
+    return None
+
+
+def check_current_version():
+    prowler_version_string = f"Prowler {prowler_version}"
+    latest_version = get_latest_release_version()
+    if not latest_version:
+        return prowler_version_string
+    try:
        if version.parse(latest_version) > version.parse(prowler_version):
            return f"{prowler_version_string} (latest is {latest_version}, upgrade for the latest features)"
        else:
            return (
                f"{prowler_version_string} (You are running the latest version, yay!)"
            )
-    except requests.RequestException:
-        return f"{prowler_version_string}"
    except Exception:
-        return f"{prowler_version_string}"
+        return prowler_version_string


 def load_and_validate_config_file(provider: str, config_file_path: str) -> dict:
@@ -91,7 +91,6 @@ aws:
      "python3.6",
      "python2.7",
      "python3.7",
-      "python3.8",
      "nodejs4.3",
      "nodejs4.3-edge",
      "nodejs6.10",
@@ -102,7 +101,6 @@ aws:
      "nodejs14.x",
      "nodejs16.x",
      "dotnet5.0",
-      "dotnet6",
      "dotnet7",
      "dotnetcore1.0",
      "dotnetcore2.0",
@@ -356,11 +354,6 @@ aws:
  # Minimum number of Availability Zones that an ELBv2 must be in
  elbv2_min_azs: 2

-  # AWS Elasticache Configuration
-  # aws.elasticache_redis_cluster_backup_enabled
-  # Minimum number of days that a Redis cluster must have backups retention period
-  minimum_snapshot_retention_period: 7
-

  # AWS Secrets Configuration
  # Patterns to ignore in the secrets checks
@@ -2,6 +2,75 @@ from colorama import Fore, Style

 from prowler.config.config import banner_color, orange_color, prowler_version, timestamp

+# Prowler Cloud landing URL used by the CLI banner. The visible text stays
+# "cloud.prowler.com" while the clickable target carries the UTM parameters so
+# terminals that support OSC 8 hyperlinks attribute the visit to the v4 CLI.
+CLOUD_DISPLAY_TEXT = "cloud.prowler.com"
+CLOUD_BANNER_URL = (
+    "https://cloud.prowler.com/sign-up?utm_source=prowler-cli&utm_content=v4"
+)
+
+
+def _hyperlink(url: str, text: str) -> str:
+    """Wrap ``text`` in an OSC 8 terminal hyperlink pointing to ``url``.
+
+    Terminals that support OSC 8 render ``text`` as a clickable link to ``url``;
+    those that do not simply display ``text`` unchanged.
+    """
+    return f"\033]8;;{url}\033\\{text}\033]8;;\033\\"
+
+
+def print_update_notice(latest_version: str):
+    """
+    Prints a notice that a newer Prowler version is available.
+
+    Parameters:
+    - latest_version (str): The latest released Prowler version.
+
+    Returns:
+    - None
+    """
+    print(
+        f"\n{Fore.YELLOW}A new version of Prowler is available: {prowler_version} → {latest_version}{Style.RESET_ALL}\n"
+        f"Upgrading from Prowler v4 is a major version upgrade — see the release notes at\n"
+        f"https://github.com/prowler-cloud/prowler/releases before upgrading.\n"
+        f"Upgrade with: {Style.BRIGHT}pipx upgrade prowler{Style.RESET_ALL} "
+        f"(disable this check with PROWLER_NO_VERSION_CHECK=1)"
+    )
+
+
+def print_prowler_cloud_banner():
+    """
+    Prints a promotional banner highlighting what Prowler Cloud adds on top of
+    the open-source CLI.
+
+    Shown at the end of a scan to let users know about the managed platform
+    capabilities they are missing.
+
+    Returns:
+    - None
+    """
+    check = f"{Fore.GREEN}✓{Style.RESET_ALL}"
+    bar = f"{banner_color}│{Style.RESET_ALL}"
+    print(
+        f"""
+{bar} {Style.BRIGHT}You're getting a snapshot 📸. Prowler Cloud gives you the full picture:{Style.RESET_ALL}
+{bar}
+{bar} {check} {Style.BRIGHT}Send your findings{Style.RESET_ALL} - directly from the Prowler CLI to Prowler Cloud.
+{bar} {check} {Style.BRIGHT}Continuous Security Monitoring{Style.RESET_ALL} - custom scheduling and scan configuration with history, trends and alerts.
+{bar} {check} {Style.BRIGHT}Triage{Style.RESET_ALL} - review findings, flag false positives and track accepted risk with your team.
+{bar} {check} {Style.BRIGHT}Lighthouse AI + MCP{Style.RESET_ALL} - autonomous triage, custom dashboards, prioritization with prevention and remediation.
+{bar} {check} {Style.BRIGHT}Alerts{Style.RESET_ALL} - get notified when anything you want is happening.
+{bar} {check} {Style.BRIGHT}Live Compliance{Style.RESET_ALL} - dashboards for 50+ frameworks, always up to date.
+{bar} {check} {Style.BRIGHT}Remediation{Style.RESET_ALL} - complete guided remediation including Autonomous remediation with Lighthouse AI.
+{bar} {check} {Style.BRIGHT}Attack Path Visualization{Style.RESET_ALL} - see how attackers chain risks to reach your crown jewels.
+{bar} {check} {Style.BRIGHT}Bulk Provisioning{Style.RESET_ALL} - add your entire AWS Organization in seconds.
+{bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Anything with our MCP + Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC.
+{bar}
+{bar} {banner_color}Start free at 👉 {_hyperlink(CLOUD_BANNER_URL, CLOUD_DISPLAY_TEXT)}{Style.RESET_ALL}
+"""
+    )
+

 def print_banner(legend: bool = False):
    """
@@ -83,7 +83,6 @@ class CIS_Requirement_Attribute(BaseModel):
    """CIS Requirement Attribute"""

    Section: str
-    SubSection: Optional[str]
    Profile: CIS_Requirement_Attribute_Profile
    AssessmentStatus: CIS_Requirement_Attribute_AssessmentStatus
    Description: str
@@ -48,7 +48,6 @@ class AWSCIS(ComplianceOutput):
                            Requirements_Id=requirement.Id,
                            Requirements_Description=requirement.Description,
                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_SubSection=attribute.SubSection,
                            Requirements_Attributes_Profile=attribute.Profile,
                            Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                            Requirements_Attributes_Description=attribute.Description,
@@ -79,7 +78,6 @@ class AWSCIS(ComplianceOutput):
                        Requirements_Id=requirement.Id,
                        Requirements_Description=requirement.Description,
                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_SubSection=attribute.SubSection,
                        Requirements_Attributes_Profile=attribute.Profile,
                        Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                        Requirements_Attributes_Description=attribute.Description,
@@ -48,7 +48,6 @@ class AzureCIS(ComplianceOutput):
                            Requirements_Id=requirement.Id,
                            Requirements_Description=requirement.Description,
                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_SubSection=attribute.SubSection,
                            Requirements_Attributes_Profile=attribute.Profile,
                            Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                            Requirements_Attributes_Description=attribute.Description,
@@ -80,7 +79,6 @@ class AzureCIS(ComplianceOutput):
                        Requirements_Id=requirement.Id,
                        Requirements_Description=requirement.Description,
                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_SubSection=attribute.SubSection,
                        Requirements_Attributes_Profile=attribute.Profile,
                        Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                        Requirements_Attributes_Description=attribute.Description,
@@ -48,7 +48,6 @@ class GCPCIS(ComplianceOutput):
                            Requirements_Id=requirement.Id,
                            Requirements_Description=requirement.Description,
                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_SubSection=attribute.SubSection,
                            Requirements_Attributes_Profile=attribute.Profile,
                            Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                            Requirements_Attributes_Description=attribute.Description,
@@ -79,7 +78,6 @@ class GCPCIS(ComplianceOutput):
                        Requirements_Id=requirement.Id,
                        Requirements_Description=requirement.Description,
                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_SubSection=attribute.SubSection,
                        Requirements_Attributes_Profile=attribute.Profile,
                        Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                        Requirements_Attributes_Description=attribute.Description,
@@ -50,7 +50,6 @@ class KubernetesCIS(ComplianceOutput):
                            Requirements_Id=requirement.Id,
                            Requirements_Description=requirement.Description,
                            Requirements_Attributes_Section=attribute.Section,
-                            Requirements_Attributes_SubSection=attribute.SubSection,
                            Requirements_Attributes_Profile=attribute.Profile,
                            Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                            Requirements_Attributes_Description=attribute.Description,
@@ -82,7 +81,6 @@ class KubernetesCIS(ComplianceOutput):
                        Requirements_Id=requirement.Id,
                        Requirements_Description=requirement.Description,
                        Requirements_Attributes_Section=attribute.Section,
-                        Requirements_Attributes_SubSection=attribute.SubSection,
                        Requirements_Attributes_Profile=attribute.Profile,
                        Requirements_Attributes_AssessmentStatus=attribute.AssessmentStatus,
                        Requirements_Attributes_Description=attribute.Description,
@@ -1,5 +1,3 @@
-from typing import Optional
-
 from pydantic import BaseModel


@@ -16,7 +14,6 @@ class AWSCISModel(BaseModel):
    Requirements_Id: str
    Requirements_Description: str
    Requirements_Attributes_Section: str
-    Requirements_Attributes_SubSection: Optional[str]
    Requirements_Attributes_Profile: str
    Requirements_Attributes_AssessmentStatus: str
    Requirements_Attributes_Description: str
@@ -47,7 +44,6 @@ class AzureCISModel(BaseModel):
    Requirements_Id: str
    Requirements_Description: str
    Requirements_Attributes_Section: str
-    Requirements_Attributes_SubSection: Optional[str]
    Requirements_Attributes_Profile: str
    Requirements_Attributes_AssessmentStatus: str
    Requirements_Attributes_Description: str
@@ -79,7 +75,6 @@ class GCPCISModel(BaseModel):
    Requirements_Id: str
    Requirements_Description: str
    Requirements_Attributes_Section: str
-    Requirements_Attributes_SubSection: Optional[str]
    Requirements_Attributes_Profile: str
    Requirements_Attributes_AssessmentStatus: str
    Requirements_Attributes_Description: str
@@ -110,7 +105,6 @@ class KubernetesCISModel(BaseModel):
    Requirements_Id: str
    Requirements_Description: str
    Requirements_Attributes_Section: str
-    Requirements_Attributes_SubSection: Optional[str]
    Requirements_Attributes_Profile: str
    Requirements_Attributes_AssessmentStatus: str
    Requirements_Attributes_Description: str
@@ -45,8 +45,6 @@ class AWSISO27001(ComplianceOutput):
                            AccountId=finding.account_uid,
                            Region=finding.region,
                            AssessmentDate=str(finding.timestamp),
-                            Requirements_Id=requirement.Id,
-                            Requirements_Description=requirement.Description,
                            Requirements_Attributes_Category=attribute.Category,
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
@@ -69,8 +67,6 @@ class AWSISO27001(ComplianceOutput):
                        AccountId="",
                        Region="",
                        AssessmentDate=str(finding.timestamp),
-                        Requirements_Id=requirement.Id,
-                        Requirements_Description=requirement.Description,
                        Requirements_Attributes_Category=attribute.Category,
                        Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                        Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
@@ -11,8 +11,6 @@ class AWSISO27001Model(BaseModel):
    AccountId: str
    Region: str
    AssessmentDate: str
-    Requirements_Id: str
-    Requirements_Description: str
    Requirements_Attributes_Category: str
    Requirements_Attributes_Objetive_ID: str
    Requirements_Attributes_Objetive_Name: str
@@ -1,5 +1,4 @@
 import os
-from datetime import datetime
 from typing import List

