mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-03-21 18:58:04 +00:00
101 lines
3.0 KiB
YAML
101 lines
3.0 KiB
YAML
# AWS EC2 Configuration
|
||
# aws.ec2_elastic_ip_shodan
|
||
shodan_api_key: null
|
||
# aws.ec2_securitygroup_with_many_ingress_egress_rules --> by default is 50 rules
|
||
max_security_group_rules: 50
|
||
# aws.ec2_instance_older_than_specific_days --> by default is 6 months (180 days)
|
||
max_ec2_instance_age_in_days: 180
|
||
# aws.ec2_securitygroup_allow_ingress_from_internet_to_any_port
|
||
# allowed network interface types for security groups open to the Internet
|
||
ec2_allowed_interface_types:
|
||
[
|
||
"api_gateway_managed",
|
||
"vpc_endpoint",
|
||
]
|
||
# allowed network interface owners for security groups open to the Internet
|
||
ec2_allowed_instance_owners:
|
||
[
|
||
"amazon-elb"
|
||
]
|
||
|
||
# AWS VPC Configuration (vpc_endpoint_connections_trust_boundaries, vpc_endpoint_services_allowed_principals_trust_boundaries)
|
||
# AWS SSM Configuration (aws.ssm_documents_set_as_public)
|
||
# Single account environment: No action required. The AWS account number will be automatically added by the checks.
|
||
# Multi account environment: Any additional trusted account number should be added as a space separated list, e.g.
|
||
# trusted_account_ids : ["123456789012", "098765432109", "678901234567"]
|
||
trusted_account_ids: []
|
||
|
||
# AWS OpenSearch Configuration (opensearch_service_domains_not_publicly_accessible)
|
||
# Trusted IP addresses or CIDR ranges that should not be considered as public access, e.g.
|
||
# trusted_ips: ["1.2.3.4", "10.0.0.0/8"]
|
||
trusted_ips: []
|
||
|
||
# AWS Cloudwatch Configuration
|
||
# aws.cloudwatch_log_group_retention_policy_specific_days_enabled --> by default is 365 days
|
||
log_group_retention_days: 365
|
||
|
||
# AWS AppStream Session Configuration
|
||
# aws.appstream_fleet_session_idle_disconnect_timeout
|
||
max_idle_disconnect_timeout_in_seconds: 600 # 10 Minutes
|
||
# aws.appstream_fleet_session_disconnect_timeout
|
||
max_disconnect_timeout_in_seconds: 300 # 5 Minutes
|
||
# aws.appstream_fleet_maximum_session_duration
|
||
max_session_duration_seconds: 36000 # 10 Hours
|
||
|
||
# AWS Lambda Configuration
|
||
# aws.awslambda_function_using_supported_runtimes
|
||
obsolete_lambda_runtimes:
|
||
[
|
||
"java8",
|
||
"go1.x",
|
||
"provided",
|
||
"python3.6",
|
||
"python2.7",
|
||
"python3.7",
|
||
"nodejs4.3",
|
||
"nodejs4.3-edge",
|
||
"nodejs6.10",
|
||
"nodejs",
|
||
"nodejs8.10",
|
||
"nodejs10.x",
|
||
"nodejs12.x",
|
||
"nodejs14.x",
|
||
"dotnet5.0",
|
||
"dotnetcore1.0",
|
||
"dotnetcore2.0",
|
||
"dotnetcore2.1",
|
||
"dotnetcore3.1",
|
||
"ruby2.5",
|
||
"ruby2.7",
|
||
]
|
||
|
||
# AWS Organizations
|
||
# organizations_scp_check_deny_regions
|
||
# organizations_enabled_regions: [
|
||
# 'eu-central-1',
|
||
# 'eu-west-1',
|
||
# "us-east-1"
|
||
# ]
|
||
organizations_enabled_regions: []
|
||
organizations_trusted_delegated_administrators: []
|
||
|
||
# aws.rds_instance_backup_enabled
|
||
# Whether to check RDS instance replicas or not
|
||
check_rds_instance_replicas: False
|
||
|
||
# AWS ACM Configuration
|
||
# aws.acm_certificates_expiration_check
|
||
days_to_expire_threshold: 7
|
||
|
||
# AWS EKS Configuration
|
||
# aws.eks_control_plane_logging_all_types_enabled
|
||
# EKS control plane logging types that must be enabled
|
||
eks_required_log_types:
|
||
[
|
||
"api",
|
||
"audit",
|
||
"authenticator",
|
||
"controllerManager",
|
||
"scheduler",
|
||
]
|