chore(changelog): update with latest changes

chore: merge master
feat(config): add compliance guardrails for the SDK config
2026-08-20 01:50:25 +00:00 · 2026-06-23 12:14:27 +02:00 · 2026-06-23 11:12:35 +02:00 · 2026-06-23 10:54:57 +02:00 · 2026-06-18 13:13:11 +02:00 · 2026-06-18 13:04:44 +02:00
121 changed files with 7501 additions and 155 deletions
@@ -52,6 +52,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `acmpca_certificate_authority_pqc_key_algorithm` check and new `acmpca` service for AWS provider to verify AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm [(#11318)](https://github.com/prowler-cloud/prowler/pull/11318)
 - `rolesanywhere_trust_anchor_pqc_pki` check and new `rolesanywhere` service for AWS provider to verify IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI [(#11319)](https://github.com/prowler-cloud/prowler/pull/11319)
 - Kubernetes core checks for container CPU limits, CPU requests, memory limits, memory requests, fixed image tags, liveness probes, and readiness probes [(#11373)](https://github.com/prowler-cloud/prowler/pull/11373)
+- Per-requirement configuration validation for compliance frameworks via `ConfigRequirements`, so a requirement is reported as FAIL when its configurable checks ran with a configuration too loose to satisfy it (applied across all compliance outputs: CSV, OCSF, and console tables) [(#11667)](https://github.com/prowler-cloud/prowler/pull/11667)