 from py_ocsf_models.events.base_event import SeverityID, StatusID
@@ -69,11 +68,7 @@ class OCSF(Output):
                    activity_name=finding_activity.name,
                    finding_info=FindingInformation(
                        created_time_dt=finding.timestamp,
-                        created_time=(
-                            int(finding.timestamp.timestamp())
-                            if isinstance(finding.timestamp, datetime)
-                            else finding.timestamp
-                        ),
+                        created_time=int(finding.timestamp.timestamp()),
                        desc=finding.metadata.Description,
                        title=finding.metadata.CheckTitle,
                        uid=finding.uid,
@@ -82,11 +77,7 @@ class OCSF(Output):
                        types=finding.metadata.CheckType,
                    ),
                    time_dt=finding.timestamp,
-                    time=(
-                        int(finding.timestamp.timestamp())
-                        if isinstance(finding.timestamp, datetime)
-                        else finding.timestamp
-                    ),
+                    time=int(finding.timestamp.timestamp()),
                    remediation=Remediation(
                        desc=finding.metadata.Remediation.Recommendation.Text,
                        references=list(
@@ -789,14 +789,7 @@ class AwsProvider(Provider):
        # Handle if there are audit resources so only their services are executed
        if self._audit_resources:
            # TODO: this should be retrieved automatically
-            services_without_subservices = [
-                "guardduty",
-                "kms",
-                "s3",
-                "elb",
-                "efs",
-                "sqs",
-            ]
+            services_without_subservices = ["guardduty", "kms", "s3", "elb", "efs"]
            service_list = set()
            sub_service_list = set()
            for resource in self._audit_resources:
@@ -7,9 +7,9 @@
  ],
  "ServiceName": "account",
  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id",
+  "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id",
  "Severity": "medium",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "Other",
  "Description": "Maintain current contact details.",
  "Risk": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.",
  "RelatedUrl": "",
@@ -7,9 +7,9 @@
  ],
  "ServiceName": "account",
  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id",
+  "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id",
  "Severity": "medium",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "Other",
  "Description": "Maintain different contact details to security, billing and operations.",
  "Risk": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization. An AWS account supports a number of contact details, and AWS will use these to contact the account owner if activity judged to be in breach of Acceptable Use Policy. If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed. If this is unsuccessful and the account behavior needs urgent mitigation, proactive measures may be taken, including throttling of traffic between the account exhibiting suspicious behavior and the AWS API endpoints and the Internet. This will result in impaired service to and from the account in question.",
  "RelatedUrl": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html",
@@ -7,9 +7,9 @@
  ],
  "ServiceName": "account",
  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id",
+  "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id",
  "Severity": "medium",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "Other",
  "Description": "Ensure security contact information is registered.",
  "Risk": "AWS provides customers with the option of specifying the contact information for accounts security team. It is recommended that this information be provided. Specifying security-specific contact information will help ensure that security advisories sent by AWS reach the team in your organization that is best equipped to respond to them.",
  "RelatedUrl": "",
@@ -7,9 +7,9 @@
  ],
  "ServiceName": "account",
  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:partition:service:region:account-id",
+  "ResourceIdTemplate": "arn:partition:access-recorder:region:account-id:recorder/resource-id",
  "Severity": "medium",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "Other",
  "Description": "Ensure security questions are registered in the AWS account.",
  "Risk": "The AWS support portal allows account owners to establish security questions that can be used to authenticate individuals calling AWS customer service for support. It is recommended that security questions be established. When creating a new AWS account a default super user is automatically created. This account is referred to as the root account. It is recommended that the use of this account be limited and highly controlled. During events in which the root password is no longer accessible or the MFA token associated with root is lost/destroyed it is possible through authentication using secret questions and associated answers to recover root login access.",
  "RelatedUrl": "",
@@ -1,6 +1,5 @@
 from typing import Optional

-from botocore.exceptions import ClientError
 from pydantic import BaseModel

 from prowler.lib.logger import logger
@@ -8,6 +7,7 @@ from prowler.lib.scan_filters.scan_filters import is_resource_filtered
 from prowler.providers.aws.lib.service.service import AWSService


+################## ApiGatewayV2
 class ApiGatewayV2(AWSService):
    def __init__(self, provider):
        # Call AWSService's __init__
@@ -71,15 +71,6 @@ class ApiGatewayV2(AWSService):
                            tags=[stage.get("Tags")],
                        )
                    )
-        except ClientError as error:
-            if error.response["Error"]["Code"] == "NotFoundException":
-                logger.warning(
-                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                )
-            else:
-                logger.error(
-                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                )
        except Exception as error:
            logger.error(
                f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
@@ -8,20 +8,19 @@ class autoscaling_group_launch_configuration_no_public_ip(Check):
    def execute(self):
        findings = []
        for group in autoscaling_client.groups:
+            report = Check_Report_AWS(self.metadata())
+            report.region = group.region
+            report.resource_id = group.name
+            report.resource_arn = group.arn
+            report.resource_tags = group.tags
+            report.status = "PASS"
+            report.status_extended = f"Autoscaling group {group.name} does not have an associated launch configuration assigning a public IP address."
+
            for lc in autoscaling_client.launch_configurations.values():
-                if lc.name == group.launch_configuration_name:
-                    report = Check_Report_AWS(self.metadata())
-                    report.region = group.region
-                    report.resource_id = group.name
-                    report.resource_arn = group.arn
-                    report.resource_tags = group.tags
-                    report.status = "PASS"
-                    report.status_extended = f"Autoscaling group {group.name} does not have an associated launch configuration assigning a public IP address."
+                if lc.name == group.launch_configuration_name and lc.public_ip:
+                    report.status = "FAIL"
+                    report.status_extended = f"Autoscaling group {group.name} has an associated launch configuration assigning a public IP address."

-                    if lc.public_ip:
-                        report.status = "FAIL"
-                        report.status_extended = f"Autoscaling group {group.name} has an associated launch configuration assigning a public IP address."
-
-                    findings.append(report)
+            findings.append(report)

        return findings
@@ -8,17 +8,20 @@ class autoscaling_group_launch_configuration_requires_imdsv2(Check):
    def execute(self):
        findings = []
        for group in autoscaling_client.groups:
+            report = Check_Report_AWS(self.metadata())
+            report.region = group.region
+            report.resource_id = group.name
+            report.resource_arn = group.arn
+            report.resource_tags = group.tags
+            report.status = "FAIL"
+            report.status_extended = (
+                f"Autoscaling group {group.name} has IMDSv2 disabled or not required."
+            )
+
            for (
                launch_configuration
            ) in autoscaling_client.launch_configurations.values():
                if launch_configuration.name == group.launch_configuration_name:
-                    report = Check_Report_AWS(self.metadata())
-                    report.region = group.region
-                    report.resource_id = group.name
-                    report.resource_arn = group.arn
-                    report.resource_tags = group.tags
-                    report.status = "FAIL"
-                    report.status_extended = f"Autoscaling group {group.name} has IMDSv2 disabled or not required."
                    if (
                        launch_configuration.http_endpoint == "enabled"
                        and launch_configuration.http_tokens == "required"
@@ -29,6 +32,6 @@ class autoscaling_group_launch_configuration_requires_imdsv2(Check):
                        report.status = "PASS"
                        report.status_extended = f"Autoscaling group {group.name} has metadata service disabled."

-                    findings.append(report)
+            findings.append(report)

        return findings
@@ -1,4 +1,3 @@
-import hashlib
 import json

 from prowler.lib.check.models import Check, Check_Report_AWS
@@ -29,19 +28,11 @@ class awslambda_function_no_secrets_in_variables(Check):
                    data=json.dumps(function.environment, indent=2),
                    excluded_secrets=secrets_ignore_patterns,
                )
-                original_env_vars = {}
-                for name, value in function.environment.items():
-                    original_env_vars.update(
-                        {
-                            hashlib.sha1(  # nosec B324 SHA1 is used here for non-security-critical unique identifiers
-                                value.encode("utf-8")
-                            ).hexdigest(): name
-                        }
-                    )
                if detect_secrets_output:
+                    environment_variable_names = list(function.environment.keys())
                    secrets_string = ", ".join(
                        [
-                            f"{secret['type']} in variable {original_env_vars[secret['hashed_secret']]}"
+                            f"{secret['type']} in variable {environment_variable_names[int(secret['line_number']) - 2]}"
                            for secret in detect_secrets_output
                        ]
                    )
@@ -14,14 +14,14 @@ class awslambda_function_not_publicly_accessible(Check):
            report.resource_tags = function.tags

            report.status = "PASS"
-            report.status_extended = f"Lambda function {function.name} has a resource-based policy without public access."
+            report.status_extended = f"Lambda function {function.name} has a policy resource-based policy not public."
            if is_policy_public(
                function.policy,
                awslambda_client.audited_account,
                is_cross_account_allowed=True,
            ):
                report.status = "FAIL"
-                report.status_extended = f"Lambda function {function.name} has a resource-based policy with public access."
+                report.status_extended = f"Lambda function {function.name} has a policy resource-based policy with public access."

            findings.append(report)

@@ -1,37 +1,6 @@
 from prowler.lib.check.models import Check, Check_Report_AWS
 from prowler.providers.aws.services.awslambda.awslambda_client import awslambda_client

