Checks

IAM Access Analyzer presence and status are evaluated per account and Region. An analyzer in ACTIVE state indicates continuous analysis of supported resources and IAM activity to identify external, internal, and unused access.

IAM Access Analyzer analyzers are in Active state and currently report zero Active findings within their scope of monitored resources.

AWS account contact information is current for the primary contact and the alternate contacts for security, billing, and operations, with accurate email addresses and phone numbers.

AWS account alternate contacts are defined for Security, Billing, and Operations with name, email, and phone. The finding evaluates that all three exist, are distinct from one another, and differ from the primary (root) contact.

Account settings contain a Security alternate contact in Alternate Contacts (name, EmailAddress, PhoneNumber) for targeted AWS security notifications.

[DEPRECATED] AWS account root configuration may include legacy security challenge questions for support identity verification. This evaluates whether those questions are set on the account. New configuration is discontinued by AWS and remaining support for this feature is time-limited.

ACM certificates are assessed for time to expiration against a configurable threshold. Certificates close to end of validity or already expired are surfaced, covering those attached to services and, if in scope, unused ones.

ACM-issued certificates are checked for Certificate Transparency (CT) logging being enabled. Certificates with type IMPORTED are excluded from evaluation.

ACM certificates are evaluated for the public key algorithm and size, identifying those that use weak parameters such as RSA-1024 or ECDSA P-192. Certificates using RSA-2048+ or ECDSA P-256+ meet the secure baseline.

AWS Private Certificate Authorities (Private CAs) are assessed for use of a post-quantum digital signature key algorithm (ML_DSA_44, ML_DSA_65, ML_DSA_87). CAs that still issue certificates with RSA or ECC algorithms produce signatures vulnerable to forgery once a cryptographically relevant quantum computer is available.

Alibaba Cloud ActionTrail records API calls made to your account, including caller identity, time, source IP, request parameters, and response elements. Ensuring a multi-region trail exists guarantees that operations across all regions and global services are captured, enabling detection of unexpected activities in unused regions.

Alibaba Cloud ActionTrail logs a record of every API call made in your account and stores these log files in an OSS bucket. It is recommended that the Access Control List (ACL) of the OSS bucket used by ActionTrail is set to private to prevent unauthorized public access to sensitive audit log data.

The Additional Google services configuration disables access to external Google Groups for all users. This setting controls whether users can access groups created outside the organization from their Google Workspace account.

Microsoft 365 calendar sharing is evaluated at the organization level to determine if sharing with external recipients is disabled, including blocking anonymous access and links sent outside the tenant.

Microsoft 365 groups are assessed for their visibility setting.

The finding highlights groups configured as Public; groups set to Private align with the intended privacy posture.

Microsoft 365 organization setting indicates whether Customer Lockbox is enabled to require explicit approval for Microsoft support access to customer content

Microsoft 365 tenant password policy is configured so user passwords do not expire (never expire), meaning no time-based rotation is enforced across accounts.

Microsoft Bookings (Shared Bookings) should be turned off unless the organization has a business need for it. Bookings lets users create public booking pages so customers can schedule time with staff. It is considered compliant when it is disabled at the tenant level (BookingsEnabled) or when the default OWA mailbox policy blocks Bookings mailbox creation (BookingsMailboxCreationEnabled).

Privileged users in Microsoft 365 are evaluated for a reduced license footprint: only AAD_PREMIUM (P1) or AAD_PREMIUM_P2 (P2), or no license. Assignments that include productivity app suites indicate excess application entitlements on administrative accounts.

Count of users assigned the Global Administrator role in the Microsoft 365 tenant is between 2 and 4 (inclusive).

Linode account users are assessed for two-factor authentication (2FA) enablement. 2FA adds a second verification factor (a TOTP code or security key) on top of the password, so a stolen or guessed password alone is not enough to sign in to the Linode Cloud Manager.

Azure AI Search service limits its data-plane endpoint by disabling public network access. This evaluation checks whether the service only permits connections via private endpoints or narrowly scoped, explicitly allowed sources.

AKS clusters are evaluated for an automatic upgrade channel other than none. Automatic upgrades keep the Kubernetes control plane and node pools on supported patch/minor versions and reduce version drift across clusters.

Azure Kubernetes Service clusters are evaluated for Azure Monitor managed service for Prometheus (the cluster's azureMonitorProfile.metrics configuration). When enabled, cluster and workload metrics are collected into an Azure Monitor workspace for dashboards and alerting. This is distinct from Container Insights (the omsagent logs addon).