 ### 🔄 Changed

@@ -109,6 +109,14 @@
      ],
      "Checks": [
        "ram_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "ram_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -841,6 +849,14 @@
      ],
      "Checks": [
        "sls_logstore_retention_period"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sls_logstore_retention_period",
+          "ConfigKey": "min_log_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
      ]
    },
    {
@@ -1353,6 +1369,14 @@
      ],
      "Checks": [
        "rds_instance_sql_audit_retention"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "rds_instance_sql_audit_retention",
+          "ConfigKey": "min_rds_audit_retention_days",
+          "Operator": "gte",
+          "Value": 180
+        }
      ]
    },
    {
@@ -47,6 +47,14 @@
      "Checks": [
        "ram_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "ram_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
+      ],
      "Attributes": [
        {
          "Title": "Inactive users disabled for console access",
@@ -695,6 +703,14 @@
      "Checks": [
        "rds_instance_sql_audit_retention"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "rds_instance_sql_audit_retention",
+          "ConfigKey": "min_rds_audit_retention_days",
+          "Operator": "gte",
+          "Value": 180
+        }
+      ],
      "Attributes": [
        {
          "Title": "RDS SQL audit retention configured",
@@ -13,6 +13,14 @@
        "config_recorder_all_regions_enabled",
        "inspector2_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Patch applications",
@@ -260,6 +268,14 @@
        "config_recorder_all_regions_enabled",
        "inspector2_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "2 Patch operating systems",
@@ -742,6 +758,14 @@
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Restrict administrative privileges",
@@ -37,6 +37,26 @@
        "guardduty_is_enabled",
        "accessanalyzer_enabled",
        "macie_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -259,6 +279,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -514,6 +548,14 @@
      "Checks": [
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -530,6 +572,20 @@
        "securityhub_enabled",
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -666,6 +722,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -680,6 +744,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -694,6 +766,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -708,6 +788,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -722,6 +810,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -736,6 +832,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -762,6 +866,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -777,6 +889,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_centrally_managed"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -792,6 +912,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -807,6 +935,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -822,6 +958,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -837,6 +981,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -852,6 +1004,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -867,6 +1027,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -882,6 +1050,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -897,6 +1073,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -912,6 +1096,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -404,6 +404,14 @@
      "Checks": [
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -860,6 +868,20 @@
        "guardduty_lambda_protection_enabled",
        "guardduty_rds_protection_enabled",
        "guardduty_ec2_malware_protection_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_delegated_admin_enabled_all_regions",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -894,6 +916,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -964,6 +994,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled",
        "config_recorder_using_aws_service_role"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1157,4 +1195,4 @@
      "Checks": []
    }
  ]
-}
+}
@@ -12,6 +12,14 @@
      "Checks": [
        "acm_certificates_expiration_check"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_expiration_check",
+          "ConfigKey": "days_to_expire_threshold",
+          "Operator": "gte",
+          "Value": 30
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "ACM.1",
@@ -29,6 +37,17 @@
      "Checks": [
        "acm_certificates_with_secure_key_algorithms"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "ACM.2",
@@ -777,6 +796,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "Config.1",
@@ -892,6 +919,14 @@
      "Checks": [
        "documentdb_cluster_backup_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "documentdb_cluster_backup_enabled",
+          "ConfigKey": "minimum_backup_retention_period",
+          "Operator": "gte",
+          "Value": 7
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "DocumentDB.2",
@@ -2370,6 +2405,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "GuardDuty.1",
@@ -2547,6 +2590,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "IAM.8",
@@ -2635,6 +2692,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "IAM.22",
@@ -2951,6 +3022,14 @@
      "Checks": [
        "neptune_cluster_backup_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "neptune_cluster_backup_enabled",
+          "ConfigKey": "minimum_backup_retention_period",
+          "Operator": "gte",
+          "Value": 7
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "Neptune.5",
@@ -176,6 +176,14 @@
        "iam_user_with_temporary_credentials",
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -585,6 +585,14 @@
        "cloudtrail_multi_region_enabled",
        "vpc_flow_logs_enabled",
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -646,6 +654,20 @@
        "guardduty_no_high_severity_findings",
        "macie_is_enabled",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -778,6 +800,14 @@
        "guardduty_is_enabled",
        "vpc_flow_logs_enabled",
        "apigateway_restapi_authorizers_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -382,6 +382,14 @@
        "cloudtrail_multi_region_enabled",
        "config_recorder_all_regions_enabled",
        "s3_multi_region_access_point_public_access_block"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2234,6 +2242,14 @@
        "vpc_different_regions",
        "autoscaling_group_multiple_az",
        "storagegateway_gateway_fault_tolerant"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2261,6 +2277,14 @@
        "organizations_scp_check_deny_regions",
        "s3_multi_region_access_point_public_access_block",
        "vpc_different_regions"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2308,6 +2332,14 @@
        "organizations_scp_check_deny_regions",
        "s3_multi_region_access_point_public_access_block",
        "vpc_different_regions"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2978,6 +3010,14 @@
        "guardduty_is_enabled",
        "athena_workgroup_enforce_configuration",
        "shield_advanced_protection_in_global_accelerators"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -3481,6 +3521,14 @@
        "cloudtrail_cloudwatch_logging_enabled",
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4299,6 +4347,14 @@
        "guardduty_no_high_severity_findings",
        "guardduty_rds_protection_enabled",
        "guardduty_s3_protection_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4920,6 +4976,17 @@
        "elbv2_nlb_tls_termination_enabled",
        "transfer_server_in_transit_encryption_enabled",
        "kafka_cluster_mutual_tls_authentication_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -4946,6 +5013,17 @@
        "elbv2_nlb_tls_termination_enabled",
        "transfer_server_in_transit_encryption_enabled",
        "kafka_cluster_mutual_tls_authentication_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -5220,6 +5298,14 @@
        "rds_instance_default_admin",
        "accessanalyzer_enabled",
        "efs_access_point_enforce_user_identity"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5737,6 +5823,14 @@
      "Checks": [
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6100,6 +6194,17 @@
        "cloudfront_distributions_origin_traffic_encrypted",
        "glue_development_endpoints_job_bookmark_encryption_enabled",
        "cloudtrail_kms_encryption_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6196,6 +6301,17 @@
        "elb_ssl_listeners_use_acm_certificate",
        "iam_no_expired_server_certificates_stored",
        "rds_instance_certificate_expiration"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6307,6 +6423,17 @@
        "elb_ssl_listeners_use_acm_certificate",
        "iam_no_expired_server_certificates_stored",
        "rds_instance_certificate_expiration"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6393,6 +6520,14 @@
        "sns_topics_not_publicly_accessible",
        "sqs_queues_not_publicly_accessible",
        "vpc_peering_routing_tables_with_least_privilege"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6412,6 +6547,14 @@
        "ec2_instance_profile_attached",
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6587,6 +6730,17 @@
        "kms_cmk_not_multi_region",
        "kms_key_not_publicly_accessible",
        "ec2_ebs_volume_encryption"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6809,6 +6963,17 @@
        "secretsmanager_not_publicly_accessible",
        "secretsmanager_secret_rotated_periodically",
        "secretsmanager_secret_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6842,6 +7007,17 @@
      ],
      "Checks": [
        "acm_certificates_with_secure_key_algorithms"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6915,6 +7091,17 @@
        "secretsmanager_secret_rotated_periodically",
        "secretsmanager_secret_unused",
        "acm_certificates_with_secure_key_algorithms"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -6937,6 +7124,17 @@
        "secretsmanager_secret_rotated_periodically",
        "secretsmanager_secret_unused",
        "acm_certificates_with_secure_key_algorithms"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -8042,6 +8240,14 @@
        "cloudtrail_multi_region_enabled",
        "cloudtrail_multi_region_enabled_logging_management_events",
        "cloudtrail_log_file_validation_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -8810,6 +9016,14 @@
        "guardduty_is_enabled",
        "cloudtrail_log_file_validation_enabled",
        "ssmincidents_enabled_with_plans"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -9732,6 +9946,14 @@
        "accessanalyzer_enabled_without_findings",
        "cloudfront_distributions_s3_origin_access_control",
        "cloudtrail_logs_s3_bucket_access_logging_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -10367,6 +10589,14 @@
      "Checks": [
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -10457,6 +10687,14 @@
        "ec2_instance_profile_attached",
        "iam_role_cross_account_readonlyaccess_policy",
        "iam_securityaudit_role_created"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -275,6 +275,17 @@
        "acm_certificates_expiration_check",
        "acm_certificates_with_secure_key_algorithms",
        "acm_certificates_transparency_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -794,6 +805,17 @@
      ],
      "Checks": [
        "acm_certificates_with_secure_key_algorithms"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -1504,6 +1526,14 @@
        "iam_policy_no_full_access_to_kms",
        "iam_policy_no_full_access_to_cloudtrail",
        "iam_policy_attached_only_to_group_or_roles"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1666,6 +1696,14 @@
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1791,6 +1829,14 @@
        "cloudtrail_threat_detection_enumeration",
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4311,6 +4357,14 @@
      ],
      "Checks": [
        "acm_certificates_expiration_check"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_expiration_check",
+          "ConfigKey": "days_to_expire_threshold",
+          "Operator": "gte",
+          "Value": 30
+        }
      ]
    },
    {
@@ -6176,6 +6230,20 @@
      "Checks": [
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -6272,6 +6340,14 @@
        "cloudwatch_log_metric_filter_root_usage",
        "cloudwatch_log_metric_filter_sign_in_without_mfa",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6374,6 +6450,14 @@
      "Checks": [
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -75,6 +75,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -736,6 +758,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 Logging",
@@ -75,6 +75,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -802,6 +824,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 Logging",
@@ -1054,6 +1084,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Monitoring",
@@ -75,6 +75,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -802,6 +824,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 Logging",
@@ -1054,6 +1084,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Monitoring",
@@ -75,6 +75,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -265,6 +279,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -756,6 +778,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 Logging",
@@ -1008,6 +1038,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Monitoring",
@@ -254,6 +254,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -431,6 +445,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -750,6 +772,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 Logging",
@@ -1234,6 +1264,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Monitoring",
@@ -232,6 +232,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -409,6 +423,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Identity and Access Management",
@@ -728,6 +750,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 Logging",
@@ -1212,6 +1242,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Monitoring",
@@ -232,6 +232,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Section": "2 Identity and Access Management",
@@ -409,6 +423,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "2 Identity and Access Management",
@@ -728,6 +750,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "4 Logging",
@@ -1212,6 +1242,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "5 Monitoring",
@@ -136,6 +136,20 @@
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_securitygroup_allow_ingress_from_internet_to_all_ports"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -367,6 +381,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -598,6 +598,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -624,6 +632,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -755,6 +771,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -781,6 +805,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -913,6 +945,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -940,6 +980,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -966,6 +1014,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1743,6 +1799,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1821,6 +1885,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1873,6 +1945,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1925,6 +2005,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1951,6 +2039,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1977,6 +2073,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2003,6 +2107,14 @@
      ],
      "Checks": [
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2056,6 +2168,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2082,6 +2202,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4310,6 +4438,14 @@
      ],
      "Checks": [
        "drs_job_exist"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -37,6 +37,14 @@
        "ssm_managed_compliant_patching",
        "ssm_managed_instance_compliance_association_compliant",
        "ssm_managed_instance_compliance_patch_compliant"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -146,6 +154,20 @@
        "inspector2_active_findings_exist",
        "securityhub_enabled",
        "sns_topics_kms_encryption_at_rest_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -205,6 +227,14 @@
        "resourceexplorer_indexes_found",
        "ssm_managed_instance_compliance_association_compliant",
        "trustedadvisor_premium_support_plan_subscribed"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -349,6 +379,14 @@
        "config_recorder_all_regions_enabled",
        "inspector2_is_enabled",
        "resourceexplorer_indexes_found"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    }
  ]
@@ -46,6 +46,20 @@
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -115,6 +129,20 @@
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -173,6 +201,14 @@
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -198,6 +234,20 @@
        "rds_instance_enhanced_monitoring_enabled",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -251,6 +301,14 @@
        "guardduty_is_enabled",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -336,6 +394,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -373,6 +445,14 @@
        "rds_instance_multi_az",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -36,6 +36,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -65,6 +79,20 @@
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -82,6 +110,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -140,6 +182,20 @@
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -191,6 +247,38 @@
        "iam_user_access_not_stale_to_sagemaker",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_access_not_stale_to_bedrock",
+          "ConfigKey": "max_unused_bedrock_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_role_access_not_stale_to_bedrock",
+          "ConfigKey": "max_unused_bedrock_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_access_not_stale_to_sagemaker",
+          "ConfigKey": "max_unused_sagemaker_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -371,6 +459,20 @@
