Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
glue_database_connections_ssl_enabled
AWS Glue connections require TLS/SSL for JDBC when the JDBC_ENFORCE_SSL property is set to true.
This evaluates connection definitions to confirm SSL is enforced for traffic to external data stores.
glue_data_catalogs_connection_passwords_encryption_enabled
AWS Glue Data Catalog settings for connection password encryption are evaluated to confirm an AWS KMS key is configured to encrypt passwords stored in connection properties.
glue_data_catalogs_metadata_encryption_enabled
AWS Glue Data Catalog metadata is encrypted at rest when catalog settings use SSE-KMS with a KMS key.
Catalogs that do not configure SSE-KMS for metadata are considered unencrypted.
glue_data_catalogs_not_publicly_accessible
AWS Glue Data Catalog resource policies are assessed for configurations that expose the catalog to anyone, such as Principal: *, broad resource scopes, or permissive conditions.
The finding highlights catalogs made public through overly permissive resource-based access.
glue_development_endpoints_cloudwatch_logs_encryption_enabled
AWS Glue development endpoints are assessed for an associated security configuration that enables CloudWatch Logs encryption. It confirms the endpoint references a configuration and that log encryption is not DISABLED.
glue_development_endpoints_job_bookmark_encryption_enabled
AWS Glue development endpoints are assessed for an attached security configuration where job bookmark encryption is enabled. Endpoints lacking a security configuration are also identified.
glue_development_endpoints_s3_encryption_enabled
AWS Glue development endpoints are evaluated for an attached security configuration with S3 encryption. Endpoints lacking a security configuration, or with s3_encryption set to DISABLED, are flagged by this check.
glue_etl_jobs_amazon_s3_encryption_enabled
AWS Glue ETL jobs are validated to use Amazon S3 at-rest encryption (SSE-S3 or SSE-KMS) when writing outputs, either through an attached security configuration or via job arguments. Jobs missing a security configuration or with S3 encryption disabled are identified.
glue_etl_jobs_cloudwatch_logs_encryption_enabled
AWS Glue ETL jobs are evaluated for a security configuration with CloudWatch Logs encryption (SSE-KMS) enabled. Jobs without a security configuration, or with CloudWatch Logs encryption set to DISABLED, are highlighted.
glue_etl_jobs_job_bookmark_encryption_enabled
AWS Glue ETL jobs should link a security configuration with job bookmark encryption enabled. Bookmark encryption must not be DISABLED (e.g., use CSE-KMS). Jobs lacking a security configuration are treated as not protecting bookmark metadata.
glue_etl_jobs_logging_enabled
AWS Glue jobs are assessed for continuous CloudWatch logging, confirming that runtime events and outputs are sent to CloudWatch Logs via the --enable-continuous-cloudwatch-log configuration.
glue_etl_jobs_no_secrets_in_arguments
AWS Glue ETL jobs are inspected for default arguments (DefaultArguments) that resemble secrets (keys, tokens, passwords).
Such values indicate sensitive data is stored directly in job arguments instead of being sourced securely from AWS Secrets Manager or Systems Manager Parameter Store.
glue_ml_transform_encrypted_at_rest
AWS Glue ML transforms are evaluated for encryption at rest of transform user data using KMS keys. The finding highlights transforms where encryption is not configured.
guardduty_ai_protection_enabled
Active Amazon GuardDuty detectors are assessed for AI Protection being enabled, which analyzes AWS CloudTrail data events from Amazon Bedrock, Amazon Bedrock AgentCore and Amazon SageMaker AI to flag anomalous model invocations, cost harvesting and prompt injection. Detectors that do not report the feature return MANUAL, because absence means the Region does not offer it.
guardduty_centrally_managed
Amazon GuardDuty detectors are under centralized management when linked to a delegated administrator account, or when the detector's account serves as the administrator with associated member accounts.
guardduty_delegated_admin_enabled_all_regions
Amazon GuardDuty has a delegated administrator configured at the organization level, detectors are enabled in all opted-in regions, and organization auto-enable is active for new member accounts.
guardduty_ec2_malware_protection_enabled
GuardDuty detectors with Malware Protection for EC2 enabled perform agentless scans of EBS volumes attached to EC2 instances and container workloads. Scans can be triggered by suspicious activity or run on-demand to identify malicious files within restored volume snapshots.
guardduty_eks_audit_log_enabled
Amazon GuardDuty detectors are evaluated for EKS Audit Log Monitoring (EKS_AUDIT_LOGS) being enabled to analyze Kubernetes audit activity from your Amazon EKS clusters.
guardduty_eks_runtime_monitoring_enabled
GuardDuty detectors are evaluated for EKS Runtime Monitoring being enabled for Amazon EKS. The configuration is at the detector level and relates to visibility into process, file, and network activity on EKS nodes and containers.
guardduty_is_enabled
Amazon GuardDuty detector existence and health are evaluated per Region. It identifies where GuardDuty isn't enabled for the account, where a detector has no status, or where a detector is configured but suspended.
guardduty_lambda_protection_enabled
Amazon GuardDuty detectors with Lambda Protection enabled analyze Lambda invocation network activity logs across your account.
Evaluation determines whether the detector has Lambda Protection turned on.
guardduty_no_high_severity_findings
GuardDuty detectors are evaluated for the presence of High-severity findings. This surfaces whether any detector currently has findings labeled High by GuardDuty.
guardduty_rds_protection_enabled
Active Amazon GuardDuty detectors are assessed for RDS Protection being enabled, allowing analysis of RDS and Aurora login activity to profile and flag anomalous access patterns.
guardduty_runtime_monitoring_enabled
GuardDuty detectors are evaluated for unified Runtime Monitoring being enabled. The configuration is at the detector level and relates to visibility into process execution, file access, and network connections on Amazon EC2 instances, Amazon ECS on AWS Fargate tasks, and Amazon EKS nodes and containers. The legacy EKS-only feature covers Amazon EKS alone and does not satisfy this check.