Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
ecs_task_definitions_containers_readonly_access
Amazon ECS task definitions specify whether container root filesystems are read-only via readonlyRootFilesystem. Containers where this setting is absent or set to false effectively have write access to the root filesystem.
ecs_task_definitions_host_namespace_not_shared
ECS task definitions where pidMode is host are configured to share the host's process namespace with containers, rather than using isolated task or private namespaces.
ecs_task_definitions_host_networking_mode_users
Amazon ECS task definitions in host network mode are assessed for containers where privileged=false and the container user is root or unset.
ecs_task_definitions_logging_block_mode
ECS task definition containers use non-blocking logging mode via the logConfiguration.mode option on the latest active revision
ecs_task_definitions_logging_enabled
Amazon ECS task definition containers specify a logging configuration with a non-null logDriver for every container in the latest active revision.
ecs_task_definitions_no_environment_secrets
ECS task definitions are analyzed for plaintext secrets placed in container environment variables. It identifies values that resemble credentials (keys, tokens, passwords) within container definitions.
ecs_task_definitions_no_privileged_containers
Amazon ECS task definitions are evaluated for containers configured with privileged mode (privileged: true).
The outcome indicates whether any container definition enables this setting.
ecs_task_set_no_assign_public_ip
ECS task sets are assessed for automatic public IP assignment via AssignPublicIP. When set to ENABLED, tasks are given public addresses in their network configuration.
efs_access_point_enforce_root_directory
Amazon EFS access points are evaluated to ensure they enforce a non-root directory. The check identifies access points whose configured root directory Path is /, meaning clients would mount the file system's root instead of a scoped subdirectory.
efs_access_point_enforce_user_identity
Amazon EFS access points are evaluated for a defined POSIX user (uid, gid, optional secondary groups). The check inspects each access point on a file system and flags those without a configured POSIX user identity.
efs_encryption_at_rest_enabled
Amazon EFS file system has encryption at rest enabled using AWS KMS to protect file data and metadata stored on the service
efs_have_backup_enabled
Amazon EFS file systems are assessed for automated backups configured via the backup policy. The finding highlights file systems where backups are not enabled or are being disabled.
efs_mount_target_not_publicly_accessible
EFS mount targets associated with VPC subnets that auto-assign public IPv4 addresses (mapPublicIpOnLaunch=true) are identified per file system.
The evaluation focuses on the subnet attribute linked to each mount target.
efs_multi_az_enabled
Amazon EFS file systems are assessed for multi-AZ resilience: Regional type (no availability_zone_id) with mount targets in more than one Availability Zone. Single-AZ (One Zone) or Regional with only one mount target is identified for attention.
efs_not_publicly_accessible
Amazon EFS file system policy is assessed for public or VPC-wide access. Policies with broad Principal values or that permit any client in the VPC without the elasticfilesystem:AccessedViaMountTarget condition are identified.
An absent or empty policy is treated as open to VPC clients.
eks_cluster_deletion_protection_enabled
Amazon EKS clusters have deletion protection enabled blocking cluster removal until protection is explicitly disabled.
eks_cluster_kms_cmk_encryption_in_secrets_enabled
Amazon EKS clusters configure AWS KMS envelope encryption so Kubernetes Secrets are stored in etcd as ciphertext at rest.
eks_cluster_network_policy_enabled
Amazon EKS clusters are evaluated for pod-level network isolation via Kubernetes NetworkPolicy, indicating whether traffic between pods and namespaces is restricted according to defined rules.
eks_cluster_not_publicly_accessible
Amazon EKS cluster API server endpoint is evaluated for unrestricted Internet access, specifically when the public endpoint permits connections from 0.0.0.0/0 instead of private access or limited CIDR ranges.
eks_cluster_private_nodes_enabled
Amazon EKS cluster has private endpoint access enabled for the Kubernetes API server, allowing control plane traffic to use a VPC-resolved private endpoint.
The check evaluates the cluster's endpointPrivateAccess setting.
eks_cluster_uses_a_supported_version
Amazon EKS clusters use a supported Kubernetes version at or above the defined baseline (e.g., 1.28+). The evaluation compares each cluster's Kubernetes minor version to the minimum supported level and highlights clusters running below that baseline.
eks_cluster_vpc_cni_network_policy_enforced
Amazon EKS clusters are evaluated for whether the Amazon VPC CNI managed add-on sets enableNetworkPolicy to true, which is what makes the CNI enforce Kubernetes NetworkPolicy resources. The policy objects themselves live in the cluster and are not exposed by the EKS API, so only this enforcement precondition is verified.
eks_control_plane_logging_all_types_enabled
Amazon EKS clusters are evaluated for control plane logging coverage of required types: api, audit, authenticator, controllerManager, scheduler.
The finding identifies clusters where any of these log types are not configured.
elasticache_cluster_uses_public_subnet
ElastiCache resources (Redis nodes and Memcached clusters) are assessed for placement in public subnets.
The finding identifies cache subnet groups that include subnets configured with Internet routing instead of private-only subnets.