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -507,6 +609,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -575,6 +691,14 @@
      ],
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -631,6 +755,20 @@
        "rds_instance_enhanced_monitoring_enabled",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -720,6 +858,14 @@
        "guardduty_is_enabled",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -887,6 +1033,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -909,6 +1069,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -927,6 +1101,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -945,6 +1133,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -961,6 +1163,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -995,6 +1205,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1061,6 +1285,14 @@
        "guardduty_is_enabled",
        "rds_instance_multi_az",
        "s3_bucket_object_versioning"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1285,6 +1517,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1307,6 +1547,20 @@
        "guardduty_is_enabled",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1334,6 +1588,20 @@
        "guardduty_is_enabled",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1361,6 +1629,20 @@
        "guardduty_is_enabled",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1388,6 +1670,20 @@
        "guardduty_is_enabled",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1414,6 +1710,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -37,6 +37,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -74,6 +82,20 @@
        "cloudtrail_cloudwatch_logging_enabled",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -148,6 +170,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -166,6 +202,20 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -183,6 +233,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -237,6 +301,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -254,6 +332,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -367,6 +459,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -386,6 +486,20 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -404,6 +518,20 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -826,6 +954,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -871,6 +1013,20 @@
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -59,6 +59,14 @@
        "cloudwatch_log_metric_filter_security_group_changes",
        "cloudwatch_log_metric_filter_unauthorized_api_calls",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -85,6 +93,14 @@
        "kms_cmk_rotation_enabled",
        "redshift_cluster_audit_logging",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -350,6 +350,20 @@
        "cloudtrail_cloudwatch_logging_enabled",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    }
  ]
@@ -19,6 +19,14 @@
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -146,6 +154,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -238,6 +254,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -253,6 +277,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -19,6 +19,20 @@
      "Checks": [
        "config_recorder_all_regions_enabled",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -102,6 +116,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -161,6 +189,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -328,6 +370,20 @@
        "guardduty_is_enabled",
        "cloudwatch_log_metric_filter_authentication_failures",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -373,6 +429,20 @@
        "cloudwatch_log_metric_filter_authentication_failures",
        "cloudwatch_log_metric_filter_root_usage",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -402,6 +472,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -514,6 +598,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -649,6 +747,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -756,6 +868,20 @@
        "s3_bucket_secure_transport_policy",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -311,6 +311,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -875,6 +883,38 @@
        "iam_user_access_not_stale_to_sagemaker",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_access_not_stale_to_bedrock",
+          "ConfigKey": "max_unused_bedrock_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_role_access_not_stale_to_bedrock",
+          "ConfigKey": "max_unused_bedrock_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_access_not_stale_to_sagemaker",
+          "ConfigKey": "max_unused_sagemaker_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -1052,6 +1092,20 @@
      "Checks": [
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -1261,6 +1315,20 @@
      "Checks": [
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -20,6 +20,14 @@
      "Checks": [
        "securityhub_enabled",
        "wellarchitected_workload_no_high_or_medium_risks"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -277,6 +285,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -331,6 +347,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -362,6 +386,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -378,6 +410,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -424,6 +464,14 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "guardduty_centrally_managed"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -472,6 +520,14 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "guardduty_centrally_managed"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -490,6 +546,14 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "guardduty_centrally_managed"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1004,6 +1068,14 @@
        "organizations_account_part_of_organizations",
        "accessanalyzer_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1080,6 +1152,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1111,6 +1191,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1749,6 +1837,14 @@
        "vpc_default_security_group_closed",
        "vpc_flow_logs_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1211,6 +1211,14 @@
        "rds_instance_default_admin",
        "redshift_cluster_non_default_database_name"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -1416,6 +1424,14 @@
        "iam_user_administrator_access_policy",
        "organizations_delegated_administrators"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -1486,6 +1502,14 @@
        "ssm_documents_set_as_public",
        "vpc_endpoint_services_allowed_principals_trust_boundaries"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -2082,6 +2106,17 @@
        "transfer_server_in_transit_encryption_enabled",
        "workspaces_volume_encryption_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -2819,6 +2854,20 @@
        "wafv2_webacl_rule_logging_enabled",
        "wafv2_webacl_with_rules"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -3319,6 +3368,47 @@
        "workspaces_volume_encryption_enabled",
        "workspaces_vpc_2private_1public_subnets_nat"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -3711,6 +3801,14 @@
        "s3_bucket_event_notifications_enabled",
        "trustedadvisor_errors_and_warnings"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -3829,6 +3927,14 @@
        "s3_bucket_object_lock",
        "s3_bucket_object_versioning"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -3866,6 +3972,14 @@
      "Checks": [
        "drs_job_exist"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. Control Measures Requirements",
@@ -1211,6 +1211,14 @@
        "rds_instance_default_admin",
        "redshift_cluster_non_default_database_name"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -1416,6 +1424,14 @@
        "iam_user_administrator_access_policy",
        "organizations_delegated_administrators"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -1485,6 +1501,14 @@
        "ssm_documents_set_as_public",
        "vpc_endpoint_services_allowed_principals_trust_boundaries"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -2084,6 +2108,17 @@
        "transfer_server_in_transit_encryption_enabled",
        "workspaces_volume_encryption_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -2822,6 +2857,20 @@
        "wafv2_webacl_rule_logging_enabled",
        "wafv2_webacl_with_rules"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -3322,6 +3371,47 @@
        "workspaces_volume_encryption_enabled",
        "workspaces_vpc_2private_1public_subnets_nat"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -3714,6 +3804,14 @@
        "s3_bucket_event_notifications_enabled",
        "trustedadvisor_errors_and_warnings"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -3832,6 +3930,14 @@
        "s3_bucket_object_lock",
        "s3_bucket_object_versioning"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -3869,6 +3975,14 @@
      "Checks": [
        "drs_job_exist"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Domain": "2. 보호대책 요구사항",
@@ -35,6 +35,32 @@
        "awslambda_function_not_publicly_accessible",
        "ec2_instance_public_ip"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudEndure Disaster Recovery",
@@ -200,6 +226,26 @@
        "organizations_scp_check_deny_regions",
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "Amazon GuardDuty",
@@ -348,6 +394,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -393,6 +447,26 @@
        "guardduty_is_enabled",
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -444,6 +518,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -557,6 +639,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -634,6 +724,26 @@
        "inspector2_is_enabled",
        "inspector2_active_findings_exist"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -821,6 +931,26 @@
        "inspector2_is_enabled",
        "inspector2_active_findings_exist"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -984,6 +1114,14 @@
        "cloudfront_distributions_https_enabled",
        "s3_bucket_secure_transport_policy"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudWatch",
@@ -1057,6 +1195,14 @@
        "ssm_document_secrets",
        "secretsmanager_automatic_rotation_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudHSM",
@@ -1143,6 +1289,14 @@
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Network Firewall",
@@ -1218,6 +1372,14 @@
        "s3_bucket_default_encryption",
        "rds_instance_storage_encrypted"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -1264,6 +1426,20 @@
        "securityhub_enabled",
        "macie_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -1441,6 +1617,20 @@
        "s3_bucket_object_versioning",
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1518,6 +1708,20 @@
        "efs_have_backup_enabled",
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1566,6 +1770,20 @@
        "drs_job_exist",
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1639,6 +1857,14 @@
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Shield",
@@ -1686,6 +1912,14 @@
        "drs_job_exist",
        "rds_instance_backup_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudEndure Disaster Recovery",
@@ -1743,6 +1977,20 @@
        "cloudwatch_log_metric_filter_sign_in_without_mfa",
        "cloudwatch_log_metric_filter_unauthorized_api_calls"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS CloudWatch",
@@ -1819,6 +2067,20 @@
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Config",
@@ -1910,6 +2172,20 @@
        "iam_policy_no_full_access_to_cloudtrail",
        "iam_policy_no_full_access_to_kms"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS Organizations",
@@ -1993,6 +2269,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "Amazon GuardDuty",
@@ -2071,6 +2355,14 @@
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "AWSService": "AWS IoT Device Defender",
@@ -597,6 +597,14 @@
        "accessanalyzer_enabled",
        "cloudwatch_log_metric_filter_root_usage"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)",
@@ -1511,6 +1519,17 @@
      "Checks": [
        "acm_certificates_with_secure_key_algorithms"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)",
@@ -1528,6 +1547,17 @@
        "route53_domains_privacy_protection_enabled",
        "iam_no_expired_server_certificates_stored"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)",
@@ -1645,6 +1675,14 @@
        "efs_access_point_enforce_user_identity",
        "efs_not_publicly_accessible"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)",
@@ -1676,6 +1714,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)",
@@ -1726,6 +1772,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)",
@@ -230,6 +230,20 @@
        "rds_instance_integration_cloudwatch_logs",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -321,6 +335,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -344,6 +372,14 @@
        "guardduty_is_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "s3_bucket_server_access_logging_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -383,6 +419,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -400,6 +450,20 @@
        "cloudtrail_cloudwatch_logging_enabled",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -687,6 +751,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -715,6 +793,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -732,6 +824,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -749,6 +855,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -772,6 +892,20 @@
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -809,6 +943,20 @@
        "ec2_networkacl_allow_ingress_any_port",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
        "ec2_networkacl_allow_ingress_any_port"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1028,6 +1176,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1047,6 +1209,20 @@
        "securityhub_enabled",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1064,6 +1240,20 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1079,6 +1269,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1105,6 +1303,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1131,6 +1343,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    }
  ]
@@ -27,6 +27,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -47,6 +61,38 @@
        "iam_user_access_not_stale_to_sagemaker",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_access_not_stale_to_bedrock",
+          "ConfigKey": "max_unused_bedrock_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_role_access_not_stale_to_bedrock",
+          "ConfigKey": "max_unused_bedrock_access_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_user_access_not_stale_to_sagemaker",
+          "ConfigKey": "max_unused_sagemaker_access_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -73,6 +119,20 @@
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -90,6 +150,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -125,6 +199,20 @@
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -270,6 +358,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -399,6 +501,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -421,6 +537,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -534,6 +664,20 @@
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -827,6 +971,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -860,6 +1012,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1110,6 +1276,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1133,6 +1307,20 @@
        "ec2_instance_imdsv2_enabled",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1155,6 +1343,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1177,6 +1379,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1194,6 +1410,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1218,6 +1448,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -220,6 +220,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -944,6 +952,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1629,6 +1645,14 @@
      "Checks": [
        "cloudtrail_multi_region_enabled",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1828,6 +1852,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1906,6 +1944,20 @@
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2290,6 +2342,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2352,6 +2418,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2387,6 +2467,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2466,6 +2560,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2487,6 +2595,20 @@
        "guardduty_is_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2522,6 +2644,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2904,6 +3040,14 @@
        "guardduty_is_enabled",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4079,6 +4223,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4095,6 +4247,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4149,6 +4309,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4184,6 +4358,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4199,6 +4387,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4270,6 +4466,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4286,6 +4496,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4303,6 +4521,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4320,6 +4546,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4336,6 +4570,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4353,6 +4595,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4369,6 +4619,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4385,6 +4643,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4401,6 +4667,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4418,6 +4692,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4435,6 +4717,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4516,6 +4806,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4558,6 +4856,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4575,6 +4881,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4591,6 +4905,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -4607,6 +4929,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5683,6 +6013,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5850,6 +6188,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5890,6 +6236,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5907,6 +6261,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5924,6 +6286,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5940,6 +6310,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5956,6 +6334,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -5988,6 +6374,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6012,6 +6406,14 @@