-<<<<<<< HEAD
-=======
-default_obsolete_lambda_runtimes = [
-    "java8",
-    "go1.x",
-    "provided",
-    "python3.6",
-    "python2.7",
-    "python3.7",
-    "python3.8",
-    "nodejs4.3",
-    "nodejs4.3-edge",
-    "nodejs6.10",
-    "nodejs",
-    "nodejs8.10",
-    "nodejs10.x",
-    "nodejs12.x",
-    "nodejs14.x",
-    "nodejs16.x",
-    "dotnet5.0",
-    "dotnet6",
-    "dotnet7",
-    "dotnetcore1.0",
-    "dotnetcore2.0",
-    "dotnetcore2.1",
-    "dotnetcore3.1",
-    "ruby2.5",
-    "ruby2.7",
-]
-
->>>>>>> 9923def4c (chore(awslambda): update obsolete lambda runtimes (#7330))

 class awslambda_function_using_supported_runtimes(Check):
    def execute(self):
@@ -8,14 +8,14 @@ class backup_recovery_point_encrypted(Check):
        for recovery_point in backup_client.recovery_points:
            report = Check_Report_AWS(self.metadata())
            report.region = recovery_point.backup_vault_region
-            report.resource_id = recovery_point.id
+            report.resource_id = recovery_point.backup_vault_name
            report.resource_arn = recovery_point.arn
            report.resource_tags = recovery_point.tags
            report.status = "FAIL"
-            report.status_extended = f"Backup Recovery Point {recovery_point.id} for Backup Vault {recovery_point.backup_vault_name} is not encrypted at rest."
+            report.status_extended = f"Backup Recovery Point {recovery_point.arn} for Backup Vault {recovery_point.backup_vault_name} is not encrypted at rest."
            if recovery_point.encrypted:
                report.status = "PASS"
-                report.status_extended = f"Backup Recovery Point {recovery_point.id} for Backup Vault {recovery_point.backup_vault_name} is encrypted at rest."
+                report.status_extended = f"Backup Recovery Point {recovery_point.arn} for Backup Vault {recovery_point.backup_vault_name} is encrypted at rest."

            findings.append(report)

@@ -18,8 +18,7 @@ class Backup(AWSService):
        self.backup_vault_arn_template = f"arn:{self.audited_partition}:backup:{self.region}:{self.audited_account}:backup-vault"
        self.backup_vaults = []
        self.__threading_call__(self._list_backup_vaults)
-        if self.backup_vaults is not None:
-            self.__threading_call__(self._list_tags, self.backup_vaults)
+        self.__threading_call__(self._list_tags, self.backup_vaults)
        self.backup_plans = []
        self.__threading_call__(self._list_backup_plans)
        self.__threading_call__(self._list_tags, self.backup_plans)
@@ -29,7 +28,6 @@ class Backup(AWSService):
        self.__threading_call__(self._list_backup_selections)
        self.recovery_points = []
        self.__threading_call__(self._list_recovery_points)
-        self.__threading_call__(self._list_tags, self.recovery_points)

    def _list_backup_vaults(self, regional_client):
        logger.info("Backup - Listing Backup Vaults...")
@@ -173,11 +171,10 @@ class Backup(AWSService):

    def _list_tags(self, resource):
        try:
-            if getattr(resource, "arn", None):
-                tags = self.regional_clients[resource.region].list_tags(
-                    ResourceArn=resource.arn
-                )["Tags"]
-                resource.tags = [tags] if tags else []
+            tags = self.regional_clients[resource.region].list_tags(
+                ResourceArn=resource.arn
+            )["Tags"]
+            resource.tags = [tags] if tags else []
        except Exception as error:
            logger.error(
                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -198,13 +195,11 @@ class Backup(AWSService):
                                self.recovery_points.append(
                                    RecoveryPoint(
                                        arn=arn,
-                                        id=arn.split(":")[-1],
                                        backup_vault_name=backup_vault.name,
                                        encrypted=recovery_point.get(
                                            "IsEncrypted", False
                                        ),
                                        backup_vault_region=backup_vault.region,
-                                        region=regional_client.region,
                                        tags=[],
                                    )
                                )
@@ -251,8 +246,6 @@ class BackupReportPlan(BaseModel):

 class RecoveryPoint(BaseModel):
    arn: str
-    id: str
-    region: str
    backup_vault_name: str
    encrypted: bool
    backup_vault_region: str
@@ -18,20 +18,14 @@ class cloudfront_distributions_origin_traffic_encrypted(Check):
            unencrypted_origins = []

            for origin in distribution.origins:
-                if origin.s3_origin_config:
-                    # For S3, only check the viewer protocol policy
-                    if distribution.viewer_protocol_policy == "allow-all":
-                        unencrypted_origins.append(origin.id)
-                else:
-                    # Regular check for custom origins (ALB, EC2, API Gateway, etc.)
-                    if (
-                        origin.origin_protocol_policy == ""
-                        or origin.origin_protocol_policy == "http-only"
-                    ) or (
-                        origin.origin_protocol_policy == "match-viewer"
-                        and distribution.viewer_protocol_policy == "allow-all"
-                    ):
-                        unencrypted_origins.append(origin.id)
+                if (
+                    origin.origin_protocol_policy == ""
+                    or origin.origin_protocol_policy == "http-only"
+                ) or (
+                    origin.origin_protocol_policy == "match-viewer"
+                    and distribution.viewer_protocol_policy == "allow-all"
+                ):
+                    unencrypted_origins.append(origin.id)

            if unencrypted_origins:
                report.status = "FAIL"
@@ -20,7 +20,7 @@ class cloudfront_distributions_s3_origin_non_existent_bucket(Check):

            for origin in distribution.origins:
                if origin.s3_origin_config:
-                    bucket_name = origin.domain_name.split(".s3")[0]
+                    bucket_name = origin.domain_name.split(".")[0]
                    if not s3_client._head_bucket(bucket_name):
                        non_existent_buckets.append(bucket_name)

@@ -48,7 +48,7 @@ class cloudtrail_multi_region_enabled_logging_management_events(Check):
                        report.resource_id = trail.name
                        report.resource_arn = trail.arn
                        report.resource_tags = trail.tags
-                        report.region = region
+                        report.region = trail.home_region
                        report.status = "PASS"
                        if trail.is_multiregion:
                            report.status_extended = f"Trail {trail.name} from home region {trail.home_region} is multi-region, is logging and have management events enabled."
@@ -12,21 +12,18 @@ class cloudwatch_log_group_not_publicly_accessible(Check):
            and logs_client.log_groups is not None
        ):
            for resource_policies in logs_client.resource_policies.values():
-                if resource_policies is not None:
-                    for resource_policy in resource_policies:
-                        if is_policy_public(
-                            resource_policy.policy, logs_client.audited_account
-                        ):
-                            for statement in resource_policy.policy.get(
-                                "Statement", []
-                            ):
-                                public_resources = statement.get("Resource", [])
-                                if isinstance(public_resources, str):
-                                    public_resources = [public_resources]
-                                for resource in public_resources:
-                                    for log_group in logs_client.log_groups.values():
-                                        if log_group.arn in resource or resource == "*":
-                                            public_log_groups.append(log_group.arn)
+                for resource_policy in resource_policies:
+                    if is_policy_public(
+                        resource_policy.policy, logs_client.audited_account
+                    ):
+                        for statement in resource_policy.policy.get("Statement", []):
+                            public_resources = statement.get("Resource", [])
+                            if isinstance(public_resources, str):
+                                public_resources = [public_resources]
+                            for resource in public_resources:
+                                for log_group in logs_client.log_groups.values():
+                                    if log_group.arn in resource or resource == "*":
+                                        public_log_groups.append(log_group.arn)
            for log_group in logs_client.log_groups.values():
                report = Check_Report_AWS(self.metadata())
                report.region = log_group.region
@@ -18,24 +18,24 @@ def check_cloudwatch_log_metric_filter(
        for trail in trails.values():
            if trail.log_group_arn:
                log_groups.append(trail.log_group_arn.split(":")[6])
-        # 2. Describe metric filters for previous log groups
-        for metric_filter in metric_filters:
-            if metric_filter.log_group.name in log_groups and re.search(
-                metric_filter_pattern, metric_filter.pattern, flags=re.DOTALL
-            ):
-                report.resource_id = metric_filter.log_group.name
-                report.resource_arn = metric_filter.log_group.arn
-                report.region = metric_filter.log_group.region
-                report.resource_tags = getattr(metric_filter.log_group, "tags", [])
-                report.status = "FAIL"
-                report.status_extended = f"CloudWatch log group {metric_filter.log_group.name} found with metric filter {metric_filter.name} but no alarms associated."
-                # 3. Check if there is an alarm for the metric
-                for alarm in metric_alarms:
-                    if alarm.metric == metric_filter.metric:
-                        report.status = "PASS"
-                        report.status_extended = f"CloudWatch log group {metric_filter.log_group.name} found with metric filter {metric_filter.name} and alarms set."
-                        break
-                if report.status == "PASS":
+    # 2. Describe metric filters for previous log groups
+    for metric_filter in metric_filters:
+        if metric_filter.log_group.name in log_groups and re.search(
+            metric_filter_pattern, metric_filter.pattern, flags=re.DOTALL
+        ):
+            report.resource_id = metric_filter.log_group.name
+            report.resource_arn = metric_filter.log_group.arn
+            report.region = metric_filter.log_group.region
+            report.resource_tags = getattr(metric_filter.log_group, "tags", [])
+            report.status = "FAIL"
+            report.status_extended = f"CloudWatch log group {metric_filter.log_group.name} found with metric filter {metric_filter.name} but no alarms associated."
+            # 3. Check if there is an alarm for the metric
+            for alarm in metric_alarms:
+                if alarm.metric == metric_filter.metric:
+                    report.status = "PASS"
+                    report.status_extended = f"CloudWatch log group {metric_filter.log_group.name} found with metric filter {metric_filter.name} and alarms set."
                    break
+            if report.status == "PASS":
+                break

