Checks

IAM Access Analyzer presence and status are evaluated per account and Region. An analyzer in ACTIVE state indicates continuous analysis of supported resources and IAM activity to identify external, internal, and unused access.

IAM Access Analyzer analyzers are in Active state and currently report zero Active findings within their scope of monitored resources.

AWS account contact information is current for the primary contact and the alternate contacts for security, billing, and operations, with accurate email addresses and phone numbers.

AWS account alternate contacts are defined for Security, Billing, and Operations with name, email, and phone. The finding evaluates that all three exist, are distinct from one another, and differ from the primary (root) contact.

Account settings contain a Security alternate contact in Alternate Contacts (name, EmailAddress, PhoneNumber) for targeted AWS security notifications.

[DEPRECATED] AWS account root configuration may include legacy security challenge questions for support identity verification. This evaluates whether those questions are set on the account. New configuration is discontinued by AWS and remaining support for this feature is time-limited.

ACM certificates are assessed for time to expiration against a configurable threshold. Certificates close to end of validity or already expired are surfaced, covering those attached to services and, if in scope, unused ones.

ACM-issued certificates are checked for Certificate Transparency (CT) logging being enabled. Certificates with type IMPORTED are excluded from evaluation.

ACM certificates are evaluated for the public key algorithm and size, identifying those that use weak parameters such as RSA-1024 or ECDSA P-192. Certificates using RSA-2048+ or ECDSA P-256+ meet the secure baseline.

AWS Private Certificate Authorities (Private CAs) are assessed for use of a post-quantum digital signature key algorithm (ML_DSA_44, ML_DSA_65, ML_DSA_87). CAs that still issue certificates with RSA or ECC algorithms produce signatures vulnerable to forgery once a cryptographically relevant quantum computer is available.

AWS Amplify apps and their branches are inspected for hardcoded secrets, such as API keys, tokens, or passwords embedded in environment variables or build settings (buildSpec).

API Gateway custom domain names for REST APIs are assessed for use of a post-quantum (PQ) TLS security policy such as SecurityPolicy_TLS13_1_2_PQ_2025_09. Custom domains with legacy policies such as TLS_1_0 or TLS_1_2 lack hybrid ML-KEM key exchange, leaving captured traffic vulnerable to future quantum decryption.

API Gateway REST APIs are evaluated for access control: an API-level authorizer is present, or all resource methods use an authorization mechanism. Methods marked NONE indicate unauthenticated access.

API Gateway REST API stages with caching have cache data encrypted at rest. The evaluation targets stages where caching is enabled and verifies that stored responses are protected via the Encrypt cache data setting.

API Gateway stage has a client certificate configured so HTTP/S integrations can perform mutual TLS and authenticate API Gateway to the backend

API Gateway REST API stages with stage logging enabled to emit execution or access logs to CloudWatch

Checks API Gateway REST API stage variables for hardcoded secrets such as passwords, API keys, and tokens. Stage variables should reference AWS Secrets Manager or Parameter Store rather than containing plaintext credentials.

Amazon API Gateway REST APIs are evaluated for endpoint exposure: internet-accessible endpoints versus private VPC-only access via interface VPC endpoints (AWS PrivateLink).

API Gateway REST APIs exposed to the Internet are evaluated for an attached authorizer that enforces caller identity (Lambda authorizer or Cognito user pool) on method invocations.

Focus is on whether public endpoints require authenticated requests rather than accepting anonymous calls.

API Gateway REST API stages have AWS X-Ray active tracing enabled to sample incoming requests and produce distributed traces across connected services.

Amazon API Gateway (REST API) stages are assessed for an associated AWS WAF web ACL. The finding reflects whether a web ACL is linked at the stage level.

API Gateway v2 stages have access logging configured to capture request details and deliver them to a logging destination (e.g., CloudWatch Logs or Firehose). The evaluation looks for logging being enabled at each API stage.

API Gateway v2 APIs use authorizers (JWT/Cognito or Lambda) to authenticate requests. This evaluates whether an API has an authorizer configured to control access to its routes.

Amazon AppStream fleets are assessed for the EnableDefaultInternetAccess setting, identifying fleets where streaming instances have default Internet connectivity.