        "rds_instance_integration_cloudwatch_logs",
        "redshift_cluster_audit_logging",
        "s3_bucket_server_access_logging_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6028,6 +6430,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6045,6 +6455,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6062,6 +6480,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6078,6 +6504,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6114,6 +6548,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6130,6 +6572,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6197,6 +6647,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6213,6 +6671,14 @@
      ],
      "Checks": [
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6233,6 +6699,14 @@
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -6253,6 +6727,14 @@
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -48,6 +48,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -99,6 +113,20 @@
        "guardduty_no_high_severity_findings",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -144,6 +172,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -179,6 +221,26 @@
        "cloudwatch_log_metric_filter_unauthorized_api_calls",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -201,6 +263,20 @@
        "guardduty_is_enabled",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -218,6 +294,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -243,6 +333,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -265,6 +369,20 @@
        "guardduty_is_enabled",
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -291,6 +409,20 @@
        "s3_bucket_server_access_logging_enabled",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -316,6 +448,20 @@
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -349,6 +495,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled",
        "ec2_instance_managed_by_ssm"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -454,6 +608,20 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -471,6 +639,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -488,6 +670,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -523,6 +719,26 @@
        "cloudwatch_log_metric_filter_unauthorized_api_calls",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -554,6 +770,26 @@
        "cloudwatch_log_metric_filter_unauthorized_api_calls",
        "rds_instance_enhanced_monitoring_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -827,6 +1063,20 @@
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "securityhub_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -881,6 +1131,14 @@
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1035,6 +1293,14 @@
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -72,6 +72,20 @@
        "securityhub_enabled",
        "wellarchitected_workload_no_high_or_medium_risks",
        "servicecatalog_portfolio_shared_within_organization_only"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -322,6 +336,26 @@
        "wellarchitected_workload_no_high_or_medium_risks",
        "organizations_delegated_administrators",
        "organizations_tags_policies_enabled_and_attached"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -352,6 +386,26 @@
        "vpc_flow_logs_enabled",
        "iam_root_mfa_enabled",
        "iam_root_credentials_management_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -408,6 +462,20 @@
        "accessanalyzer_enabled",
        "guardduty_no_high_severity_findings",
        "trustedadvisor_errors_and_warnings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -442,6 +510,26 @@
        "organizations_scp_check_deny_regions",
        "organizations_tags_policies_enabled_and_attached",
        "organizations_delegated_administrators"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -574,6 +662,14 @@
        "opensearch_service_domains_encryption_at_rest_enabled",
        "redshift_cluster_encrypted_at_rest",
        "sns_topics_kms_encryption_at_rest_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -610,6 +706,17 @@
        "iam_inline_policy_allows_privilege_escalation",
        "ssm_documents_set_as_public",
        "s3_bucket_shadow_resource_vulnerability"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -726,6 +833,14 @@
        "iam_role_administratoraccess_policy",
        "iam_policy_no_full_access_to_cloudtrail",
        "iam_policy_no_full_access_to_kms"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -853,6 +968,14 @@
        "iam_customer_unattached_policy_no_administrative_privileges",
        "accessanalyzer_enabled",
        "cognito_user_pool_password_policy_symbol"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1224,6 +1347,14 @@
        "inspector2_active_findings_exist",
        "secretsmanager_automatic_rotation_enabled",
        "secretsmanager_secret_rotated_periodically"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1265,6 +1396,14 @@
      "Checks": [
        "ssmincidents_enabled_with_plans",
        "drs_job_exist"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1283,6 +1422,14 @@
        "inspector2_is_enabled",
        "guardduty_is_enabled",
        "inspector2_active_findings_exist"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1329,6 +1476,14 @@
        "vpc_flow_logs_enabled",
        "config_recorder_all_regions_enabled",
        "config_recorder_using_aws_service_role"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1540,6 +1695,14 @@
        "guardduty_is_enabled",
        "inspector2_is_enabled",
        "accessanalyzer_enabled_without_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1662,6 +1825,14 @@
        "guardduty_rds_protection_enabled",
        "guardduty_lambda_protection_enabled",
        "guardduty_eks_runtime_monitoring_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -628,6 +628,14 @@
        "ssm_managed_compliant_patching",
        "ec2_elastic_ip_unassigned"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "2.4",
@@ -643,6 +651,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "2.4.a",
@@ -2413,6 +2429,14 @@
        "cloudtrail_log_file_validation_enabled",
        "s3_bucket_cross_region_replication"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "10.5",
@@ -2430,6 +2454,14 @@
        "s3_bucket_object_versioning",
        "cloudtrail_log_file_validation_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "10.5.2",
@@ -2616,6 +2648,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.4",
@@ -2631,6 +2671,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.4.a",
@@ -2646,6 +2694,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.4.b",
@@ -2661,6 +2717,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.4.c",
@@ -2676,6 +2740,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.5",
@@ -2691,6 +2763,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.5.a",
@@ -2706,6 +2786,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "ItemId": "11.5.b",
@@ -4403,6 +4403,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ",
@@ -9281,6 +9289,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ",
@@ -9363,6 +9379,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ",
@@ -9459,6 +9483,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ",
@@ -9551,6 +9583,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.5.1: Audit log history is retained and available for analysis. ",
@@ -10179,6 +10219,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ",
@@ -10343,6 +10391,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ",
@@ -10451,6 +10507,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ",
@@ -10625,6 +10689,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. ",
@@ -10653,6 +10725,14 @@
      "Checks": [
        "guardduty_is_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to. ",
@@ -11445,6 +11525,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.2.1: Storage of account data is kept to a minimum. ",
@@ -11567,6 +11655,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -11689,6 +11785,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -11811,6 +11915,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -11933,6 +12045,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ",
@@ -13573,6 +13693,17 @@
      "Checks": [
        "acm_certificates_with_secure_key_algorithms"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ",
@@ -15001,6 +15132,14 @@
      "Checks": [
        "cloudwatch_log_group_retention_policy_specific_days_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudwatch_log_group_retention_policy_specific_days_enabled",
+          "ConfigKey": "log_group_retention_days",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ",
@@ -22504,6 +22643,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ",
@@ -23000,6 +23147,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Section": "A3.5.1: Suspicious events are identified and responded to. ",
@@ -174,6 +174,20 @@
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_user_accesskey_unused",
+          "ConfigKey": "max_unused_access_keys_days",
+          "Operator": "lte",
+          "Value": 45
+        },
+        {
+          "Check": "iam_user_console_access_unused",
+          "ConfigKey": "max_console_access_days",
+          "Operator": "lte",
+          "Value": 45
+        }
+      ],
      "Attributes": [
        {
          "Title": "IAM credentials unused disabled",
@@ -336,6 +350,14 @@
      "Checks": [
        "accessanalyzer_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Title": "Access Analyzer enabled",
@@ -1541,6 +1563,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Title": "AWS Config is enabled",
@@ -1829,6 +1859,14 @@
      "Checks": [
        "securityhub_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ],
      "Attributes": [
        {
          "Title": "Security Hub enabled",
@@ -185,6 +185,14 @@
        "securityhub_enabled",
        "vpc_flow_logs_enabled",
        "opensearch_service_domains_audit_logging_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -202,6 +202,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled",
        "ec2_instance_managed_by_ssm"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -323,6 +331,14 @@
        "iam_role_administratoraccess_policy",
        "iam_user_administrator_access_policy",
        "iam_user_two_active_access_key"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -563,6 +579,17 @@
      "Checks": [
        "acm_certificates_expiration_check",
        "acm_certificates_with_secure_key_algorithms"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        }
      ]
    },
    {
@@ -735,6 +762,14 @@
        "config_recorder_all_regions_enabled",
        "cloudtrail_multi_region_enabled",
        "cloudtrail_multi_region_enabled_logging_management_events"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -774,6 +809,14 @@
        "guardduty_lambda_protection_enabled",
        "guardduty_eks_audit_log_enabled",
        "guardduty_eks_runtime_monitoring_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -911,6 +954,20 @@
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
        "cloudwatch_changes_to_vpcs_alarm_configured"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1014,6 +1071,14 @@
        "config_recorder_all_regions_enabled",
        "config_recorder_using_aws_service_role",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1060,6 +1125,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "vpc_flow_logs_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1091,6 +1164,14 @@
      "Checks": [
        "config_recorder_all_regions_enabled",
        "cloudtrail_multi_region_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1268,6 +1349,20 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "cloudwatch_alarm_actions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1418,6 +1513,14 @@
      "Checks": [
        "backup_plans_exist",
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1481,6 +1584,20 @@
      "Checks": [
        "securityhub_enabled",
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -1498,6 +1615,14 @@
      "Checks": [
        "inspector2_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -43,6 +43,14 @@
        "cloudtrail_s3_dataevents_write_enabled",
        "cloudtrail_multi_region_enabled",
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -61,6 +69,26 @@
        "guardduty_is_enabled",
        "securityhub_enabled",
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -80,6 +108,14 @@
        "ssm_managed_compliant_patching",
        "guardduty_no_high_severity_findings",
        "guardduty_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -116,6 +152,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -133,6 +177,14 @@
      "Checks": [
        "guardduty_is_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -312,6 +364,20 @@
      "Checks": [
        "guardduty_is_enabled",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -331,6 +397,20 @@
        "securityhub_enabled",
        "ec2_instance_managed_by_ssm",
        "ssm_managed_compliant_patching"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -367,6 +447,20 @@
        "guardduty_is_enabled",
        "apigateway_restapi_logging_enabled",
        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -399,6 +493,20 @@
        "cloudwatch_log_group_retention_policy_specific_days_enabled",
        "vpc_flow_logs_enabled",
        "guardduty_no_high_severity_findings"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -426,6 +534,20 @@
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning",
        "securityhub_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -463,6 +585,14 @@
      ],
      "Checks": [
        "config_recorder_all_regions_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -600,6 +730,14 @@
        "rds_cluster_integration_cloudwatch_logs",
        "glue_etl_jobs_logging_enabled",
        "stepfunctions_statemachine_logging_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
      ]
    },
    {
@@ -2681,6 +2681,17 @@
        "app_function_latest_runtime_version",
        "mysql_flexible_server_minimum_tls_version_12",
        "sqlserver_recommended_minimal_tls_version"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -2705,6 +2716,17 @@
        "app_function_latest_runtime_version",
        "mysql_flexible_server_minimum_tls_version_12",
        "sqlserver_recommended_minimal_tls_version"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -3903,6 +3925,17 @@
        "app_ensure_php_version_is_latest",
        "storage_ensure_minimum_tls_version_12",
        "storage_smb_protocol_version_is_latest"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -4352,6 +4385,17 @@
        "sqlserver_recommended_minimal_tls_version",
        "sqlserver_tde_encrypted_with_cmk",
        "sqlserver_tde_encryption_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -5743,6 +5787,17 @@
        "storage_ensure_minimum_tls_version_12",
        "sqlserver_tde_encrypted_with_cmk",
        "sqlserver_tde_encryption_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -5770,6 +5825,17 @@
        "storage_ensure_minimum_tls_version_12",
        "sqlserver_tde_encrypted_with_cmk",
        "sqlserver_tde_encryption_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -6513,6 +6579,17 @@
        "mysql_flexible_server_minimum_tls_version_12",
        "sqlserver_recommended_minimal_tls_version",
        "storage_ensure_minimum_tls_version_12"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -56,6 +56,25 @@
        "app_ensure_using_http20",
        "app_ftp_deployment_disabled",
        "app_function_ftps_deployment_disabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        },
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
      ]
    },
    {
@@ -726,6 +745,16 @@
      ],
      "Checks": [
        "storage_smb_channel_encryption_with_secure_algorithm"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
      ]
    },
    {
@@ -375,6 +375,16 @@
      "Checks": [
        "storage_smb_channel_encryption_with_secure_algorithm"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "10 Storage Services",
@@ -3006,6 +3006,16 @@
      "Checks": [
        "storage_smb_channel_encryption_with_secure_algorithm"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "9 Storage Services",
@@ -765,6 +765,17 @@
        "mysql_flexible_server_minimum_tls_version_12",
        "mysql_flexible_server_ssl_connection_enabled",
        "postgresql_flexible_server_enforce_ssl_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -817,6 +828,17 @@
        "mysql_flexible_server_ssl_connection_enabled",
        "postgresql_flexible_server_enforce_ssl_enabled",
        "databricks_workspace_cmk_encryption_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    }
  ]
@@ -1133,6 +1133,17 @@
        "defender_ensure_defender_for_dns_is_on",
        "sqlserver_tde_encryption_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)",
@@ -1164,6 +1175,17 @@
        "network_udp_internet_access_restricted",
        "network_watcher_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)",
@@ -1887,6 +1909,17 @@
        "sqlserver_tde_encrypted_with_cmk",
        "sqlserver_tde_encryption_enabled"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
+      ],
      "Attributes": [
        {
          "Section": "12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)",
@@ -440,6 +440,25 @@
        "postgresql_flexible_server_enforce_ssl_enabled",
        "mysql_flexible_server_ssl_connection_enabled",
        "mysql_flexible_server_minimum_tls_version_12"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        },
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
      ]
    },
    {
@@ -266,6 +266,17 @@
        "sqlserver_tde_encryption_enabled",