    return report
@@ -84,13 +84,12 @@ class Codebuild(AWSService):
            if project_info["source"]["type"] != "NO_SOURCE":
                project.source = Source(
                    type=project_info["source"]["type"],
-                    location=project_info["source"].get("location", ""),
+                    location=project_info["source"]["location"],
                )
            project.secondary_sources = []
            for secondary_source in project_info.get("secondarySources", []):
                source_obj = Source(
-                    type=secondary_source["type"],
-                    location=secondary_source.get("location", ""),
+                    type=secondary_source["type"], location=secondary_source["location"]
                )
                project.secondary_sources.append(source_obj)
            environment = project_info.get("environment", {})
@@ -108,45 +108,21 @@ class DirectoryService(AWSService):
                if directory.region == regional_client.region:
                    # Operation is not supported for Shared MicrosoftAD directories.
                    if directory.type != DirectoryType.SharedMicrosoftAD:
-                        try:
-                            describe_event_topics_parameters = {
-                                "DirectoryId": directory.id
-                            }
-                            event_topics = []
-                            describe_event_topics = (
-                                regional_client.describe_event_topics(
-                                    **describe_event_topics_parameters
+                        describe_event_topics_parameters = {"DirectoryId": directory.id}
+                        event_topics = []
+                        describe_event_topics = regional_client.describe_event_topics(
+                            **describe_event_topics_parameters
+                        )
+                        for event_topic in describe_event_topics["EventTopics"]:
+                            event_topics.append(
+                                EventTopics(
+                                    topic_arn=event_topic["TopicArn"],
+                                    topic_name=event_topic["TopicName"],
+                                    status=event_topic["Status"],
+                                    created_date_time=event_topic["CreatedDateTime"],
                                )
                            )
-                            for event_topic in describe_event_topics["EventTopics"]:
-                                event_topics.append(
-                                    EventTopics(
-                                        topic_arn=event_topic["TopicArn"],
-                                        topic_name=event_topic["TopicName"],
-                                        status=event_topic["Status"],
-                                        created_date_time=event_topic[
-                                            "CreatedDateTime"
-                                        ],
-                                    )
-                                )
-                            self.directories[directory.id].event_topics = event_topics
-                        except ClientError as error:
-                            if (
-                                "is in Deleting state"
-                                in error.response["Error"]["Message"]
-                            ):
-                                logger.warning(
-                                    f"{directory.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                                )
-                            else:
-                                logger.error(
-                                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                                )
-                        except Exception as error:
-                            logger.error(
-                                f"{regional_client.region} -- {error.__class__.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                            )
-
+                        self.directories[directory.id].event_topics = event_topics
        except Exception as error:
            logger.error(
                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -227,15 +203,6 @@ class DirectoryService(AWSService):
                                "SnapshotLimits"
                            ]["ManualSnapshotsLimitReached"],
                        )
-                    except ClientError as error:
-                        if "is in Deleting state" in error.response["Error"]["Message"]:
-                            logger.warning(
-                                f"{directory.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                            )
-                        else:
-                            logger.error(
-                                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                            )
                    except Exception as error:
                        logger.error(
                            f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -65,17 +65,6 @@ class DocumentDB(AWSService):
    def _list_tags_for_resource(self):
        logger.info("DocumentDB - List Tags...")
        try:
-            for cluster_arn, cluster in self.db_clusters.items():
-                try:
-                    regional_client = self.regional_clients[cluster.region]
-                    response = regional_client.list_tags_for_resource(
-                        ResourceName=cluster_arn
-                    )["TagList"]
-                    cluster.tags = response
-                except Exception as error:
-                    logger.error(
-                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                    )
            for instance_arn, instance in self.db_instances.items():
                try:
                    regional_client = self.regional_clients[instance.region]
@@ -9,7 +9,7 @@
  "SubServiceName": "snapshot",
  "ResourceIdTemplate": "arn:partition:service:region:account-id",
  "Severity": "high",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "Other",
  "Description": "EBS snapshots can be shared with other AWS accounts or made public. By default, EBS snapshots are private and only the AWS account that created the snapshot can access it. If an EBS snapshot is shared with another AWS account or made public, the data in the snapshot can be accessed by the other account or by anyone on the internet. Ensure that public access to EBS snapshots is disabled.",
  "Risk": "If public access to EBS snapshots is enabled, the data in the snapshot can be accessed by anyone on the internet.",
  "RelatedUrl": "https://docs.aws.amazon.com/ebs/latest/userguide/block-public-access-snapshots-work.html#block-public-access-snapshots-enable",
@@ -9,7 +9,7 @@
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service:region:account-id",
  "Severity": "high",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "AwsEc2Instance",
  "Description": "Ensure Instance Metadata Service Version 2 (IMDSv2) is enforced for EC2 instances at the account level to protect against SSRF vulnerabilities.",
  "Risk": "EC2 instances that use IMDSv1 are vulnerable to SSRF attacks.",
  "RelatedUrl": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#set-imdsv2-account-defaults",
@@ -9,7 +9,7 @@
  "SubServiceName": "instance",
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "critical",
-  "ResourceType": "AwsEc2Instance",
+  "ResourceType": "AwsEc2SecurityGroup",
  "Description": "Ensure no EC2 instances allow ingress from the internet to TCP port 11211 (Memcached).",
  "Risk": "Memcached is an open-source, high-performance, distributed memory object caching system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source must be read. Memcached is designed to be used in trusted environments and should not be exposed to the internet. If Memcached is exposed to the internet, it can be exploited by attackers to perform distributed denial-of-service (DDoS) attacks, data exfiltration, and other malicious activities.",
  "RelatedUrl": "",
@@ -19,10 +19,7 @@ class ec2_instance_uses_single_eni(Check):
                )
            else:
                for eni_id in instance.network_interfaces:
-                    if (
-                        eni_id in ec2_client.network_interfaces
-                        and ec2_client.network_interfaces[eni_id].type in eni_types
-                    ):
+                    if ec2_client.network_interfaces[eni_id].type in eni_types:
                        eni_types[ec2_client.network_interfaces[eni_id].type].append(
                            eni_id
                        )
@@ -51,15 +51,7 @@ class ec2_launch_template_no_secrets(Check):
                )

                if version_secrets:
-                    secrets_string = ", ".join(
-                        [
-                            f"{secret['type']} on line {secret['line_number']}"
-                            for secret in version_secrets
-                        ]
-                    )
-                    versions_with_secrets.append(
-                        f"Version {version.version_number}: {secrets_string}"
-                    )
+                    versions_with_secrets.append(str(version.version_number))

            if len(versions_with_secrets) > 0:
                report.status = "FAIL"
@@ -10,7 +10,7 @@
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "high",
  "ResourceType": "AwsEc2SecurityGroup",
-  "Description": "Ensure no security groups allow ingress and egress from wide-open IP address with a mask between 0 and 24.",
+  "Description": "Ensure no security groups allow ingress and egress from ide-open IP address with a mask between 0 and 24.",
  "Risk": "If Security groups are not properly configured the attack surface is increased.",
  "RelatedUrl": "",
  "Remediation": {
@@ -12,7 +12,7 @@
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "critical",
  "ResourceType": "AwsEcsTaskDefinition",
-  "Description": "Check if secrets exists in ECS task definitions environment variables.",
+  "Description": "Check if secrets exists in ECS task definitions environment variables. If a secret is detected, the line number shown in the finding matches with the environment variable \"Name\" attribute starting to count at the \"environment\" key from the ECS Task Definition in JSON format.",
  "Risk": "The use of a hard-coded password increases the possibility of password guessing. If hard-coded passwords are used, it is possible that malicious users gain access through the account in question.",
  "RelatedUrl": "",
  "Remediation": {
@@ -1,4 +1,3 @@
-import hashlib
 from json import dumps

 from prowler.lib.check.models import Check, Check_Report_AWS
@@ -26,16 +25,8 @@ class ecs_task_definitions_no_environment_secrets(Check):

                if container.environment:
                    dump_env_vars = {}
-                    original_env_vars = {}
                    for env_var in container.environment:
                        dump_env_vars.update({env_var.name: env_var.value})
-                        original_env_vars.update(
-                            {
-                                hashlib.sha1(  # nosec B324 SHA1 is used here for non-security-critical unique identifiers
-                                    env_var.value.encode("utf-8")
-                                ).hexdigest(): env_var.name
-                            }
-                        )

                    env_data = dumps(dump_env_vars, indent=2)
                    detect_secrets_output = detect_secrets_scan(
@@ -44,7 +35,7 @@ class ecs_task_definitions_no_environment_secrets(Check):
                    if detect_secrets_output:
                        secrets_string = ", ".join(
                            [
-                                f"{secret['type']} on the environment variable {original_env_vars[secret['hashed_secret']]}"
+                                f"{secret['type']} on line {secret['line_number']}"
                                for secret in detect_secrets_output
                            ]
                        )
@@ -15,7 +15,7 @@ class elasticache_redis_cluster_backup_enabled(Check):
            report.resource_tags = repl_group.tags
            report.status = "FAIL"
            report.status_extended = f"Elasticache Redis cache cluster {repl_group.id} does not have automated snapshot backups enabled."
-            if repl_group.snapshot_retention >= elasticache_client.audit_config.get(
+            if repl_group.snapshot_retention > elasticache_client.audit_config.get(
                "minimum_snapshot_retention_period", 7
            ):
                report.status = "PASS"
@@ -147,12 +147,6 @@ class ElastiCache(AWSService):
                    logger.warning(
                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                    )
-                except (
-                    regional_client.exceptions.InvalidReplicationGroupStateFault
-                ) as error:
-                    logger.warning(
-                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                    )
                except Exception as error:
                    logger.error(
                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -169,12 +163,6 @@ class ElastiCache(AWSService):
                    logger.warning(
                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                    )
-                except (
-                    regional_client.exceptions.InvalidReplicationGroupStateFault
-                ) as error:
-                    logger.warning(
-                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                    )
                except Exception as error:
                    logger.error(
                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -19,7 +19,7 @@
      "Terraform": ""
    },
    "Recommendation": {
-      "Text": "To mitigate cross-service confused deputy attacks, it's recommended to use the aws:SourceArn and aws:SourceAccount global condition context keys in your IAM role trust policies. If the role doesn't support these fields, consider implementing alternative security measures, such as defining more restrictive resource-based policies or using service-specific trust policies, to limit the role's permissions and exposure. For detailed guidance, refer to AWS's documentation on preventing cross-service confused deputy issues.",
+      "Text": "Use the aws:SourceArn and aws:SourceAccount global condition context keys in trust relationship policies to limit the permissions that a service has to a specific resource",
      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html#cross-service-confused-deputy-prevention"
    }
  },
@@ -49,7 +49,7 @@ class iam_rotate_access_key_90_days(Check):
                        old_access_keys = True
                        report = Check_Report_AWS(self.metadata())
                        report.region = iam_client.region
-                        report.resource_id = f"{user['user']}-access-key-1"
+                        report.resource_id = user["user"]
                        report.resource_arn = user["arn"]
                        report.resource_tags = user_tags
                        report.status = "FAIL"
@@ -66,7 +66,7 @@ class iam_rotate_access_key_90_days(Check):
                        old_access_keys = True
                        report = Check_Report_AWS(self.metadata())
                        report.region = iam_client.region
-                        report.resource_id = f"{user['user']}-access-key-2"
+                        report.resource_id = user["user"]
                        report.resource_arn = user["arn"]
                        report.resource_tags = user_tags
                        report.status = "FAIL"
@@ -112,8 +112,7 @@ class IAM(AWSService):
            [policy for policy in self.policies if policy.type == "Custom"],
        )
        self.__threading_call__(self._list_tags, self.server_certificates)
-        if self.saml_providers is not None:
-            self.__threading_call__(self._list_tags, self.saml_providers.values())
+        self.__threading_call__(self._list_tags, self.saml_providers.values())

