Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
elasticache_redis_cluster_automatic_failover_enabled
Amazon ElastiCache (Redis OSS) replication groups have automatic failover set to enabled, allowing a replica to be promoted when the primary becomes unavailable
elasticache_redis_cluster_auto_minor_version_upgrades
ElastiCache for Redis replication groups are configured to apply automatic minor engine upgrades using AutoMinorVersionUpgrade
elasticache_redis_cluster_backup_enabled
Amazon ElastiCache Redis replication groups have automated snapshot backups enabled with a retention period of at least 7 days.
The evaluation focuses on whether backups are enabled and the configured retention meets the minimum threshold.
elasticache_redis_cluster_in_transit_encryption_enabled
ElastiCache for Redis replication groups have in-transit encryption (TLS) enabled for client and inter-node traffic (TransitEncryptionEnabled=true).
elasticache_redis_cluster_multi_az_enabled
ElastiCache for Redis replication groups have Multi-AZ automatic failover enabled, distributing primary and replicas across distinct Availability Zones
elasticache_redis_cluster_rest_encryption_enabled
ElastiCache for Redis replication groups are evaluated for encryption at rest of on-disk cache data and backups. The finding pinpoints groups where this protection is not enabled.
elasticache_redis_replication_group_auth_enabled
Amazon ElastiCache Redis replication groups running versions prior to 6.0 are evaluated for the use of AUTH tokens. For 6.0+, the finding indicates ACL/RBAC configuration should be reviewed instead of token-based AUTH.
elasticbeanstalk_environment_cloudwatch_logging_enabled
Elastic Beanstalk environments are configured to stream instance and proxy logs to Amazon CloudWatch Logs via the StreamLogs setting
elasticbeanstalk_environment_enhanced_health_reporting
Elastic Beanstalk environments have health reporting set to enhanced instead of basic.
elasticbeanstalk_environment_managed_updates_enabled
Elastic Beanstalk environments with managed platform updates enabled (ManagedActionsEnabled: true) automatically apply platform patch/minor updates during a scheduled maintenance window.
elasticbeanstalk_environment_no_secrets_in_configuration
AWS Elastic Beanstalk environments are inspected for hardcoded secrets in configuration option settings. Secrets such as API keys, passwords, access tokens, or credentials should not be stored in environment configuration.
elb_connection_draining_enabled
Classic Load Balancer has connection draining enabled, so deregistering or unhealthy instances stop receiving new requests while existing connections are allowed to complete within the configured drain window.
elb_cross_zone_load_balancing_enabled
Classic Load Balancer with cross-zone load balancing distributes requests across registered targets in all enabled Availability Zones.
This evaluates whether that setting is enabled, instead of restricting distribution to targets within only the same zone.
elb_desync_mitigation_mode
Classic Load Balancer desync_mitigation_mode is evaluated to determine whether it is configured as defensive or strictest. Any other mode (such as monitor) is identified for attention.
Elastic Load Balancer HTTPS listeners are assessed for use of a strong TLS policy. Listeners associated with ELBSecurityPolicy-TLS-1-2-2017-01 are considered to negotiate only modern protocols and ciphers, avoiding legacy SSL/TLS and weak suites.
elb_internet_facing
Elastic Load Balancers are evaluated for the scheme to determine whether they are internet-facing or internal, indicating if the endpoint is publicly reachable via a public DNS name.
elb_is_in_multiple_az
Classic Load Balancer spans at least the configured number of Availability Zones.
The evaluation identifies load balancers enabled in fewer AZs than the specified minimum.
elb_logging_enabled
Elastic Load Balancers have access logs configured to deliver request metadata (client IPs, paths, status, TLS details) to Amazon S3
elb_ssl_listeners
Elastic Load Balancers are assessed for client-facing listener protocols. Only HTTPS or SSL are considered encrypted; any HTTP or TCP listener indicates plaintext between clients and the load balancer.
elb_ssl_listeners_use_acm_certificate
Classic Load Balancer HTTPS/SSL listeners use AWS Certificate Manager certificates that are Amazon-issued (certificate type AMAZON_ISSUED).
elbv2_alb_drop_invalid_header_fields_enabled
Ensure that Application Load Balancers (ALB) are configured to drop invalid HTTP header fields. The check fails when routing.http.drop_invalid_header_fields.enabled is not set to true. By default, ALBs do not remove HTTP headers that do not conform to RFC 7230.
elbv2_cross_zone_load_balancing_enabled
Network and Gateway Load Balancers have cross-zone load balancing enabled (load_balancing.cross_zone.enabled), so each node distributes requests to targets in all enabled Availability Zones rather than only its own.
elbv2_deletion_protection
ELBv2 load balancers with deletion protection (deletion_protection.enabled) are resistant to deletion through standard APIs.
The assessment determines whether this attribute is enabled on each load balancer.
Application Load Balancer settings are reviewed for HTTP desync protections. It evaluates routing.http.desync_mitigation_mode for strictest or defensive; when neither is configured, it checks routing.http.drop_invalid_header_fields.enabled is true as a compensating control.