Checks

ELBv2 HTTPS listeners are assessed for use of strong TLS policies. Listeners whose ssl_policy is not in the approved set (TLS 1.2/1.3-focused policies) may include weak protocols or ciphers.

ELBv2 Application Load Balancers configured as internet-facing are assessed for exposure by reviewing attached security groups.

Inbound TCP rules that allow 0.0.0.0/0 or ::/0 indicate unrestricted internet reachability.

ELBv2 load balancers (Application, Network, or Gateway) are assessed for distribution across multiple Availability Zones. The finding indicates whether each load balancer spans at least the configured minimum number of AZs (default 2).

ELBv2 HTTPS and TLS listeners are assessed for use of a FIPS TLS security policy (ELBSecurityPolicy-*-FIPS-*). FIPS policies terminate TLS with the AWS-LC FIPS validated cryptographic module.

ELBv2 HTTPS and TLS listeners are assessed for use of post-quantum (PQ) TLS security policies. Listeners whose SslPolicy is not in the approved PQ set lack hybrid key exchange (ML-KEM 768 + ECDHE), which can increase harvest-now-decrypt-later exposure for recorded traffic.

ELBv2 load balancer requires at least one listener (protocol and port) to accept client connections and route requests to target groups. The finding indicates whether listeners are defined on the load balancer.

ELBv2 Application Load Balancers are evaluated for access logging enabled to Amazon S3, capturing request details such as timestamps, client IPs, paths, and response codes.

Network Load Balancers with listeners using the TLS protocol indicate TLS termination at the load balancer. The evaluation identifies NLBs that have at least one TLS listener versus those using plain TCP/UDP or deferring encryption to targets.

Application Load Balancer listeners are assessed for encrypted ingress: either only HTTPS listeners are present, or any HTTP listener redirects to HTTPS.

Application Load Balancers are evaluated for an associated AWS WAF web ACL that governs HTTP(S) requests. The evaluation detects ALBs missing a web ACL and recognizes associations from WAFv2 or regional WAF Classic.

Amazon EMR account-level Block Public Access configuration is assessed per Region. When BlockPublicSecurityGroupRules is enabled, clusters cannot use security groups that allow inbound public sources (0.0.0.0/0, ::/0) except on permitted ports.

Amazon EMR clusters in non-terminated states are assessed for public IP assignment on cluster nodes (primary and workers). The finding identifies clusters whose instances are reachable via public IPs rather than private VPC addresses.

Amazon EMR clusters are assessed for public network exposure by examining master and core/task node security groups for inbound rules that allow any source (0.0.0.0/0 or ::/0).

Only active clusters are considered, and findings identify exposure via the specific security groups attached to the cluster nodes.

EventBridge event bus has a resource policy that grants cross-account event delivery to principals outside the account, including broad or public access.

Focus is on buses whose policies permit external accounts to send events.

EventBridge event bus resource policy is evaluated for public access, such as a Principal: "*" or overly broad conditions that allow any AWS account to publish events or manage rules on the bus.

EventBridge global endpoints are configured with event replication ENABLED (not DISABLED) so custom events are replicated to both the primary and secondary Regions.

EventBridge schema registry resource policies are assessed for cross-account access. It identifies statements that grant external or public principals (e.g., Principal: * or other accounts) permissions to interact with the registry and its schemas.

Amazon Data Firehose delivery streams must enable server-side encryption at rest with AWS KMS regardless of the source type. Encryption of upstream sources such as Kinesis Data Streams or MSK does not replace the need to protect the delivery stream itself.

Firewall Manager policies in the administrator account are evaluated for organization-wide compliance. The assessment reviews each policy's account-level status and flags entries marked NON_COMPLIANT or unset. It also identifies when no effective policies exist within the administrator scope.

Amazon FSx file systems are evaluated for whether they copy resource tags to their backups via the copy_tags_to_backups setting.

Amazon FSx file systems are configured to copy tags to volumes via copy_tags_to_volumes.

Identifies file systems where volume resources will not inherit the file system's tags.

FSx for Windows File Server file systems are evaluated for Multi-AZ deployment, determined when SubnetIds include more than one subnet in different Availability Zones.

Glacier vault access policy is evaluated for exposure to public principals. The finding highlights Allow statements that grant access to Principal: '*' (including wildcard forms), and notes when a vault lacks a policy.

AWS Glue Data Catalog connections are inspected for ConnectionProperties values that resemble secrets (keys, tokens, passwords).

Such values indicate sensitive data is stored directly in connection configuration instead of being sourced securely from AWS Secrets Manager or Systems Manager Parameter Store.