    def _get_client(self):
        return self.client
@@ -395,38 +394,21 @@ class IAM(AWSService):
        logger.info("IAM - List MFA Devices...")
        try:
            for user in self.users:
-                try:
-                    list_mfa_devices_paginator = self.client.get_paginator(
-                        "list_mfa_devices"
-                    )
-                    mfa_devices = []
-                    for page in list_mfa_devices_paginator.paginate(UserName=user.name):
-                        for mfa_device in page["MFADevices"]:
-                            mfa_serial_number = mfa_device["SerialNumber"]
-                            try:
-                                mfa_type = mfa_serial_number.split(":")[5].split("/")[0]
-                            except IndexError:
-                                mfa_type = "hardware"
-                            mfa_devices.append(
-                                MFADevice(
-                                    serial_number=mfa_serial_number, type=mfa_type
-                                )
-                            )
-                    user.mfa_devices = mfa_devices
-                except ClientError as error:
-                    if error.response["Error"]["Code"] == "NoSuchEntity":
-                        logger.warning(
-                            f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                list_mfa_devices_paginator = self.client.get_paginator(
+                    "list_mfa_devices"
+                )
+                mfa_devices = []
+                for page in list_mfa_devices_paginator.paginate(UserName=user.name):
+                    for mfa_device in page["MFADevices"]:
+                        mfa_serial_number = mfa_device["SerialNumber"]
+                        try:
+                            mfa_type = mfa_serial_number.split(":")[5].split("/")[0]
+                        except IndexError:
+                            mfa_type = "hardware"
+                        mfa_devices.append(
+                            MFADevice(serial_number=mfa_serial_number, type=mfa_type)
                        )
-                    else:
-                        logger.error(
-                            f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                        )
-
-                except Exception as error:
-                    logger.error(
-                        f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                    )
+                user.mfa_devices = mfa_devices
        except Exception as error:
            logger.error(
                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -8,9 +8,7 @@ class kms_key_not_publicly_accessible(Check):
        findings = []
        for key in kms_client.keys:
            if (
-                key.manager == "CUSTOMER"
-                and key.state == "Enabled"
-                and key.policy is not None
+                key.manager == "CUSTOMER" and key.state == "Enabled"
            ):  # only customer KMS have policies
                report = Check_Report_AWS(self.metadata())
                report.status = "PASS"
@@ -27,20 +27,15 @@ class KMS(AWSService):
            list_keys_paginator = regional_client.get_paginator("list_keys")
            for page in list_keys_paginator.paginate():
                for key in page["Keys"]:
-                    try:
-                        if not self.audit_resources or (
-                            is_resource_filtered(key["KeyArn"], self.audit_resources)
-                        ):
-                            self.keys.append(
-                                Key(
-                                    id=key["KeyId"],
-                                    arn=key["KeyArn"],
-                                    region=regional_client.region,
-                                )
+                    if not self.audit_resources or (
+                        is_resource_filtered(key["KeyArn"], self.audit_resources)
+                    ):
+                        self.keys.append(
+                            Key(
+                                id=key["KeyId"],
+                                arn=key["KeyArn"],
+                                region=regional_client.region,
                            )
-                    except Exception as error:
-                        logger.error(
-                            f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
                        )
        except Exception as error:
            logger.error(
@@ -52,16 +47,11 @@ class KMS(AWSService):
        try:
            for key in self.keys:
                regional_client = self.regional_clients[key.region]
-                try:
-                    response = regional_client.describe_key(KeyId=key.id)
-                    key.state = response["KeyMetadata"]["KeyState"]
-                    key.origin = response["KeyMetadata"]["Origin"]
-                    key.manager = response["KeyMetadata"]["KeyManager"]
-                    key.spec = response["KeyMetadata"]["CustomerMasterKeySpec"]
-                except Exception as error:
-                    logger.error(
-                        f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
-                    )
+                response = regional_client.describe_key(KeyId=key.id)
+                key.state = response["KeyMetadata"]["KeyState"]
+                key.origin = response["KeyMetadata"]["Origin"]
+                key.manager = response["KeyMetadata"]["KeyManager"]
+                key.spec = response["KeyMetadata"]["CustomerMasterKeySpec"]
        except Exception as error:
            logger.error(
                f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
@@ -78,14 +68,9 @@ class KMS(AWSService):
                    and "AWS" not in key.manager
                ):
                    regional_client = self.regional_clients[key.region]
-                    try:
-                        key.rotation_enabled = regional_client.get_key_rotation_status(
-                            KeyId=key.id
-                        )["KeyRotationEnabled"]
-                    except Exception as error:
-                        logger.error(
-                            f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
-                        )
+                    key.rotation_enabled = regional_client.get_key_rotation_status(
+                        KeyId=key.id
+                    )["KeyRotationEnabled"]
        except Exception as error:
            logger.error(
                f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
@@ -99,16 +84,11 @@ class KMS(AWSService):
                    key.manager and key.manager == "CUSTOMER"
                ):  # only customer KMS have policies
                    regional_client = self.regional_clients[key.region]
-                    try:
-                        key.policy = json.loads(
-                            regional_client.get_key_policy(
-                                KeyId=key.id, PolicyName="default"
-                            )["Policy"]
-                        )
-                    except Exception as error:
-                        logger.error(
-                            f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
-                        )
+                    key.policy = json.loads(
+                        regional_client.get_key_policy(
+                            KeyId=key.id, PolicyName="default"
+                        )["Policy"]
+                    )
        except Exception as error:
            logger.error(
                f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
@@ -116,25 +96,20 @@ class KMS(AWSService):

    def _list_resource_tags(self):
        logger.info("KMS - List Tags...")
-        try:
-            for key in self.keys:
-                if (
-                    key.manager and key.manager == "CUSTOMER"
-                ):  # only check customer KMS keys
-                    try:
-                        regional_client = self.regional_clients[key.region]
-                        response = regional_client.list_resource_tags(
-                            KeyId=key.id,
-                        )["Tags"]
-                        key.tags = response
-                    except Exception as error:
-                        logger.error(
-                            f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                        )
-        except Exception as error:
-            logger.error(
-                f"{regional_client.region} -- {error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
-            )
+        for key in self.keys:
+            if (
+                key.manager and key.manager == "CUSTOMER"
+            ):  # only check customer KMS keys
+                try:
+                    regional_client = self.regional_clients[key.region]
+                    response = regional_client.list_resource_tags(
+                        KeyId=key.id,
+                    )["Tags"]
+                    key.tags = response
+                except Exception as error:
+                    logger.error(
+                        f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )


 class Key(BaseModel):
@@ -10,9 +10,13 @@ from prowler.providers.aws.lib.service.service import AWSService

 class OpenSearchService(AWSService):
    def __init__(self, provider):
+        # Call AWSService's __init__
        super().__init__("opensearch", provider)
        self.opensearch_domains = {}
        self.__threading_call__(self._list_domain_names)
+        self.__threading_call__(
+            self._describe_domain_config, self.opensearch_domains.values()
+        )
        self.__threading_call__(self._describe_domain, self.opensearch_domains.values())
        self.__threading_call__(self._list_tags, self.opensearch_domains.values())

@@ -35,6 +39,43 @@ class OpenSearchService(AWSService):
                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
            )

+    def _describe_domain_config(self, domain):
+        logger.info("OpenSearch - describing domain configurations...")
+        try:
+            regional_client = self.regional_clients[domain.region]
+            describe_domain = regional_client.describe_domain_config(
+                DomainName=domain.name
+            )
+            for logging_key in [
+                "SEARCH_SLOW_LOGS",
+                "INDEX_SLOW_LOGS",
+                "AUDIT_LOGS",
+            ]:
+                if logging_key in describe_domain["DomainConfig"].get(
+                    "LogPublishingOptions", {}
+                ).get("Options", {}):
+                    domain.logging.append(
+                        PublishingLoggingOption(
+                            name=logging_key,
+                            enabled=describe_domain["DomainConfig"][
+                                "LogPublishingOptions"
+                            ]["Options"][logging_key]["Enabled"],
+                        )
+                    )
+            try:
+                domain.access_policy = loads(
+                    describe_domain["DomainConfig"]["AccessPolicies"]["Options"]
+                )
+            except JSONDecodeError as error:
+                logger.warning(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
    def _describe_domain(self, domain):
        logger.info("OpenSearch - describing domain configurations...")
        try:
@@ -89,32 +130,6 @@ class OpenSearchService(AWSService):
            domain.dedicated_master_count = cluster_config.get(
                "DedicatedMasterCount", 0
            )
-            for logging_key in [
-                "SEARCH_SLOW_LOGS",
-                "INDEX_SLOW_LOGS",
-                "AUDIT_LOGS",
-            ]:
-                if logging_key in describe_domain["DomainStatus"].get(
-                    "LogPublishingOptions", {}
-                ):
-                    domain.logging.append(
-                        PublishingLoggingOption(
-                            name=logging_key,
-                            enabled=describe_domain["DomainStatus"][
-                                "LogPublishingOptions"
-                            ][logging_key]["Enabled"],
-                        )
-                    )
-            try:
-                if describe_domain["DomainStatus"].get("AccessPolicies"):
-                    domain.access_policy = loads(
-                        describe_domain["DomainStatus"]["AccessPolicies"]
-                    )
-            except JSONDecodeError as error:
-                logger.warning(
-                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                )
-
        except Exception as error:
            logger.error(
                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -1,25 +1,25 @@
 {
  "Provider": "aws",
  "CheckID": "organizations_opt_out_ai_services_policy",
-  "CheckTitle": "Ensure that AWS Organizations opt-out of AI services policy is enabled and disallow child-accounts to overwrite this policy.",
+  "CheckTitle": "Ensure that AWS Organizations opt-out of AI services policy is enabled.",
  "CheckType": [],
  "ServiceName": "organizations",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service::account-id:organization/organization-id",
  "Severity": "low",
  "ResourceType": "Other",
-  "Description": "This control checks whether the AWS Organizations opt-out of AI services policy is enabled and whether child-accounts are disallowed to overwrite this policy. The control fails if the policy is not enabled or if child-accounts are not disallowed to overwrite this policy.",
+  "Description": "This control checks whether the AWS Organizations opt-out of AI services policy is enabled. The control fails if the policy is not enabled.",
  "Risk": "By default, AWS may be using your data to train its AI models. This may include data from your AWS CloudTrail logs, AWS Config rules, and AWS GuardDuty findings. If you opt out of AI services, AWS will not use your data to train its AI models.",
  "RelatedUrl": "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out_all.html",
  "Remediation": {
    "Code": {
-      "CLI": "",
+      "CLI": "aws organizations enable-policy-type --root-id <root-id> --policy-type AI_SERVICES_OPT_OUT {'services': {'default': {'opt_out_policy': {'@@assign': 'optOut'}}}}",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
-      "Text": "Artificial Intelligence (AI) services opt-out policies enable you to control whether AWS AI services can store and use your content. Enable the AWS Organizations opt-out of AI services policy and disallow child-accounts to overwrite this policy.",
+      "Text": "Artificial Intelligence (AI) services opt-out policies enable you to control whether AWS AI services can store and use your content. Enable the AWS Organizations opt-out of AI services policy.",
      "Url": "https://docs.aws.amazon.com/organizations/latest/userguide/disable-policy-type.html"
    }
  },
@@ -20,42 +20,21 @@ class organizations_opt_out_ai_services_policy(Check):
                report.status_extended = (
                    "AWS Organizations is not in-use for this AWS Account."
                )
-
                if organizations_client.organization.status == "ACTIVE":
-                    all_conditions_passed = False
-                    opt_out_policies = organizations_client.organization.policies.get(
+                    report.status_extended = f"AWS Organization {organizations_client.organization.id} has not opted out of all AI services, granting consent for AWS to access its data."
+                    for policy in organizations_client.organization.policies.get(
                        "AISERVICES_OPT_OUT_POLICY", []
-                    )
-
-                    if not opt_out_policies:
-                        report.status_extended = f"AWS Organization {organizations_client.organization.id} has no opt-out policy for AI services."
-                    else:
-                        for policy in opt_out_policies:
-                            opt_out_policy = (
-                                policy.content.get("services", {})
-                                .get("default", {})
-                                .get("opt_out_policy", {})
-                            )
-
-                            condition_1 = opt_out_policy.get("@@assign") == "optOut"
-                            condition_2 = opt_out_policy.get(
-                                "@@operators_allowed_for_child_policies"
-                            ) == ["@@none"]
-
-                            if condition_1 and condition_2:
-                                all_conditions_passed = True
-                                break
-
-                            if not condition_1 and not condition_2:
-                                report.status_extended = f"AWS Organization {organizations_client.organization.id} has not opted out of all AI services and it does not disallow child-accounts to overwrite the policy."
-                            elif not condition_1:
-                                report.status_extended = f"AWS Organization {organizations_client.organization.id} has not opted out of all AI services."
-                            elif not condition_2:
-                                report.status_extended = f"AWS Organization {organizations_client.organization.id} has opted out of all AI services but it does not disallow child-accounts to overwrite the policy."
-
-                        if all_conditions_passed:
+                    ):
+                        if (
+                            policy.content.get("services", {})
+                            .get("default", {})
+                            .get("opt_out_policy", {})
+                            .get("@@assign")
+                            == "optOut"
+                        ):
                            report.status = "PASS"
-                            report.status_extended = f"AWS Organization {organizations_client.organization.id} has opted out of all AI services and also disallows child-accounts to overwrite this policy."
+                            report.status_extended = f"AWS Organization {organizations_client.organization.id} has opted out of all AI services, not granting consent for AWS to access its data."
+                            break