        "sqlserver_unrestricted_inbound_access",
        "storage_secure_transfer_required_is_enabled"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -310,6 +321,17 @@
        "sqlserver_recommended_minimal_tls_version",
        "storage_ensure_minimum_tls_version_12",
        "network_subnet_nsg_associated"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
      ]
    },
    {
@@ -229,7 +229,15 @@
        "oraclecloud": [
          "cloudguard_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "A&A-04",
@@ -334,7 +342,21 @@
        "oraclecloud": [
          "cloudguard_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "AIS-04",
@@ -978,7 +1000,15 @@
          "defender_ensure_defender_for_server_is_on",
          "vm_backup_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "drs_job_exist",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "BCR-11",
@@ -1416,7 +1446,27 @@
          "events_rule_security_list_changes",
          "events_rule_vcn_changes"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "CEK-03",
@@ -1659,7 +1709,17 @@
          "filestorage_file_system_encrypted_with_cmk",
          "objectstorage_bucket_encrypted_with_cmk"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
+      ]
    },
    {
      "id": "CEK-04",
@@ -1802,7 +1862,27 @@
          "dns_rsasha1_in_use_to_key_sign_in_dnssec",
          "dns_rsasha1_in_use_to_zone_sign_in_dnssec"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        },
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
+      ]
    },
    {
      "id": "CEK-08",
@@ -2345,7 +2425,15 @@
        "alibabacloud": [
          "securitycenter_all_assets_agent_installed"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DSP-02",
@@ -2583,7 +2671,15 @@
        "alibabacloud": [
          "securitycenter_all_assets_agent_installed"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DSP-04",
@@ -2997,7 +3093,18 @@
        "oraclecloud": [
          "compute_instance_in_transit_encryption_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        }
+      ]
    },
    {
      "id": "DSP-16",
@@ -3403,7 +3510,21 @@
        "oraclecloud": [
          "cloudguard_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "IAM-02",
@@ -6255,7 +6376,15 @@
          "cloudguard_enabled",
          "events_rule_cloudguard_problems"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "LOG-02",
@@ -6558,7 +6687,21 @@
          "events_notification_topic_and_subscription_exists",
          "events_rule_local_user_authentication"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "LOG-04",
@@ -7602,7 +7745,15 @@
          "events_rule_cloudguard_problems",
          "events_notification_topic_and_subscription_exists"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "SEF-03",
@@ -7880,7 +8031,21 @@
        "oraclecloud": [
          "cloudguard_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "SEF-08",
@@ -8461,7 +8626,15 @@
        "oraclecloud": [
          "cloudguard_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "TVM-05",
@@ -8729,7 +8902,15 @@
        "oraclecloud": [
          "cloudguard_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "UEM-08",
@@ -215,7 +215,33 @@
          "securitycenter_vulnerability_scan_enabled",
          "actiontrail_multi_region_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_delegated_admin_enabled_all_regions",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art7",
@@ -299,7 +325,35 @@
          "ecs_unattached_disk_encrypted",
          "ecs_instance_no_legacy_network"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "acm_certificates_with_secure_key_algorithms",
+          "ConfigKey": "insecure_key_algorithms",
+          "Operator": "superset",
+          "Value": [
+            "RSA-1024",
+            "P-192"
+          ]
+        },
+        {
+          "Check": "sqlserver_recommended_minimal_tls_version",
+          "ConfigKey": "recommended_minimal_tls_versions",
+          "Operator": "subset",
+          "Value": [
+            "1.2",
+            "1.3"
+          ]
+        },
+        {
+          "Check": "storage_smb_channel_encryption_with_secure_algorithm",
+          "ConfigKey": "recommended_smb_channel_encryption_algorithms",
+          "Operator": "subset",
+          "Value": [
+            "AES-256-GCM"
+          ]
+        }
+      ]
    },
    {
      "id": "DORA-Art8",
@@ -344,7 +398,15 @@
          "securitycenter_all_assets_agent_installed",
          "ram_user_console_access_unused"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art9",
@@ -580,7 +642,21 @@
          "ecs_instance_endpoint_protection_installed",
          "cs_kubernetes_cloudmonitor_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art11",
@@ -732,7 +808,15 @@
          "securitycenter_all_assets_agent_installed",
          "ecs_instance_latest_os_patches_applied"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art14",
@@ -901,7 +985,21 @@
          "securitycenter_notification_enabled_high_risk",
          "securitycenter_vulnerability_scan_enabled"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_delegated_admin_enabled_all_regions",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art19",
@@ -1017,7 +1115,15 @@
          "cs_kubernetes_cluster_check_recent",
          "cs_kubernetes_cluster_check_weekly"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art25",
@@ -1079,7 +1185,21 @@
          "ecs_instance_latest_os_patches_applied",
          "ecs_instance_no_legacy_network"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "config_recorder_all_regions_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art28",
@@ -1144,7 +1264,15 @@
          "oss_bucket_not_publicly_accessible",
          "actiontrail_oss_bucket_not_publicly_accessible"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art30",
@@ -1200,7 +1328,15 @@
          "ram_policy_attached_only_to_group_or_roles",
          "ram_no_root_access_key"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "accessanalyzer_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    },
    {
      "id": "DORA-Art45",
@@ -1245,7 +1381,21 @@
          "actiontrail_multi_region_enabled",
          "sls_logstore_retention_period"
        ]
-      }
+      },
+      "config_requirements": [
+        {
+          "Check": "guardduty_is_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        },
+        {
+          "Check": "securityhub_enabled",
+          "ConfigKey": "mute_non_default_regions",
+          "Operator": "eq",
+          "Value": false
+        }
+      ]
    }
  ]
 }
@@ -924,6 +924,14 @@
        "cloudsql_instance_automated_backups",
        "cloudstorage_bucket_log_retention_policy_lock",
        "cloudstorage_bucket_sufficient_retention_period"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "cloudstorage_bucket_sufficient_retention_period",
+          "ConfigKey": "storage_min_retention_days",
+          "Operator": "gte",
+          "Value": 30
+        }
      ]
    },
    {
@@ -5841,6 +5849,20 @@
      "Checks": [
        "iam_sa_user_managed_key_unused",
        "iam_service_account_unused"
+      ],
+      "ConfigRequirements": [
+        {
+          "Check": "iam_sa_user_managed_key_unused",
+          "ConfigKey": "max_unused_account_days",
+          "Operator": "lte",
+          "Value": 90
+        },
+        {
+          "Check": "iam_service_account_unused",
+          "ConfigKey": "max_unused_account_days",
+          "Operator": "lte",
+          "Value": 90
+        }
      ]
    },
    {
@@ -820,6 +820,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 30
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Control Plane Components",
@@ -820,6 +820,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 30
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Control Plane Components",
@@ -820,6 +820,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 30
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Control Plane Components",
@@ -843,6 +843,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 30
+        }
+      ],
      "Attributes": [
        {
          "Section": "1 Control Plane Components",
@@ -8268,6 +8268,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "10.5.1: Audit log history is retained and available for analysis.",
@@ -10054,6 +10062,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization.",
@@ -10250,6 +10266,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization.",
@@ -13004,6 +13028,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 365
+        }
+      ],
      "Attributes": [
        {
          "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.",
@@ -1199,6 +1199,14 @@
      "Checks": [
        "apiserver_audit_log_maxage_set"
      ],
+      "ConfigRequirements": [
+        {
+          "Check": "apiserver_audit_log_maxage_set",
+          "ConfigKey": "audit_log_maxage",
+          "Operator": "gte",
+          "Value": 30
+        }
+      ],
      "Attributes": [
        {
          "Title": "API Server audit log retention configured",
@@ -0,0 +1,220 @@
+"""Shared evaluation of a requirement's configuration constraints.
+
+Some compliance requirements only hold if the configurable checks they map to
+ran with a configuration strict enough for the requirement. For example CIS AWS
+6.0 requirement 2.11 ("credentials unused for 45 days or more are disabled")
+maps `iam_user_accesskey_unused` (config `max_unused_access_keys_days`); if the
+user loosens that to 120 days the check can PASS while the requirement is, in
+fact, not satisfied.
+
+A requirement declares its expectations via ``ConfigRequirements`` (a list of
+``{Check, ConfigKey, Operator, Value}``). The configuration a scan applied is a
+single, scan-global mapping (the provider's ``audit_config``), so the rules are
+evaluated against that mapping directly. This module is consumed by the SDK
+compliance outputs (CSV + CLI table) and by the Prowler App backend so the rule
+lives in one place.
+"""
+
+from typing import Any, Optional
+
+# Prefix prepended to a finding's ``status_extended`` when its requirement's
+# config constraints are not satisfied and the status is forced to FAIL.
+CONFIG_NOT_VALID_PREFIX = "[CONFIG NOT VALID]"
+
+
+def _check_operator(applied: Any, operator: str, expected: Any) -> bool:
+    """Return whether ``applied`` satisfies ``operator`` against ``expected``."""
+    try:
+        if operator == "lte":
+            return applied <= expected
+        if operator == "gte":
+            return applied >= expected
+        if operator == "eq":
+            return applied == expected
+        if operator == "in":
+            return applied in expected
+        if operator in ("subset", "superset"):
+            # Set comparisons for list-valued configs (allowlists / denylists).
+            # Both sides must be collections; anything else is not satisfiable.
+            if not isinstance(applied, (list, tuple, set)) or not isinstance(
+                expected, (list, tuple, set)
+            ):
+                return False
+            applied_set, expected_set = set(applied), set(expected)
+            if operator == "subset":
+                return applied_set <= expected_set
+            return applied_set >= expected_set
+    except TypeError:
+        # Mismatched/unhashable types → treat as not satisfied.
+        return False
+    # Unknown operator: do not block the requirement on a malformed constraint.
+    return True
+
+
+def evaluate_config_constraints(
+    config_requirements: Optional[list],
+    audit_config: Optional[dict],
+) -> tuple[bool, str]:
+    """Evaluate a requirement's config constraints against the scan's config.
+
+    Args:
+        config_requirements: list of constraints, each a mapping (or object with
+            the same attributes) holding ``Check``, ``ConfigKey``, ``Operator``
+            and ``Value``. ``None``/empty means the requirement has no config
+            expectations.
+        audit_config: the scan-global configuration mapping (the provider's
+            ``audit_config``, i.e. ``{config_key: value}``). The applied config
+            is identical across every resource and region of a scan.
+
+    Returns:
+        ``(is_compliant, reason)``. ``is_compliant`` is ``True`` when there are
+        no constraints or every explicitly-set value satisfies its constraint.
+        When a configured value violates a constraint, returns ``(False, reason)``
+        describing the first violation. A constraint whose ``ConfigKey`` was not
+        explicitly set is skipped (the check's default is assumed to match what
+        the requirement expects).
+    """
+    if not config_requirements:
+        return True, ""
+
+    audit_config = audit_config or {}
+
+    for constraint in config_requirements:
+        # Accept both dicts (API template) and objects (Pydantic model).
+        if isinstance(constraint, dict):
+            check = constraint.get("Check")
+            config_key = constraint.get("ConfigKey")
+            operator = constraint.get("Operator")
+            expected = constraint.get("Value")
+        else:
+            check = getattr(constraint, "Check", None)
+            config_key = getattr(constraint, "ConfigKey", None)
+            operator = getattr(constraint, "Operator", None)
+            expected = getattr(constraint, "Value", None)
+
+        if config_key not in audit_config:
+            # Config not explicitly set → default is assumed adequate.
+            continue
+
+        applied = audit_config[config_key]
+        if not _check_operator(applied, operator, expected):
+            reason = (
+                f"config not valid for requirement: {check}.{config_key}="
+                f"{applied!r} does not satisfy {operator} {expected!r}"
+            )
+            return False, reason
+
+    return True, ""
+
+
+def get_scan_audit_config() -> dict:
+    """Return the scan-global applied configuration (the provider's audit_config).
+
+    The applied config is identical across every resource and region of a scan,
+    so every compliance output evaluates constraints against this single mapping.
+    Imported lazily to avoid a circular import with the provider package and to
+    keep this module usable from contexts without a global provider (returns
+    ``{}`` if no provider is set or audit_config is unavailable).
+    """
+    try:
+        from prowler.providers.common.provider import Provider
+
+        return Provider.get_global_provider().audit_config or {}
+    except Exception:
+        return {}
+
+
+def _requirement_id(requirement: Any) -> Optional[str]:
+    """Return a requirement's id across the legacy (``Id``) and universal (``id``) models."""
+    return getattr(requirement, "Id", None) or getattr(requirement, "id", None)
+
+
+def _requirement_constraints(requirement: Any) -> Optional[list]:
+    """Return a requirement's config constraints across both model flavours.
+
+    Legacy ``Compliance_Requirement`` exposes ``ConfigRequirements`` (a list of
+    Pydantic models); ``UniversalComplianceRequirement`` exposes
+    ``config_requirements`` (a list of dicts). ``evaluate_config_constraints``
+    handles both element types.
+    """
+    return getattr(requirement, "ConfigRequirements", None) or getattr(
+        requirement, "config_requirements", None
+    )
+
+
+def build_requirement_config_status(
+    requirements: list,
+    audit_config: Optional[dict] = None,
+) -> dict:
+    """Map every requirement id to its ``(is_compliant, reason)`` config verdict.
+
+    Only requirements that actually declare constraints are included; callers use
+    ``dict.get(req_id)`` (returning ``None`` → no constraints → no override).
+
+    Args:
+        requirements: the framework's requirements (legacy or universal models).
+        audit_config: the applied config; resolved via ``get_scan_audit_config``
+            when omitted.
+    """
+    if audit_config is None:
+        audit_config = get_scan_audit_config()
+    status = {}
+    for requirement in requirements:
+        constraints = _requirement_constraints(requirement)
+        if constraints:
+            status[_requirement_id(requirement)] = evaluate_config_constraints(
+                constraints, audit_config
+            )
+    return status
+
+
+def resolve_requirement_config_status(
+    requirement: Any,
+    audit_config: dict,
+    cache: dict,
+) -> tuple[bool, str]:
+    """Return a requirement's ``(is_compliant, reason)`` verdict, memoised in ``cache``.
+
+    For table generators that iterate findings × compliances and only encounter
+    each requirement lazily. ``cache`` is keyed by requirement id and reused
+    across the whole table build.
+    """
+    req_id = _requirement_id(requirement)
+    if req_id not in cache:
+        constraints = _requirement_constraints(requirement)
+        cache[req_id] = (
+            evaluate_config_constraints(constraints, audit_config)
+            if constraints
+            else (True, "")
+        )
+    return cache[req_id]
+
+
+def apply_config_status(
+    status: str,
+    status_extended: str,
+    config_status: Optional[tuple],
+) -> tuple[str, str]:
+    """Override a finding's ``(status, status_extended)`` when its config is invalid.
+
+    A requirement whose configurable checks ran with a config too loose to trust
+    is forced to ``FAIL`` regardless of the finding's own status, with the reason
+    prepended to ``status_extended``. ``config_status`` is the ``(ok, reason)``
+    tuple from ``build_requirement_config_status`` (``None`` → no constraints).
+    """
+    if not config_status or config_status[0]:
+        return status, status_extended
+    return (
+        "FAIL",
+        f"{CONFIG_NOT_VALID_PREFIX} {config_status[1]}. {status_extended}",
+    )
+
+
+def get_effective_status(
+    status: str,
+    config_status: Optional[tuple],
+) -> str:
+    """Return the effective status for table aggregation (``FAIL`` if config invalid)."""
+    if not config_status or config_status[0]:
+        return status
+    return "FAIL"
@@ -3,7 +3,7 @@ import json
 import os
 import sys
 from enum import Enum
-from typing import Optional, Union
+from typing import Literal, Optional, Union

