Checks

Amazon GuardDuty detectors are evaluated for S3 Protection, which analyzes CloudTrail S3 data events to monitor object-level API activity (GetObject, PutObject, DeleteObject) across S3 buckets in the account and Region.

IAM groups with the AdministratorAccess managed policy are assessed to ensure all member users have active MFA.

The finding highlights any administrator group that includes a user without MFA enrollment or activation.

AWS IAM root user activity is assessed by inspecting last-used timestamps for the root password and access keys. The finding indicates when the root identity has been used recently for console or programmatic access.

IAM AWS-managed policies attached to identities are inspected for statements that allow Action:'*' on Resource:'*'-i.e., full administrative *:* permissions

IAM SAML providers enable federated role assumption via STS AssumeRoleWithSAML.

This evaluates whether such providers exist in the account.

Attached customer-managed IAM policies are evaluated for statements granting full admin access via Action: "*", Resource: "*", i.e., *:*. Only policies you created and attached to identities are considered.

Customer-managed IAM policies that are unattached are evaluated for statements granting full administrative access using *:* wildcards.

The focus is on policies whose documents include unrestricted actions on all resources.

IAM groups are assessed for the AWS-managed AdministratorAccess policy attachment.

The finding reports any group that has this policy among its attached permissions.

IAM inline policies are evaluated for permission combinations that enable privilege escalation, such as sts:AssumeRole, iam:PassRole, attaching/editing policies, or broad wildcards. The result highlights inline policies that allow a principal to obtain higher effective access.

IAM inline policies on identities are evaluated for statements allowing Action:"*" on Resource:"*", which indicates unrestricted administrative access.

IAM inline policies are evaluated for statements that grant full CloudTrail permissions (cloudtrail:*) to all resources.

The finding flags identity policies that provide unrestricted control over CloudTrail operations.

IAM inline policies are analyzed to identify statements that grant unrestricted AWS KMS access via the wildcard action kms:*.

IAM inline policies are analyzed to identify statements that grant aws-marketplace:Subscribe on all resources (*). This action controls the ability to subscribe to AWS Marketplace products, including Amazon Bedrock foundation models, and should be scoped to specific product ARNs to enforce least privilege.

Custom IAM policies with Allow statements that grant sts:AssumeRole (or sts:*/*) to a wildcard Resource.

IAM server certificates stored in AWS IAM are evaluated for expiration by comparing their validity period to the current time. Certificates with a NotAfter date in the past are identified as expired.

AWS root user is evaluated for active access keys. It identifies whether the root identity has one or two programmatic credentials and notes when organization-level root credential management is present.

IAM account password policy sets a password expiration period for IAM user console logins; configuration is aligned when rotation is enabled and set to <= 90 days.

IAM password policy requires at least one lowercase character in user passwords via the Require lowercase setting

IAM password policy is assessed for the minimum password length setting, confirming it meets >= 14 characters for IAM console users.

IAM account password policy requires at least one numeric character (0-9) in IAM user passwords

IAM account password policy uses password reuse prevention set to 24 remembered passwords (maximum history) for IAM users

IAM account password policy includes the Require at least one non-alphanumeric character rule for IAM user passwords

IAM account password policy enforces the presence of at least one uppercase letter (A-Z) in IAM user passwords.

This evaluates whether the uppercase complexity rule is enabled for console passwords.

Customer-managed IAM policies are evaluated for permissions that enable privilege escalation, including creating or updating policies, altering role trust, attaching higher-privilege policies, or using iam:PassRole to obtain broader access.