                findings.append(report)

@@ -7,9 +7,9 @@
  ],
  "ServiceName": "rds",
  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:account",
+  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster",
  "Severity": "low",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "AwsRdsDbCluster",
  "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database cluster events, particularly maintenance and failure.",
  "Risk": "Without event subscriptions for critical events, such as maintenance and failures, you may not be aware of issues affecting your RDS clusters, leading to downtime or security vulnerabilities.",
  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html",
@@ -6,8 +6,8 @@ class rds_cluster_non_default_port(Check):
    def execute(self):
        findings = []
        default_ports = {
-            3306: ["mysql", "mariadb", "aurora-mysql"],
-            5432: ["postgres", "aurora-postgresql"],
+            3306: ["mysql", "mariadb"],
+            5432: ["postgres"],
            1521: ["oracle"],
            1433: ["sqlserver"],
            50000: ["db2"],
@@ -5,9 +5,9 @@
  "CheckType": [],
  "ServiceName": "rds",
  "SubServiceName": "",
-  "ResourceIdTemplate": "arn:aws:rds:region:account-id:account",
+  "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance",
  "Severity": "low",
-  "ResourceType": "AwsAccount",
+  "ResourceType": "AwsRdsEventSubscription",
  "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database parameter groups events.",
  "Risk": "Amazon RDS event subscriptions for database parameter groups are designed to provide incident notification of events that may affect the security, availability, and reliability of the RDS database instances associated with these parameter groups.",
  "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html",
@@ -37,21 +37,18 @@ class rds_instance_no_public_access(Check):
                                    ):
                                        report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) has {db_instance.engine} port {db_instance_port} open to the Internet at endpoint {db_instance.endpoint.get('Address')} but is not in a public subnet."
                                        public_sg = True
-                                        if db_instance.subnet_ids:
-                                            for subnet_id in db_instance.subnet_ids:
-                                                if (
-                                                    subnet_id in vpc_client.vpc_subnets
-                                                    and vpc_client.vpc_subnets[
-                                                        subnet_id
-                                                    ].public
-                                                ):
-                                                    report.status = "FAIL"
-                                                    report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) has {db_instance.engine} port {db_instance_port} open to the Internet at endpoint {db_instance.endpoint.get('Address')} in a public subnet {subnet_id}."
-                                                    break
-                                    if public_sg:
                                        break
                            if public_sg:
                                break
+                        if db_instance.subnet_ids:
+                            for subnet_id in db_instance.subnet_ids:
+                                if (
+                                    subnet_id in vpc_client.vpc_subnets
+                                    and vpc_client.vpc_subnets[subnet_id].public
+                                ):
+                                    report.status = "FAIL"
+                                    report.status_extended = f"RDS Instance {db_instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) has {db_instance.engine} port {db_instance_port} open to the Internet at endpoint {db_instance.endpoint.get('Address')} in a public subnet {subnet_id}."
+                                    break

            findings.append(report)

@@ -6,8 +6,8 @@ class rds_instance_non_default_port(Check):
    def execute(self):
        findings = []
        default_ports = {
-            3306: ["mysql", "mariadb", "aurora-mysql"],
-            5432: ["postgres", "aurora-postgresql"],
+            3306: ["mysql", "mariadb"],
+            5432: ["postgres"],
            1521: ["oracle"],
            1433: ["sqlserver"],
            50000: ["db2"],
@@ -122,19 +122,14 @@ class RDS(AWSService):
            for instance in self.db_instances.values():
                if instance.region == regional_client.region:
                    for parameter_group in instance.parameter_groups:
-                        try:
-                            describe_db_parameters_paginator = (
-                                regional_client.get_paginator("describe_db_parameters")
-                            )
-                            for page in describe_db_parameters_paginator.paginate(
-                                DBParameterGroupName=parameter_group
-                            ):
-                                for parameter in page["Parameters"]:
-                                    instance.parameters.append(parameter)
-                        except Exception as error:
-                            logger.error(
-                                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                            )
+                        describe_db_parameters_paginator = (
+                            regional_client.get_paginator("describe_db_parameters")
+                        )
+                        for page in describe_db_parameters_paginator.paginate(
+                            DBParameterGroupName=parameter_group
+                        ):
+                            for parameter in page["Parameters"]:
+                                instance.parameters.append(parameter)

        except Exception as error:
            logger.error(
@@ -29,9 +29,7 @@ class route53_dangling_ip_subdomain_takeover(Check):
                    # Check if record is an IP Address
                    if validate_ip_address(record):
                        report = Check_Report_AWS(self.metadata())
-                        report.resource_id = (
-                            f"{record_set.hosted_zone_id}/{record_set.name}/{record}"
-                        )
+                        report.resource_id = f"{record_set.hosted_zone_id}/{record}"
                        report.resource_arn = route53_client.hosted_zones[
                            record_set.hosted_zone_id
                        ].arn
@@ -87,14 +87,13 @@ class Route53(AWSService):
                )
                for page in list_query_logging_configs_paginator.paginate():
                    for logging_config in page["QueryLoggingConfigs"]:
-                        if logging_config["HostedZoneId"] == hosted_zone.id:
-                            self.hosted_zones[hosted_zone.id].logging_config = (
-                                LoggingConfig(
-                                    cloudwatch_log_group_arn=logging_config[
-                                        "CloudWatchLogsLogGroupArn"
-                                    ]
-                                )
+                        self.hosted_zones[hosted_zone.id].logging_config = (
+                            LoggingConfig(
+                                cloudwatch_log_group_arn=logging_config[
+                                    "CloudWatchLogsLogGroupArn"
+                                ]
                            )
+                        )

        except Exception as error:
            logger.error(
@@ -494,7 +494,6 @@ class S3(AWSService):
                )
                return False
            else:
-                # Bucket exists but we don't have access to it
                logger.error(
                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                )
@@ -10,17 +10,16 @@ class vpc_endpoint_services_allowed_principals_trust_boundaries(Check):
        # Get trusted account_ids from prowler.config.yaml
        trusted_account_ids = vpc_client.audit_config.get("trusted_account_ids", [])
        for service in vpc_client.vpc_endpoint_services:
-            report = Check_Report_AWS(self.metadata())
-            report.region = service.region
-            report.resource_id = service.id
-            report.resource_arn = service.arn
-            report.resource_tags = service.tags
-
            if not service.allowed_principals:
+                report = Check_Report_AWS(self.metadata())
+                report.region = service.region
                report.status = "PASS"
                report.status_extended = (
                    f"VPC Endpoint Service {service.id} has no allowed principals."
                )
+                report.resource_id = service.id
+                report.resource_arn = service.arn
+                report.resource_tags = service.tags
                findings.append(report)
            else:
                for principal in service.allowed_principals:
@@ -28,24 +27,27 @@ class vpc_endpoint_services_allowed_principals_trust_boundaries(Check):
                    pattern = compile(r"^[0-9]{12}$")
                    match = pattern.match(principal)
                    if not match:
-                        account_id = (
-                            principal.split(":")[4] if principal != "*" else "*"
-                        )
+                        account_id = principal.split(":")[4]
                    else:
                        account_id = match.string

+                    report = Check_Report_AWS(self.metadata())
+                    report.region = service.region
                    if (
                        account_id in trusted_account_ids
                        or account_id in vpc_client.audited_account
                    ):
                        report.status = "PASS"
                        report.status_extended = f"Found trusted account {account_id} in VPC Endpoint Service {service.id}."
+                        report.resource_id = service.id
+                        report.resource_arn = service.arn
+                        report.resource_tags = service.tags
                    else:
                        report.status = "FAIL"
-                        if account_id == "*":
-                            report.status_extended = f"Wildcard principal found in VPC Endpoint Service {service.id}."
-                        else:
-                            report.status_extended = f"Found untrusted account {account_id} in VPC Endpoint Service {service.id}."
+                        report.status_extended = f"Found untrusted account {account_id} in VPC Endpoint Service {service.id}."
+                        report.resource_id = service.id
+                        report.resource_arn = service.arn
+                        report.resource_tags = service.tags
                    findings.append(report)

        return findings
@@ -19,11 +19,12 @@ class app_minimum_tls_version_12(Check):
                report.location = app.location
                report.status_extended = f"Minimum TLS version is not set to 1.2 for app '{app_name}' in subscription '{subscription_name}'."