 from pydantic.v1 import BaseModel, Field, ValidationError, root_validator

@@ -304,6 +304,34 @@ class STIG_Requirement_Attribute(BaseModel):


 # Base Compliance Model
+class Compliance_Requirement_ConfigConstraint(BaseModel):
+    """A constraint a requirement places on a configurable check's config.
+
+    Declares that the configurable check ``Check`` must have run with
+    ``ConfigKey`` satisfying ``Operator`` ``Value`` for the requirement's
+    result to be trusted. Example: ``max_unused_access_keys_days <= 45``.
+
+    Operators:
+    - ``lte``/``gte``/``eq``: scalar comparisons (e.g. a max-age or min-retention
+      threshold, or a boolean toggle).
+    - ``in``: the applied scalar must be one of ``Value`` (a list).
+    - ``subset``: the applied list must be a subset of ``Value`` — for allowlist
+      configs (e.g. ``recommended_minimal_tls_versions``); widening the allowlist
+      with a weaker value (e.g. TLS ``1.0``) breaks the constraint.
+    - ``superset``: the applied list must be a superset of ``Value`` — for
+      denylist configs (e.g. ``insecure_key_algorithms``); removing a forbidden
+      value from the denylist breaks the constraint.
+    """
+
+    Check: str
+    ConfigKey: str
+    Operator: Literal["lte", "gte", "eq", "in", "subset", "superset"]
+    # ``bool`` must precede ``int`` so pydantic v1 keeps booleans (e.g. a
+    # ``mute_non_default_regions == false`` constraint) instead of coercing
+    # them to 0/1.
+    Value: Union[bool, int, float, str, list]
+
+
 # TODO: move this to compliance folder
 class Compliance_Requirement(BaseModel):
    """Compliance_Requirement holds the base model for every requirement within a compliance framework"""
@@ -329,6 +357,7 @@ class Compliance_Requirement(BaseModel):
        ]
    ]
    Checks: list[str]
+    ConfigRequirements: Optional[list[Compliance_Requirement_ConfigConstraint]] = None


 class Compliance(BaseModel):
@@ -701,6 +730,7 @@ class UniversalComplianceRequirement(BaseModel):
    name: Optional[str] = None
    attributes: dict = Field(default_factory=dict)
    checks: dict[str, list[str]] = Field(default_factory=dict)
+    config_requirements: Optional[list[dict]] = None
    tactics: Optional[list] = None
    sub_techniques: Optional[list] = None
    platforms: Optional[list] = None
@@ -913,6 +943,11 @@ def adapt_legacy_to_universal(legacy: Compliance) -> ComplianceFramework:
                attrs = req.Attributes[0].dict()
            else:
                attrs = {}
+            config_requirements = (
+                [c.dict() for c in req.ConfigRequirements]
+                if getattr(req, "ConfigRequirements", None)
+                else None
+            )
            universal_requirements.append(
                UniversalComplianceRequirement(
                    id=req.Id,
@@ -920,6 +955,7 @@ def adapt_legacy_to_universal(legacy: Compliance) -> ComplianceFramework:
                    name=req.Name,
                    attributes=attrs,
                    checks=req_checks,
+                    config_requirements=config_requirements,
                )
            )

@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_asd_essential_eight_table(
@@ -24,6 +29,10 @@ def get_asd_essential_eight_table(
    muted_count = []
    section_seen = {}
    provider = ""
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -31,6 +40,14 @@ def get_asd_essential_eight_table(
            if compliance.Framework == "ASD-Essential-Eight":
                provider = compliance.Provider
                for requirement in compliance.Requirements:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: treat the finding as FAIL.
+                    config_status = resolve_requirement_config_status(
+                        requirement, audit_config, config_status_cache
+                    )
+                    effective_status = get_effective_status(
+                        finding.status, config_status
+                    )
                    for attribute in requirement.Attributes:
                        section = attribute.Section
                        if section not in sections:
@@ -45,10 +62,10 @@ def get_asd_essential_eight_table(
                        if finding.muted:
                            if index not in muted_count:
                                muted_count.append(index)
-                        elif finding.status == "FAIL":
+                        elif effective_status == "FAIL":
                            if index not in fail_count:
                                fail_count.append(index)
-                        elif finding.status == "PASS":
+                        elif effective_status == "PASS":
                            if index not in pass_count:
                                pass_count.append(index)

@@ -58,9 +75,9 @@ def get_asd_essential_eight_table(
                            section_seen[section].add(index)
                            if finding.muted:
                                sections[section]["Muted"] += 1
-                            elif finding.status == "FAIL":
+                            elif effective_status == "FAIL":
                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS":
+                            elif effective_status == "PASS":
                                sections[section]["PASS"] += 1

    sections = dict(sorted(sections.items()))
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.asd_essential_eight.models import (
    ASDEssentialEightAWSModel,
@@ -36,10 +40,22 @@ class ASDEssentialEightAWS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = ASDEssentialEightAWSModel(
                            Provider=finding.provider,
@@ -63,8 +79,8 @@ class ASDEssentialEightAWS(ComplianceOutput):
                            Requirements_Attributes_AuditProcedure=attribute.AuditProcedure,
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.aws_well_architected.models import (
    AWSWellArchitectedModel,
@@ -36,10 +40,21 @@ class AWSWellArchitected(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AWSWellArchitectedModel(
                            Provider=finding.provider,
@@ -58,8 +73,8 @@ class AWSWellArchitected(ComplianceOutput):
                            Requirements_Attributes_AssessmentMethod=attribute.AssessmentMethod,
                            Requirements_Attributes_Description=attribute.Description,
                            Requirements_Attributes_ImplementationGuidanceUrl=attribute.ImplementationGuidanceUrl,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_c5_table(
@@ -24,6 +29,10 @@ def get_c5_table(
    sections = {}
    section_seen = {}
    provider = ""
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -31,6 +40,14 @@ def get_c5_table(
            if compliance.Framework == "C5":
                provider = compliance.Provider
                for requirement in compliance.Requirements:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: treat the finding as FAIL.
+                    config_status = resolve_requirement_config_status(
+                        requirement, audit_config, config_status_cache
+                    )
+                    effective_status = get_effective_status(
+                        finding.status, config_status
+                    )
                    for attribute in requirement.Attributes:
                        section = attribute.Section

@@ -42,10 +59,10 @@ def get_c5_table(
                        if finding.muted:
                            if index not in muted_count:
                                muted_count.append(index)
-                        elif finding.status == "FAIL":
+                        elif effective_status == "FAIL":
                            if index not in fail_count:
                                fail_count.append(index)
-                        elif finding.status == "PASS":
+                        elif effective_status == "PASS":
                            if index not in pass_count:
                                pass_count.append(index)

