Checks

Google Chat apps connect to external services to look up information, schedule meetings, or complete tasks. Apps are accounts created by Google, users in the organization, or third parties that can access user data including email addresses, conversation content, and organizational information.

Google Chat external file sharing controls whether users can share files with people outside the organization via Chat conversations. Files often contain confidential information, and organizations in regulated industries need to control the flow of this information outside their boundaries.

Google Chat external messaging controls whether users can send messages to people outside the organization. If external messaging is allowed, it can optionally be restricted to only allowlisted domains to limit the scope of external communication.

Google Chat external spaces allow users to create or join collaborative spaces that include people outside the organization. If external spaces are allowed, they can optionally be restricted to only allowlisted domains to limit external participation.

Incoming webhooks let external applications post asynchronous messages into Google Chat spaces without being a Chat app. When enabled, users can configure webhooks and developers can call them to send content from external applications.

Google Chat internal file sharing controls whether users can share files with other people inside the organization via Chat conversations. Organizations in regulated industries may need to control and audit all file sharing, even between internal users.

When creating instances, user data can be used during the initial configuration. User data must not contain sensitive information

CloudFormation CDKToolkit stack's BootstrapVersion is compared to a recommended minimum (default 21). A lower value indicates the environment uses legacy bootstrap resources and IAM roles from older templates.

CloudFormation stack Outputs are analyzed for hardcoded secrets-passwords, API keys, tokens-using pattern-based detection across output values. A finding indicates potential secret strings present within Outputs of the template or stack.

AWS CloudFormation root stacks are evaluated for termination protection. The detection identifies whether termination protection is enabled to block stack deletions on non-nested stacks.

CloudFront distributions are configured with a custom SSL/TLS certificate rather than the default *.cloudfront.net certificate for viewer connections.

CloudFront distributions are evaluated for a configured default root object that maps / requests to a specific file such as index.html, rather than forwarding root requests directly to the origin.

CloudFront distributions have the default cache behavior associated with Field-Level Encryption via field_level_encryption_id, targeting specified request fields for edge encryption.

CloudFront distributions have geographic restrictions configured to limit access by country using an allowlist or blocklist (RestrictionType not none).

CloudFront distributions require viewer connections over HTTPS when the default cache behavior viewer_protocol_policy is https-only or redirect-to-https. Configurations that use allow-all permit HTTP.

CloudFront distributions that use custom SSL/TLS certificates are configured to serve HTTPS using Server Name Indication (ssl_support_method: sni-only). It evaluates SNI use rather than dedicated IP during the TLS handshake.

CloudFront distributions record viewer requests using standard access logs (S3), real-time log configurations, or Standard Logging v2 via CloudWatch Logs delivery sources.

The finding evaluates whether at least one logging mechanism is active so request metadata is captured for each distribution.

CloudFront distributions are evaluated for an origin group configured with at least 2 origins to support automatic origin failover.

CloudFront distributions are evaluated for TLS to origins. The check ensures custom origins use origin_protocol_policy=https-only, or match-viewer only when the viewer protocol policy disallows HTTP. For S3 origins, it inspects the viewer protocol policy and flags allow-all as permitting non-encrypted paths.

CloudFront distributions are assessed for use of a TLS 1.3-only security policy (TLSv1.3_2025). CloudFront's quantum-safe key exchanges (X25519MLKEM768, SecP256r1MLKEM768) only work with TLS 1.3. Distributions that allow TLS 1.2 (or older) fallback to classical key exchanges and are exposed to harvest-now, decrypt-later attacks.

CloudFront distributions with Amazon S3 origins are expected to use Origin Access Control (OAC) on each S3 origin.

The evaluation inspects distributions that include s3_origin_config and identifies S3 origins that lack an associated OAC.

CloudFront distributions with S3OriginConfig should reference existing S3 bucket origins (excluding static website hosting).

Identifies origins where the configured bucket name does not exist.

CloudFront distributions have origins whose OriginSslProtocols allow deprecated SSL/TLS versions (SSLv3, TLSv1, TLSv1.1) for CloudFront-to-origin HTTPS connections.

CloudFront distributions are assessed for an associated AWS WAF web ACL that inspects and filters HTTP/S requests at the edge.

The finding highlights distributions without this web ACL association.