Checks

Azure Kubernetes clusters should define a disk encryption set ID to ensure encrypted storage for OS and data disks. This provides an additional layer of security by encrypting data at rest.

VMs without NSGs are exposed without traffic control or inspection.

Using an unsupported PHP runtime in Azure App Service may expose applications to security vulnerabilities as these versions no longer receive security patches. This check ensures PHP versions are still supported.

Using an unsupported Python runtime in Azure App Service may expose applications to security vulnerabilities as these versions no longer receive security patches. This check ensures Python versions are still supported by the Python Foundation.

Allowing plain FTP risks credentials and data being transmitted unencrypted.

Allowing HTTP undermines transport encryption and exposes user data.

Without NSG flow logs, network activity is not auditable, hindering incident investigation.

Sensitive legacy ports like Telnet or POP3 should not be open to broad networks.

IP forwarding should be disabled on network interfaces unless specifically required.

Avoid assigning public IP addresses to network interfaces unless necessary.

AWS Backup is assessed for the existence of at least one backup plan that schedules and retains recovery points for selected resources.

The evaluation determines whether any plan is configured; when none is found-even if backup vaults exist-the absence of a plan is noted.

AWS Backup recovery points are evaluated for encryption at rest using the backup vault's KMS configuration. Items lacking vault-level encryption are highlighted, regardless of the source resource's encryption.

AWS Backup environments with existing backup plans are assessed for the presence of at least one report plan that generates jobs or compliance reports.

AWS Backup vaults are evaluated for encryption at rest with AWS KMS. The finding highlights vaults without a configured KMS key protecting stored recovery points.

AWS Backup in the account/region includes at least one backup vault that stores and organizes recovery points for use by backup plans and copies.

AWS Batch job definitions are analyzed for plaintext secrets placed in container environment variables and command parameters. It identifies values that resemble credentials (keys, tokens, passwords) within job definitions.

Bedrock agents should have an associated guardrail for their sessions. The evaluation identifies agents without a guardrail linked for input/output screening during interactions.

Bedrock Agent execution roles (agentResourceRoleArn) should grant only the minimum permissions the agent needs. The evaluation FAILs when the role has an AWS-managed *FullAccess policy attached, has an inline statement allowing broad actions on Resource: "*", or has no permissions boundary configured.

Every Bedrock Agent assumes the role in its agentResourceRoleArn. That role must belong to exactly one agent, so no agent inherits another's permissions.

Bedrock API keys linked to IAM users are evaluated for excessive permissions, including policies that grant full access (* or bedrock:*) or enable privilege escalation. The finding highlights keys whose attached or inline policies provide broad or escalating capabilities.

AWS recommends Amazon Bedrock long-term API keys only for exploration; production workloads should use short-term API keys (session-scoped, valid up to 12 hours). This check fails for any active long-term Bedrock API key, escalating to critical severity when configured to never expire. Already-expired keys pass — they can no longer authenticate.

Bedrock custom models produced by model customization can be encrypted at rest with a customer-managed KMS key rather than resting under an AWS-owned key the organization cannot audit, rotate, or revoke.

IAM roles (excluding service roles) are evaluated for attachment of the AWS-managed AmazonBedrockFullAccess policy.

This policy grants unrestricted access to all Amazon Bedrock actions and resources.

Bedrock guardrails can attach a contextualGroundingPolicy whose filters score each response for GROUNDING (supported by the retrieved source) and RELEVANCE (answers the question asked). Both filter types must be enabled, set to action: BLOCK, and carry a threshold above 0.