-                if app.configurations and getattr(
-                    app.configurations, "min_tls_version", ""
-                ) in ["1.2", "1.3"]:
+                if (
+                    app.configurations
+                    and getattr(app.configurations, "min_tls_version", "") == "1.2"
+                ):
                    report.status = "PASS"
-                    report.status_extended = f"Minimum TLS version is set to {app.configurations.min_tls_version} for app '{app_name}' in subscription '{subscription_name}'."
+                    report.status_extended = f"Minimum TLS version is set to 1.2 for app '{app_name}' in subscription '{subscription_name}'."

                findings.append(report)

@@ -15,7 +15,7 @@ class entra_security_defaults_enabled(Check):
            report.subscription = f"Tenant: {tenant}"
            report.resource_name = getattr(security_default, "name", "Security Default")
            report.resource_id = getattr(security_default, "id", "Security Default")
-            report.status_extended = "Entra security defaults is disabled."
+            report.status_extended = "Entra security defaults is diabled."

            if getattr(security_default, "is_enabled", False):
                report.status = "PASS"
@@ -12,8 +12,6 @@ class sqlserver_tde_encryption_enabled(Check):
                )
                if len(databases) > 0:
                    for database in databases:
-                        if database.name.lower() == "master":
-                            continue
                        report = Check_Report_Azure(self.metadata())
                        report.subscription = subscription
                        report.resource_name = database.name
@@ -1,7 +1,7 @@
 {
  "Provider": "azure",
  "CheckID": "sqlserver_unrestricted_inbound_access",
-  "CheckTitle": "Ensure no Azure SQL Databases allow ingress from 0.0.0.0/0 (ANY IP)",
+  "CheckTitle": "Ensure that there are no firewall rules allowing traffic from 0.0.0.0-255.255.255.255",
  "CheckType": [],
  "ServiceName": "sqlserver",
  "SubServiceName": "",
@@ -15,13 +15,9 @@ class cloudsql_instance_ssl_connections(Check):
            report.status_extended = (
                f"Database Instance {instance.name} requires SSL connections."
            )
-
-            if (instance.ssl_mode == "ALLOW_UNENCRYPTED_AND_ENCRYPTED") or (
-                instance.ssl_mode == "SSL_MODE_UNSPECIFIED" and not instance.require_ssl
-            ):
+            if not instance.require_ssl or instance.ssl_mode != "ENCRYPTED_ONLY":
                report.status = "FAIL"
                report.status_extended = f"Database Instance {instance.name} does not require SSL connections."
-
            findings.append(report)

        return findings
@@ -1,5 +1,5 @@
 {
-  "Provider": "gcp",
+  "Provider": "compute",
  "CheckID": "compute_public_address_shodan",
  "CheckTitle": "Check if any of the Public Addresses are in Shodan (requires Shodan API KEY).",
  "CheckType": [
@@ -25,13 +25,11 @@ class DNS(GCPService):
                            ManagedZone(
                                name=managed_zone["name"],
                                id=managed_zone["id"],
-                                dnssec=managed_zone.get("dnssecConfig", {}).get(
-                                    "state", ""
-                                )
+                                dnssec=managed_zone.get("dnssecConfig", {})["state"]
                                == "on",
-                                key_specs=managed_zone.get("dnssecConfig", {}).get(
-                                    "defaultKeySpecs", []
-                                ),
+                                key_specs=managed_zone.get("dnssecConfig", {})[
+                                    "defaultKeySpecs"
+                                ],
                                project_id=project_id,
                            )
                        )
@@ -28,17 +28,17 @@ version = "4.6.3"
 [tool.poetry.dependencies]
 alive-progress = "3.2.0"
 awsipranges = "0.3.3"
-azure-identity = "1.21.0"
+azure-identity = "1.19.0"
 azure-keyvault-keys = "4.10.0"
 azure-mgmt-applicationinsights = "4.0.0"
 azure-mgmt-authorization = "4.0.0"
-azure-mgmt-compute = "34.0.0"
+azure-mgmt-compute = "33.0.0"
 azure-mgmt-containerregistry = "10.3.0"
-azure-mgmt-containerservice = "34.1.0"
+azure-mgmt-containerservice = "33.0.0"
 azure-mgmt-cosmosdb = "9.7.0"
 azure-mgmt-keyvault = "10.3.1"
 azure-mgmt-monitor = "6.0.2"
-azure-mgmt-network = "28.1.0"
+azure-mgmt-network = "28.0.0"
 azure-mgmt-rdbms = "10.1.0"
 azure-mgmt-resource = "23.2.0"
 azure-mgmt-search = "9.1.0"
@@ -46,46 +46,46 @@ azure-mgmt-security = "7.0.0"
 azure-mgmt-sql = "3.0.1"
 azure-mgmt-storage = "21.2.1"
 azure-mgmt-subscription = "3.1.1"
-azure-mgmt-web = "8.0.0"
-azure-storage-blob = "12.24.1"
-boto3 = "1.35.99"
-botocore = "1.35.99"
+azure-mgmt-web = "7.3.1"
+azure-storage-blob = "12.24.0"
+boto3 = "1.35.77"
+botocore = "1.35.77"
 colorama = "0.4.6"
 cryptography = "43.0.1"
 dash = "2.18.2"
-dash-bootstrap-components = "1.7.1"
+dash-bootstrap-components = "1.6.0"
 detect-secrets = "1.5.0"
-google-api-python-client = "2.164.0"
+google-api-python-client = "2.154.0"
 google-auth-httplib2 = ">=0.1,<0.3"
 jsonschema = "4.23.0"
-kubernetes = "32.0.1"
-microsoft-kiota-abstractions = "1.9.2"
-msgraph-sdk = "1.18.0"
+kubernetes = "31.0.0"
+microsoft-kiota-abstractions = "1.6.6"
+msgraph-sdk = "1.14.0"
 numpy = "2.0.2"
 pandas = "2.2.3"
-py-ocsf-models = "0.3.0"
+py-ocsf-models = "0.2.0"
 pydantic = "1.10.18"
 python = ">=3.9,<3.13"
 python-dateutil = "^2.9.0.post0"
-pytz = "2025.1"
+pytz = "2024.2"
 schema = "0.7.7"
 shodan = "1.31.0"
-slack-sdk = "3.35.0"
+slack-sdk = "3.33.5"
 tabulate = "0.9.0"
-tzlocal = "5.3"
+tzlocal = "5.2"

 [tool.poetry.group.dev.dependencies]
-bandit = "1.8.3"
-black = "25.1.0"
-coverage = "7.6.12"
+bandit = "1.8.0"
+black = "24.10.0"
+coverage = "7.6.9"
 docker = "7.1.0"
-flake8 = "7.1.2"
+flake8 = "7.1.1"
 freezegun = "1.5.1"
-mock = "5.2.0"
-moto = {extras = ["all"], version = "5.0.28"}
-openapi-schema-validator = "0.6.3"
+mock = "5.1.0"
+moto = {extras = ["all"], version = "5.0.16"}
+openapi-schema-validator = "0.6.2"
 openapi-spec-validator = "0.7.1"
-pylint = "3.3.4"
+pylint = "3.3.2"
 pytest = "8.3.4"
 pytest-cov = "6.0.0"
 pytest-env = "1.1.5"
@@ -100,7 +100,7 @@ optional = true
 [tool.poetry.group.docs.dependencies]
 mkdocs = "1.6.1"
 mkdocs-git-revision-date-localized-plugin = "1.3.0"
-mkdocs-material = "9.6.7"
+mkdocs-material = "9.5.48"
 mkdocs-material-extensions = "1.3.1"

 [tool.poetry.scripts]
@@ -8,6 +8,7 @@ from requests import Response
 from prowler.config.config import (
    check_current_version,
    get_available_compliance_frameworks,
+    get_available_update,
    load_and_validate_config_file,
    load_and_validate_fixer_config_file,
 )
@@ -306,7 +307,6 @@ config_aws = {
    ],
    "eks_cluster_oldest_version_supported": "1.28",
    "excluded_sensitive_environment_variables": [],
-    "minimum_snapshot_retention_period": 7,
    "elb_min_azs": 2,
    "elbv2_min_azs": 2,
    "secrets_ignore_patterns": [],
@@ -378,6 +378,44 @@ class Test_Config:
            == f"Prowler {MOCK_PROWLER_MASTER_VERSION} (You are running the latest version, yay!)"
        )

+    @mock.patch(
+        "prowler.config.config.requests.get", new=mock_prowler_get_latest_release
+    )
+    @mock.patch("prowler.config.config.prowler_version", new=MOCK_OLD_PROWLER_VERSION)
+    def test_get_available_update_with_old_version(self):
+        assert get_available_update() == MOCK_PROWLER_VERSION
+
+    @mock.patch(
+        "prowler.config.config.requests.get", new=mock_prowler_get_latest_release
+    )
+    @mock.patch("prowler.config.config.prowler_version", new=MOCK_PROWLER_VERSION)
+    def test_get_available_update_with_latest_version(self):
+        assert get_available_update() is None
+
+    @mock.patch(
+        "prowler.config.config.requests.get", new=mock_prowler_get_latest_release
+    )
+    @mock.patch("prowler.config.config.prowler_version", new=MOCK_OLD_PROWLER_VERSION)
+    @mock.patch.dict(os.environ, {"PROWLER_NO_VERSION_CHECK": "1"})
+    def test_get_available_update_opt_out_env_var(self):
+        assert get_available_update() is None
+
+    @mock.patch(
+        "prowler.config.config.requests.get", new=mock_prowler_get_latest_release
+    )
+    @mock.patch("prowler.config.config.prowler_version", new=MOCK_OLD_PROWLER_VERSION)
+    @mock.patch.dict(os.environ, {"DO_NOT_TRACK": "1"})
+    def test_get_available_update_do_not_track(self):
+        assert get_available_update() is None
+
+    @mock.patch(
+        "prowler.config.config.requests.get",
+        new=mock.MagicMock(side_effect=Exception("network error")),
+    )
+    @mock.patch("prowler.config.config.prowler_version", new=MOCK_OLD_PROWLER_VERSION)
+    def test_get_available_update_network_failure(self):
+        assert get_available_update() is None
+
    def test_get_available_compliance_frameworks(self):
        compliance_frameworks = [
            "cisa_aws",
@@ -351,11 +351,6 @@ aws:
  # Minimum number of Availability Zones that an ELBv2 must be in
  elbv2_min_azs: 2

