Checks

EC2 security groups are inspected for inbound rules that expose MongoDB on TCP 27017-27018 to the Internet via 0.0.0.0/0 or ::/0.

It identifies groups where these ports are reachable from any address.

EC2 security groups are assessed for inbound exposure of MySQL on TCP 3306 from 0.0.0.0/0 or ::/0.

The finding reflects whether this port is reachable from any IPv4 or IPv6 address.

EC2 security groups are evaluated for inbound rules that permit public sources (0.0.0.0/0 or ::/0) to TCP 1521 or TCP 2483-Oracle listener ports.

The focus is on rules that make these ports reachable from the Internet over IPv4 or IPv6.

EC2 security groups are evaluated for inbound rules that expose Postgres on TCP 5432 to the Internet. Rules permitting 0.0.0.0/0 or ::/0 to this port, or policies that open all ports publicly, are identified.

EC2 security groups permitting Internet sources (0.0.0.0/0 or ::/0) to TCP 6379 are identified, indicating Redis is reachable from public networks

EC2 security groups with inbound rules that allow Internet sources (0.0.0.0/0, ::/0) to reach Microsoft SQL Server on TCP 1433 or TCP 1434

EC2 security groups are evaluated for rules that allow inbound Telnet on TCP 23 from the Internet (0.0.0.0/0 or ::/0).

EC2 security groups with rules that permit non-RFC1918 IPv4 ranges wider than /24 are identified across both ingress and egress.

The focus is on public CIDRs (/1-/23) that broadly expose sources or destinations, not on private networks.

Default VPC security group should have no inbound or outbound rules. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.

EC2 security groups whose names include launch-wizard are identified as created by the EC2 Launch Wizard, distinguishing auto-generated groups from curated, baseline-controlled groups.

EC2 security groups, except default, are assessed for unused status: zero attached network interfaces, no AWS Lambda associations, no AWS Batch compute environment associations, and no references from other security groups.

EC2 security groups are evaluated for excessive rule counts, flagging groups where ingress or egress entries exceed the configured threshold (default 50). This targets groups with unusually large rule sets that complicate access control.

EC2 Transit Gateways with AutoAcceptSharedAttachments=enable automatically approve cross-account VPC attachments.

The evaluation identifies transit gateways configured to auto-accept shared attachments.

Amazon ECR registries with repositories are evaluated for enhanced scanning, the Amazon Inspector-powered scan type that covers operating system and programming language packages and can rescan images continuously as new CVEs are published. A registry left on basic scanning is reported as failing.

Amazon ECR registries with repositories are evaluated for automated image scanning at the registry level -- scan on push or continuous scanning -- with scan rules that cover all repositories (no restrictive filters), for either basic or enhanced scanning. A registry whose rules specify only MANUAL scanning does not scan pushed images.

Amazon ECR repositories have a lifecycle policy configured to automatically expire container images based on age, count, or tags.

Amazon ECR repositories are evaluated for public exposure via repository policies that allow anonymous principals (e.g., Principal: "*") to access the repo, including image listing, pulling, or modification.

[DEPRECATED] Amazon ECR repositories are evaluated for image scanning on push; when configured, new image uploads automatically trigger a vulnerability scan (scan_on_push).

Amazon ECR repositories are assessed on the most recent pushed image to confirm a vulnerability scan exists, completed successfully, and that no results meet or exceed the configured minimum severity (e.g., CRITICAL, HIGH, MEDIUM).

Amazon ECR repositories are assessed for image tag immutability. Repositories permitting tag updates (MUTABLE) are identified; those enforcing immutable tags (such as IMMUTABLE) are recognized.

The latest image pushed to each Amazon ECR repository is analyzed for embedded secrets: environment variables and build history (Dockerfile instructions) recorded in the image configuration, plus the file contents of every filesystem layer. Findings reference the variable, build step, or file, never the secret value.

ECS clusters have CloudWatch Container Insights configured via the containerInsights setting, accepting enabled or enhanced values to emit cluster, service, task, and container telemetry.

ECS Fargate services use the latest Fargate platform version via platformVersion=LATEST or an explicit value matching the current release for their platformFamily (Linux/Windows).

ECS services are assessed for automatic public IP assignment via the assignPublicIp setting in their network configuration.

The finding indicates whether tasks launched by the service receive a public IP or are limited to private addressing.