@@ -55,9 +72,9 @@ def get_c5_table(
                            section_seen[section].add(index)
                            if finding.muted:
                                sections[section]["Muted"] += 1
-                            elif finding.status == "FAIL":
+                            elif effective_status == "FAIL":
                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS":
+                            elif effective_status == "PASS":
                                sections[section]["PASS"] += 1

    sections = dict(sorted(sections.items()))
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.c5.models import AWSC5Model
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,22 @@ class AWSC5(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AWSC5Model(
                            Provider=finding.provider,
@@ -52,8 +68,8 @@ class AWSC5(ComplianceOutput):
                            Requirements_Attributes_Type=attribute.Type,
                            Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
                            Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.c5.models import AzureC5Model
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,22 @@ class AzureC5(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AzureC5Model(
                            Provider=finding.provider,
@@ -52,8 +68,8 @@ class AzureC5(ComplianceOutput):
                            Requirements_Attributes_Type=attribute.Type,
                            Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
                            Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.c5.models import GCPC5Model
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,22 @@ class GCPC5(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GCPC5Model(
                            Provider=finding.provider,
@@ -52,8 +68,8 @@ class GCPC5(ComplianceOutput):
                            Requirements_Attributes_Type=attribute.Type,
                            Requirements_Attributes_AboutCriteria=attribute.AboutCriteria,
                            Requirements_Attributes_ComplementaryCriteria=attribute.ComplementaryCriteria,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_ccc_table(
@@ -24,6 +29,10 @@ def get_ccc_table(
    sections = {}
    section_seen = {}
    provider = ""
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -31,6 +40,14 @@ def get_ccc_table(
            if compliance.Framework == "CCC":
                provider = compliance.Provider
                for requirement in compliance.Requirements:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: treat the finding as FAIL.
+                    config_status = resolve_requirement_config_status(
+                        requirement, audit_config, config_status_cache
+                    )
+                    effective_status = get_effective_status(
+                        finding.status, config_status
+                    )
                    for attribute in requirement.Attributes:
                        section = attribute.Section

@@ -42,10 +59,10 @@ def get_ccc_table(
                        if finding.muted:
                            if index not in muted_count:
                                muted_count.append(index)
-                        elif finding.status == "FAIL":
+                        elif effective_status == "FAIL":
                            if index not in fail_count:
                                fail_count.append(index)
-                        elif finding.status == "PASS":
+                        elif effective_status == "PASS":
                            if index not in pass_count:
                                pass_count.append(index)

@@ -55,9 +72,9 @@ def get_ccc_table(
                            section_seen[section].add(index)
                            if finding.muted:
                                sections[section]["Muted"] += 1
-                            elif finding.status == "FAIL":
+                            elif effective_status == "FAIL":
                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS":
+                            elif effective_status == "PASS":
                                sections[section]["PASS"] += 1

    sections = dict(sorted(sections.items()))
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.ccc.models import CCC_AWSModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,22 @@ class CCC_AWS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = CCC_AWSModel(
                            Provider=finding.provider,
@@ -56,8 +72,8 @@ class CCC_AWS(ComplianceOutput):
                            Requirements_Attributes_Recommendation=attribute.Recommendation,
                            Requirements_Attributes_SectionThreatMappings=attribute.SectionThreatMappings,
                            Requirements_Attributes_SectionGuidelineMappings=attribute.SectionGuidelineMappings,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.ccc.models import CCC_AzureModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,22 @@ class CCC_Azure(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = CCC_AzureModel(
                            Provider=finding.provider,
@@ -56,8 +72,8 @@ class CCC_Azure(ComplianceOutput):
                            Requirements_Attributes_Recommendation=attribute.Recommendation,
                            Requirements_Attributes_SectionThreatMappings=attribute.SectionThreatMappings,
                            Requirements_Attributes_SectionGuidelineMappings=attribute.SectionGuidelineMappings,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.ccc.models import CCC_GCPModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,22 @@ class CCC_GCP(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = CCC_GCPModel(
                            Provider=finding.provider,
@@ -56,8 +72,8 @@ class CCC_GCP(ComplianceOutput):
                            Requirements_Attributes_Recommendation=attribute.Recommendation,
                            Requirements_Attributes_SectionThreatMappings=attribute.SectionThreatMappings,
                            Requirements_Attributes_SectionGuidelineMappings=attribute.SectionGuidelineMappings,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_cis_table(
@@ -26,6 +31,10 @@ def get_cis_table(
    pass_count = []
    fail_count = []
    muted_count = []
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -34,6 +43,14 @@ def get_cis_table(
            if compliance.Framework == "CIS" and version_in_name in compliance.Version:
                provider = compliance.Provider
                for requirement in compliance.Requirements:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: treat the finding as FAIL.
+                    config_status = resolve_requirement_config_status(
+                        requirement, audit_config, config_status_cache
+                    )
+                    effective_status = get_effective_status(
+                        finding.status, config_status
+                    )
                    for attribute in requirement.Attributes:
                        section = attribute.Section
                        # Check if Section exists
@@ -59,9 +76,9 @@ def get_cis_table(
                                section_muted_seen[section].add(index)
                                sections[section]["Muted"] += 1
                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                            if effective_status == "FAIL" and index not in fail_count:
                                fail_count.append(index)
-                            elif finding.status == "PASS" and index not in pass_count:
+                            elif effective_status == "PASS" and index not in pass_count:
                                pass_count.append(index)
                        if "Level 1" in attribute.Profile:
                            if (
@@ -69,7 +86,7 @@ def get_cis_table(
                                and index not in section_split_seen[section]["Level 1"]
                            ):
                                section_split_seen[section]["Level 1"].add(index)
-                                if finding.status == "FAIL":
+                                if effective_status == "FAIL":
                                    sections[section]["Level 1"]["FAIL"] += 1
                                else:
                                    sections[section]["Level 1"]["PASS"] += 1
@@ -79,7 +96,7 @@ def get_cis_table(
                                and index not in section_split_seen[section]["Level 2"]
                            ):
                                section_split_seen[section]["Level 2"].add(index)
-                                if finding.status == "FAIL":
+                                if effective_status == "FAIL":
                                    sections[section]["Level 2"]["FAIL"] += 1
                                else:
                                    sections[section]["Level 2"]["PASS"] += 1
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import AlibabaCloudCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class AlibabaCloudCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AlibabaCloudCISModel(
                            Provider=finding.provider,
@@ -59,8 +74,8 @@ class AlibabaCloudCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import AWSCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,24 @@ class AWSCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # The applied config is scan-global (the provider's audit_config), so
+        # evaluate each requirement's config constraints once against it.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: force FAIL regardless of the
+                    # finding's own status.
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AWSCISModel(
                            Provider=finding.provider,
@@ -59,8 +77,8 @@ class AWSCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import AzureCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class AzureCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AzureCISModel(
                            Provider=finding.provider,
@@ -59,8 +74,8 @@ class AzureCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import GCPCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class GCPCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GCPCISModel(
                            Provider=finding.provider,
@@ -58,8 +73,8 @@ class GCPCIS(ComplianceOutput):
                            Requirements_Attributes_AuditProcedure=attribute.AuditProcedure,
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import GithubCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class GithubCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GithubCISModel(
                            Provider=finding.provider,
@@ -58,8 +73,8 @@ class GithubCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_References=attribute.References,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import GoogleWorkspaceCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class GoogleWorkspaceCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GoogleWorkspaceCISModel(
                            Provider=finding.provider,
@@ -58,8 +73,8 @@ class GoogleWorkspaceCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import KubernetesCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class KubernetesCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = KubernetesCISModel(
                            Provider=finding.provider,
@@ -59,8 +74,8 @@ class KubernetesCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_References=attribute.References,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import M365CISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class M365CIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = M365CISModel(
                            Provider=finding.provider,
@@ -59,8 +74,8 @@ class M365CIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cis.models import OracleCloudCISModel
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
@@ -34,10 +38,21 @@ class OracleCloudCIS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = OracleCloudCISModel(
                            Provider=finding.provider,
@@ -59,8 +74,8 @@ class OracleCloudCIS(ComplianceOutput):
                            Requirements_Attributes_AdditionalInformation=attribute.AdditionalInformation,
                            Requirements_Attributes_DefaultValue=attribute.DefaultValue,
                            Requirements_Attributes_References=attribute.References,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.cisa_scuba.models import (
    GoogleWorkspaceCISASCuBAModel,
@@ -36,10 +40,21 @@ class GoogleWorkspaceCISASCuBA(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GoogleWorkspaceCISASCuBAModel(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class GoogleWorkspaceCISASCuBA(ComplianceOutput):
                            Requirements_Attributes_SubSection=attribute.SubSection,
                            Requirements_Attributes_Service=attribute.Service,
                            Requirements_Attributes_Type=attribute.Type,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_ens_table(
@@ -28,6 +33,10 @@ def get_ens_table(
    pass_count = []
    fail_count = []
    muted_count = []
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -35,6 +44,14 @@ def get_ens_table(
            if compliance.Framework == "ENS":
                provider = compliance.Provider
                for requirement in compliance.Requirements:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: treat the finding as FAIL.
+                    config_status = resolve_requirement_config_status(
+                        requirement, audit_config, config_status_cache
+                    )
+                    effective_status = get_effective_status(
+                        finding.status, config_status
+                    )
                    for attribute in requirement.Attributes:
                        marco_categoria = f"{attribute.Marco}/{attribute.Categoria}"
                        # Check if Marco/Categoria exists
@@ -58,7 +75,7 @@ def get_ens_table(
                                marco_muted_seen[marco_categoria].add(index)
                                marcos[marco_categoria]["Muted"] += 1
                        else:
-                            if finding.status == "FAIL":
+                            if effective_status == "FAIL":
                                if attribute.Tipo != "recomendacion":
                                    if index not in fail_count:
                                        fail_count.append(index)
@@ -67,7 +84,7 @@ def get_ens_table(
                                    marcos[marco_categoria][
                                        "Estado"
                                    ] = f"{Fore.RED}NO CUMPLE{Style.RESET_ALL}"
-                            elif finding.status == "PASS" and index not in pass_count:
+                            elif effective_status == "PASS" and index not in pass_count:
                                pass_count.append(index)
                        if attribute.Nivel == "opcional":
                            marcos[marco_categoria]["Opcional"] += 1
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.ens.models import AWSENSModel
@@ -34,10 +38,22 @@ class AWSENS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AWSENSModel(
                            Provider=finding.provider,
@@ -60,8 +76,8 @@ class AWSENS(ComplianceOutput):
                            Requirements_Attributes_Dependencias=",".join(
                                attribute.Dependencias
                            ),
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.ens.models import AzureENSModel
@@ -34,10 +38,22 @@ class AzureENS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AzureENSModel(
                            Provider=finding.provider,
@@ -60,8 +76,8 @@ class AzureENS(ComplianceOutput):
                            Requirements_Attributes_Dependencias=",".join(
                                attribute.Dependencias
                            ),
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.ens.models import GCPENSModel
@@ -34,10 +38,22 @@ class GCPENS(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GCPENSModel(
                            Provider=finding.provider,
@@ -60,8 +76,8 @@ class GCPENS(ComplianceOutput):
                            Requirements_Attributes_Dependencias=",".join(
                                attribute.Dependencias
                            ),
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.generic.models import GenericComplianceModel
@@ -35,11 +39,27 @@ class GenericCompliance(ComplianceOutput):
            - None
        """