-  # AWS Elasticache Configuration
-  # aws.elasticache_redis_cluster_backup_enabled
-  # Minimum number of days that a Redis cluster must have backups retention period
-  minimum_snapshot_retention_period: 7
-
  # AWS Secrets Configuration
  # Patterns to ignore in the secrets checks
  secrets_ignore_patterns: []
@@ -42,10 +42,6 @@ class TestKubernetesCIS:
            output_data.Requirements_Attributes_Section
            == CIS_1_8_KUBERNETES.Requirements[0].Attributes[0].Section
        )
-        assert (
-            output_data.Requirements_Attributes_SubSection
-            == CIS_1_8_KUBERNETES.Requirements[0].Attributes[0].SubSection
-        )
        assert (
            output_data.Requirements_Attributes_Profile
            == CIS_1_8_KUBERNETES.Requirements[0].Attributes[0].Profile
@@ -109,10 +105,6 @@ class TestKubernetesCIS:
            output_data_manual.Requirements_Attributes_Section
            == CIS_1_8_KUBERNETES.Requirements[1].Attributes[0].Section
        )
-        assert (
-            output_data.Requirements_Attributes_SubSection
-            == CIS_1_8_KUBERNETES.Requirements[0].Attributes[0].SubSection
-        )
        assert (
            output_data_manual.Requirements_Attributes_Profile
            == CIS_1_8_KUBERNETES.Requirements[1].Attributes[0].Profile
@@ -181,5 +173,5 @@ class TestKubernetesCIS:

        mock_file.seek(0)
        content = mock_file.read()
-        expected_csv = f"PROVIDER;DESCRIPTION;CONTEXT;NAMESPACE;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SUBSECTION;REQUIREMENTS_ATTRIBUTES_PROFILE;REQUIREMENTS_ATTRIBUTES_ASSESSMENTSTATUS;REQUIREMENTS_ATTRIBUTES_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_RATIONALESTATEMENT;REQUIREMENTS_ATTRIBUTES_IMPACTSTATEMENT;REQUIREMENTS_ATTRIBUTES_REMEDIATIONPROCEDURE;REQUIREMENTS_ATTRIBUTES_AUDITPROCEDURE;REQUIREMENTS_ATTRIBUTES_ADDITIONALINFORMATION;REQUIREMENTS_ATTRIBUTES_REFERENCES;REQUIREMENTS_ATTRIBUTES_DEFAULTVALUE;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED\r\nkubernetes;This CIS Kubernetes Benchmark provides prescriptive guidance for establishing a secure configuration posture for Kubernetes v1.27.;test-cluster;test-namespace;{datetime.now()};1.1.3;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1. Control Plane;1.1 Control Plane Node Configuration Files;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ```  Verify that the permissions are `600` or more restrictive.;;https://kubernetes.io/docs/admin/kube-apiserver/;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;PASS;;;;test-check-id;False\r\nkubernetes;This CIS Kubernetes Benchmark provides prescriptive guidance for establishing a secure configuration posture for Kubernetes v1.27.;;;{datetime.now()};1.1.4;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1.1 Control Plane Node Configuration Files;;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ```  Verify that the permissions are `600` or more restrictive.;;https://kubernetes.io/docs/admin/kube-apiserver/;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;MANUAL;Manual check;manual_check;Manual check;manual;False\r\n"
+        expected_csv = f"PROVIDER;DESCRIPTION;CONTEXT;NAMESPACE;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_PROFILE;REQUIREMENTS_ATTRIBUTES_ASSESSMENTSTATUS;REQUIREMENTS_ATTRIBUTES_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_RATIONALESTATEMENT;REQUIREMENTS_ATTRIBUTES_IMPACTSTATEMENT;REQUIREMENTS_ATTRIBUTES_REMEDIATIONPROCEDURE;REQUIREMENTS_ATTRIBUTES_AUDITPROCEDURE;REQUIREMENTS_ATTRIBUTES_ADDITIONALINFORMATION;REQUIREMENTS_ATTRIBUTES_REFERENCES;REQUIREMENTS_ATTRIBUTES_DEFAULTVALUE;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED\r\nkubernetes;This CIS Kubernetes Benchmark provides prescriptive guidance for establishing a secure configuration posture for Kubernetes v1.27.;test-cluster;test-namespace;{datetime.now()};1.1.3;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1.1 Control Plane Node Configuration Files;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ```  Verify that the permissions are `600` or more restrictive.;;https://kubernetes.io/docs/admin/kube-apiserver/;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;PASS;;;;test-check-id;False\r\nkubernetes;This CIS Kubernetes Benchmark provides prescriptive guidance for establishing a secure configuration posture for Kubernetes v1.27.;;;{datetime.now()};1.1.4;Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive;1.1 Control Plane Node Configuration Files;Level 1 - Master Node;Automated;Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.;The controller manager pod specification file controls various parameters that set the behavior of the Controller Manager on the master node. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.;;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml ```;Run the below command (based on the file location on your system) on the Control Plane node. For example,  ``` stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml ```  Verify that the permissions are `600` or more restrictive.;;https://kubernetes.io/docs/admin/kube-apiserver/;By default, the `kube-controller-manager.yaml` file has permissions of `640`.;MANUAL;Manual check;manual_check;Manual check;manual;False\r\n"
        assert content == expected_csv
@@ -28,8 +28,7 @@ CIS_1_4_AWS = Compliance(
            Description="Ensure MFA Delete is enabled on S3 buckets",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="2. Storage",
-                    SubSection="2.1. Simple Storage Service (S3)",
+                    Section="2.1. Simple Storage Service (S3)",
                    Profile="Level 1",
                    AssessmentStatus="Automated",
                    Description="Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -48,8 +47,7 @@ CIS_1_4_AWS = Compliance(
            Description="Ensure MFA Delete is enabled on S3 buckets",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="2. Storage",
-                    SubSection="2.1. Simple Storage Service (S3)",
+                    Section="2.1. Simple Storage Service (S3)",
                    Profile="Level 1",
                    AssessmentStatus="Automated",
                    Description="Once MFA Delete is enabled on your sensitive and classified S3 bucket it requires the user to have two forms of authentication.",
@@ -77,8 +75,7 @@ CIS_2_0_AZURE = Compliance(
            Description="Ensure That Microsoft Defender for Databases Is Set To 'On'",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="2. Defender",
-                    SubSection="2.1 Microsoft Defender for Cloud",
+                    Section="2.1 Microsoft Defender for Cloud",
                    Profile="Level 2",
                    AssessmentStatus="Manual",
                    Description="Turning on Microsoft Defender for Databases enables threat detection for the instances running your database software. This provides threat intelligence, anomaly detection, and behavior analytics in the Azure Microsoft Defender for Cloud. Instead of being enabled on services like Platform as a Service (PaaS), this implementation will run within your instances as Infrastructure as a Service (IaaS) on the Operating Systems hosting your databases.",
@@ -98,8 +95,7 @@ CIS_2_0_AZURE = Compliance(
            Description="Ensure That Microsoft Defender for Databases Is Set To 'On'",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="2. Defender",
-                    SubSection="2.1 Microsoft Defender for Cloud",
+                    Section="2.1 Microsoft Defender for Cloud",
                    Profile="Level 2",
                    AssessmentStatus="Manual",
                    Description="Turning on Microsoft Defender for Databases enables threat detection for the instances running your database software. This provides threat intelligence, anomaly detection, and behavior analytics in the Azure Microsoft Defender for Cloud. Instead of being enabled on services like Platform as a Service (PaaS), this implementation will run within your instances as Infrastructure as a Service (IaaS) on the Operating Systems hosting your databases.",
@@ -128,8 +124,7 @@ CIS_2_0_GCP = Compliance(
            Description="Ensure That Microsoft Defender for Databases Is Set To 'On'",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="2. Logging",
-                    SubSection="2.1. Logging and Monitoring",
+                    Section="2. Logging and Monitoring",
                    Profile="Level 1",
                    AssessmentStatus="Automated",
                    Description="GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.",
@@ -148,7 +143,7 @@ CIS_2_0_GCP = Compliance(
            Description="Ensure That Microsoft Defender for Databases Is Set To 'On'",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="2. Logging",
+                    Section="2. Logging and Monitoring",
                    Profile="Level 1",
                    AssessmentStatus="Automated",
                    Description="GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.",
@@ -176,8 +171,7 @@ CIS_1_8_KUBERNETES = Compliance(
            Description="Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive",
            Attributes=[
                CIS_Requirement_Attribute(
-                    Section="1. Control Plane",
-                    SubSection="1.1 Control Plane Node Configuration Files",
+                    Section="1.1 Control Plane Node Configuration Files",
                    Profile="Level 1 - Master Node",
                    AssessmentStatus="Automated",
                    Description="Ensure that the controller manager pod specification file has permissions of `600` or more restrictive.",
@@ -85,5 +85,5 @@ class TestAWSISO27001:

        mock_file.seek(0)
        content = mock_file.read()
-        expected_csv = f"PROVIDER;DESCRIPTION;ACCOUNTID;REGION;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_CATEGORY;REQUIREMENTS_ATTRIBUTES_OBJETIVE_ID;REQUIREMENTS_ATTRIBUTES_OBJETIVE_NAME;REQUIREMENTS_ATTRIBUTES_CHECK_SUMMARY;STATUS;STATUSEXTENDED;RESOURCEID;CHECKID;MUTED;RESOURCENAME\r\naws;ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.;123456789012;eu-west-1;{datetime.now()};A.10.1;Setup Encryption at rest for RDS instances;A.10 Cryptography;A.10.1;Cryptographic Controls;Setup Encryption at rest for RDS instances;PASS;;;test-check-id;False;\r\naws;ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.;;;{datetime.now()};A.10.2;Setup Encryption at rest for RDS instances;A.10 Cryptography;A.10.1;Cryptographic Controls;Setup Encryption at rest for RDS instances;MANUAL;Manual check;manual_check;manual;False;Manual check\r\n"
+        expected_csv = f"PROVIDER;DESCRIPTION;ACCOUNTID;REGION;ASSESSMENTDATE;REQUIREMENTS_ATTRIBUTES_CATEGORY;REQUIREMENTS_ATTRIBUTES_OBJETIVE_ID;REQUIREMENTS_ATTRIBUTES_OBJETIVE_NAME;REQUIREMENTS_ATTRIBUTES_CHECK_SUMMARY;STATUS;STATUSEXTENDED;RESOURCEID;CHECKID;MUTED;RESOURCENAME\r\naws;ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.;123456789012;eu-west-1;{datetime.now()};A.10 Cryptography;A.10.1;Cryptographic Controls;Setup Encryption at rest for RDS instances;PASS;;;test-check-id;False;\r\naws;ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.;;;{datetime.now()};A.10 Cryptography;A.10.1;Cryptographic Controls;Setup Encryption at rest for RDS instances;MANUAL;Manual check;manual_check;manual;False;Manual check\r\n"
        assert content == expected_csv
@@ -1,5 +1,4 @@
 from datetime import datetime
-from typing import Union

 from prowler.config.config import prowler_version
 from prowler.lib.check.models import CheckMetadata, Code, Recommendation, Remediation
@@ -20,7 +19,7 @@ def generate_finding_output(
    resource_name: str = "",
    resource_tags: dict = {},
    compliance: dict = {"test-compliance": "test-compliance"},
-    timestamp: Union[int, datetime] = None,
+    timestamp: datetime = None,
    provider: str = "aws",
    partition: str = "aws",
    description: str = "check description",
--- a/Show More
+++ b/Show More