Checks

EC2 instances are evaluated for association with an IAM instance profile role that delivers temporary credentials to workloads running on the instance

EC2 instances are assessed for the presence of a public IPv4 address and public DNS. A public IP indicates the instance is directly reachable from the Internet; no public IP implies access only through private networking paths such as load balancers, gateways, or proxies.

EC2 instance User Data is inspected for secret-like values (credentials, tokens, keys). Both plain and compressed content are parsed, honoring configured exclusions, to identify patterns that resemble sensitive material within initialization scripts.

EC2 instances in the stopped state are evaluated for how long they have remained stopped. Instances stopped beyond the configurable limit (max_ec2_instance_stopped_days, default 30) are flagged. Running, pending, and other non-stopped instances pass.

EC2 instances are evaluated for attached network adapters. It identifies instances with more than one ENI-including efa, interface, or trunk types-and distinguishes those using a single adapter.

EC2 instances launched from Amazon-owned AMIs are evaluated for the AMI's DeprecationTime; instances tied to images with a deprecation date in the past are reported as using deprecated AMIs.

EC2 launch templates are inspected for Instance Metadata Service configuration. It identifies versions where http_endpoint is enabled and http_tokens is required (IMDSv2 enforced), versions with the metadata service disabled, and versions that allow metadata without requiring tokens.

EC2 launch templates with versions that either enable associate_public_ip_address for network interfaces or reference ENIs already associated with public IPs

EC2 launch template user data is analyzed across versions to identify embedded secrets-hard-coded passwords, tokens, API keys, or private keys-within the startup scripts or configuration supplied to instances.

VPC network ACLs with inbound entries that permit traffic from 0.0.0.0/0 to any port (any protocol) are identified at the subnet boundary.

VPC network ACLs are evaluated for inbound rules that permit 0.0.0.0/0 to access SSH on TCP 22 at the subnet boundary.

VPC network ACLs with inbound rules allowing RDP on TCP 3389 from 0.0.0.0/0 are identified.

Assessment focuses on subnet-level ACL entries that permit this traffic.

VPC network ACLs that are not associated with any subnet are considered unused. The evaluation focuses on non-default ACLs and identifies those without a current subnet association; the default network ACL is excluded.

EC2 security groups with inbound rules permitting Internet sources (0.0.0.0/0, ::/0) to all ports across any protocol

EC2 security groups with internet-sourced ingress from 0.0.0.0/0 or ::/0 to any port, and their attachments, are evaluated. Groups linked to network interfaces or instance owners outside an approved list for public exposure are identified.

EC2 security groups with inbound rules allowing traffic from specific globally routable IP addresses to any port or protocol. Wildcard CIDRs (0.0.0.0/0 and ::/0) are excluded as they are covered by the related checks. This targets cases where developers add personal or third-party IPs directly to security groups.

EC2 security groups are assessed for inbound rules that allow Internet sources (0.0.0.0/0 or ::/0) to high-risk TCP ports: 25, 110, 135, 143, 445, 3000, 4333, 5000, 5500, 8080, 8088.

Findings highlight groups exposing any of these ports to the public network.

EC2 security groups are assessed for inbound SSH exposure by locating ingress rules that allow TCP 22 from the Internet (0.0.0.0/0 or ::/0).

Only groups in use are considered; sets already flagged for all-port exposure are not repeated.

EC2 security groups restrict inbound RDP on TCP 3389 to trusted sources, avoiding Internet-wide (0.0.0.0/0, ::/0) exposure.

EC2 security groups are evaluated for inbound rules that allow the Internet (0.0.0.0/0 or ::/0) to reach Cassandra ports 7199, 9160, or 8888.

Focuses on tcp rules that expose these ports to public sources.

EC2 security groups restrict public ingress to Elasticsearch/Kibana ports 9200, 9300, and 5601, denying sources 0.0.0.0/0 and ::/0

EC2 security groups are evaluated for Internet-exposed FTP: any inbound rule allowing tcp ports 20 or 21 from 0.0.0.0/0 or ::/0.

EC2 security groups are evaluated for ingress rules that expose Kafka on TCP 9092 to the Internet via 0.0.0.0/0 or ::/0

EC2 security groups are evaluated for inbound rules that permit Internet-sourced access to TCP 11211 (Memcached) from 0.0.0.0/0 or ::/0.