+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks ran
+        # with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        def compliance_row(requirement, attribute, finding=None):
            # Read attribute fields defensively: GenericCompliance is the
            # last-resort renderer for any framework, and provider-specific
            # schemas (e.g. CIS, ENS, ISO27001) do not declare the universal
            # Section/SubSection/SubGroup/Service/Type/Comment fields.
+            status, status_extended = (
+                apply_config_status(
+                    finding.status,
+                    finding.status_extended,
+                    requirement_config_status.get(requirement.Id),
+                )
+                if finding
+                else ("MANUAL", "Manual check")
+            )
            return GenericComplianceModel(
                Provider=(finding.provider if finding else compliance.Provider.lower()),
                Description=compliance.Description,
@@ -56,8 +76,8 @@ class GenericCompliance(ComplianceOutput):
                Requirements_Attributes_Service=getattr(attribute, "Service", None),
                Requirements_Attributes_Type=getattr(attribute, "Type", None),
                Requirements_Attributes_Comment=getattr(attribute, "Comment", None),
-                Status=finding.status if finding else "MANUAL",
-                StatusExtended=(finding.status_extended if finding else "Manual check"),
+                Status=status,
+                StatusExtended=status_extended,
                ResourceId=finding.resource_uid if finding else "manual_check",
                ResourceName=finding.resource_name if finding else "Manual check",
                CheckId=finding.check_id if finding else "manual",
@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_generic_compliance_table(
@@ -15,6 +20,10 @@ def get_generic_compliance_table(
    pass_count = []
    fail_count = []
    muted_count = []
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -25,13 +34,28 @@ def get_generic_compliance_table(
                and compliance.Version in compliance_framework.upper()
                and compliance.Provider.upper() in compliance_framework.upper()
            ):
+                # A requirement whose configurable checks ran with an invalid
+                # config can't be trusted: treat the finding as FAIL if any of
+                # the requirements it maps to has an invalid config.
+                effective_status = finding.status
+                for requirement in compliance.Requirements:
+                    if finding.check_id in requirement.Checks:
+                        config_status = resolve_requirement_config_status(
+                            requirement, audit_config, config_status_cache
+                        )
+                        if (
+                            get_effective_status(finding.status, config_status)
+                            == "FAIL"
+                        ):
+                            effective_status = "FAIL"
+                            break
                if finding.muted:
                    if index not in muted_count:
                        muted_count.append(index)
                else:
-                    if finding.status == "FAIL" and index not in fail_count:
+                    if effective_status == "FAIL" and index not in fail_count:
                        fail_count.append(index)
-                    elif finding.status == "PASS" and index not in pass_count:
+                    elif effective_status == "PASS" and index not in pass_count:
                        pass_count.append(index)
    if (
        len(fail_count) + len(pass_count) + len(muted_count) > 1
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.iso27001.models import AWSISO27001Model
@@ -34,10 +38,21 @@ class AWSISO27001(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AWSISO27001Model(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class AWSISO27001(ComplianceOutput):
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
                            Requirements_Attributes_Check_Summary=attribute.Check_Summary,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            CheckId=finding.check_id,
                            Muted=finding.muted,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.iso27001.models import AzureISO27001Model
@@ -34,10 +38,21 @@ class AzureISO27001(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AzureISO27001Model(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class AzureISO27001(ComplianceOutput):
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
                            Requirements_Attributes_Check_Summary=attribute.Check_Summary,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            CheckId=finding.check_id,
                            Muted=finding.muted,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.iso27001.models import GCPISO27001Model
@@ -34,10 +38,21 @@ class GCPISO27001(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = GCPISO27001Model(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class GCPISO27001(ComplianceOutput):
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
                            Requirements_Attributes_Check_Summary=attribute.Check_Summary,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            CheckId=finding.check_id,
                            Muted=finding.muted,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.iso27001.models import KubernetesISO27001Model
@@ -34,10 +38,21 @@ class KubernetesISO27001(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = KubernetesISO27001Model(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class KubernetesISO27001(ComplianceOutput):
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
                            Requirements_Attributes_Check_Summary=attribute.Check_Summary,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            CheckId=finding.check_id,
                            Muted=finding.muted,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.iso27001.models import M365ISO27001Model
@@ -34,10 +38,21 @@ class M365ISO27001(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = M365ISO27001Model(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class M365ISO27001(ComplianceOutput):
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
                            Requirements_Attributes_Check_Summary=attribute.Check_Summary,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            CheckId=finding.check_id,
                            Muted=finding.muted,
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.iso27001.models import NHNISO27001Model
@@ -34,10 +38,21 @@ class NHNISO27001(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = NHNISO27001Model(
                            Provider=finding.provider,
@@ -52,8 +67,8 @@ class NHNISO27001(ComplianceOutput):
                            Requirements_Attributes_Objetive_ID=attribute.Objetive_ID,
                            Requirements_Attributes_Objetive_Name=attribute.Objetive_Name,
                            Requirements_Attributes_Check_Summary=attribute.Check_Summary,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            CheckId=finding.check_id,
                            Muted=finding.muted,
@@ -2,6 +2,11 @@ from colorama import Fore, Style
 from tabulate import tabulate

 from prowler.config.config import orange_color
+from prowler.lib.check.compliance_config_eval import (
+    get_effective_status,
+    get_scan_audit_config,
+    resolve_requirement_config_status,
+)


 def get_kisa_ismsp_table(
@@ -25,6 +30,10 @@ def get_kisa_ismsp_table(
    pass_count = []
    fail_count = []
    muted_count = []
+    # The applied config is scan-global (the provider's audit_config). Evaluate
+    # each requirement's config constraints once against it (memoised by Id).
+    audit_config = get_scan_audit_config()
+    config_status_cache = {}
    for index, finding in enumerate(findings):
        check = bulk_checks_metadata[finding.check_metadata.CheckID]
        check_compliances = check.Compliance
@@ -35,6 +44,14 @@ def get_kisa_ismsp_table(
            ):
                provider = compliance.Provider
                for requirement in compliance.Requirements:
+                    # A requirement whose configurable checks ran with an invalid
+                    # config can't be trusted: treat the finding as FAIL.
+                    config_status = resolve_requirement_config_status(
+                        requirement, audit_config, config_status_cache
+                    )
+                    effective_status = get_effective_status(
+                        finding.status, config_status
+                    )
                    for attribute in requirement.Attributes:
                        section = attribute.Section
                        # Check if Section exists
@@ -52,10 +69,10 @@ def get_kisa_ismsp_table(
                        if finding.muted:
                            if index not in muted_count:
                                muted_count.append(index)
-                        elif finding.status == "FAIL":
+                        elif effective_status == "FAIL":
                            if index not in fail_count:
                                fail_count.append(index)
-                        elif finding.status == "PASS":
+                        elif effective_status == "PASS":
                            if index not in pass_count:
                                pass_count.append(index)

@@ -65,9 +82,9 @@ def get_kisa_ismsp_table(
                            section_seen[section].add(index)
                            if finding.muted:
                                sections[section]["Muted"] += 1
-                            elif finding.status == "FAIL":
+                            elif effective_status == "FAIL":
                                sections[section]["Status"]["FAIL"] += 1
-                            elif finding.status == "PASS":
+                            elif effective_status == "PASS":
                                sections[section]["Status"]["PASS"] += 1

    # Add results to table
@@ -1,4 +1,8 @@
 from prowler.config.config import timestamp
+from prowler.lib.check.compliance_config_eval import (
+    apply_config_status,
+    build_requirement_config_status,
+)
 from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
 from prowler.lib.outputs.compliance.kisa_ismsp.models import AWSKISAISMSPModel
@@ -34,10 +38,22 @@ class AWSKISAISMSP(ComplianceOutput):
        Returns:
            - None
        """
+        # Evaluate each requirement's config constraints once against the
+        # scan-global applied config; a requirement whose configurable checks
+        # ran with a config too loose to trust is forced to FAIL.
+        requirement_config_status = build_requirement_config_status(
+            compliance.Requirements
+        )
+
        for finding in findings:
            for requirement in compliance.Requirements:
                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
                if finding.check_id in requirement.Checks:
+                    row_status, row_status_extended = apply_config_status(
+                        finding.status,
+                        finding.status_extended,
+                        requirement_config_status.get(requirement.Id),
+                    )
                    for attribute in requirement.Attributes:
                        compliance_row = AWSKISAISMSPModel(
                            Provider=finding.provider,
@@ -55,8 +71,8 @@ class AWSKISAISMSP(ComplianceOutput):
                            Requirements_Attributes_RelatedRegulations=attribute.RelatedRegulations,
                            Requirements_Attributes_AuditEvidence=attribute.AuditEvidence,
                            Requirements_Attributes_NonComplianceCases=attribute.NonComplianceCases,
-                            Status=finding.status,
-                            StatusExtended=finding.status_extended,
+                            Status=row_status,
+                            StatusExtended=row_status_extended,
                            ResourceId=finding.resource_uid,
                            ResourceName=finding.resource_name,
                            CheckId=finding.check_id,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
pedrooot	7f249360c2	chore(changelog): update with latest changes	2026-06-23 12:14:27 +02:00
pedrooot	8050797233	chore: merge master	2026-06-23 11:12:35 +02:00
pedrooot	edcffcaf44	feat(config): add compliance guardrails for the SDK config	2026-06-23 10:54:57 +02:00
pedrooot	ff7ec1f8b3	chore(revision): solve comments	2026-06-18 13:13:11 +02:00
pedrooot	1673bdf0a6	chore(revision): solve comments	2026-06-18 13:04:44 +02:00
pedrooot	510da0154a	chore(merge): master	2026-06-09 17:59:00 +02:00
pedrooot	88926cc052	chore(changelog): update with latest changes	2026-06-09 16:40:20 +02:00
pedrooot	ed17dc4b09	feat(sdk): scan configuration schema and validation for Prowler Cloud	2026-06-09 16:34:37 +02:00
Pepe Fagoaga	1a450aaa70	feat(config): add SDK config's validator	2026-05-13 08:04:13 +02:00