Checks

AppStream fleets enforce a maximum user session duration. This finding evaluates each fleet's configured limit against a threshold-default 10 hours (36000 seconds)-and identifies fleets whose session duration exceeds that limit.

AppStream fleets are evaluated for DisconnectTimeoutInSeconds being at or below 300 seconds (5 minutes), which defines how long a streaming session remains active after a user disconnects.

Amazon AppStream fleets are evaluated for the idle disconnect timeout setting, confirming it is configured to 10 minutes (<=600s) or less before inactive users are dropped and the session's disconnect_timeout window begins.

AWS AppSync GraphQL APIs have field-level logging configured at the resolver level. The check looks for log levels of ERROR or ALL to confirm field resolution events are recorded.

AWS AppSync GraphQL APIs are examined for the default authorization type. The finding indicates an API configured with API_KEY instead of IAM, Cognito, OIDC, or Lambda authorizers.

Athena workgroups are evaluated for encryption of query results to confirm result data is stored encrypted at rest, whether saved in Amazon S3 or via managed query results

Athena workgroups that set enforce_workgroup_configuration=true apply the workgroup's settings to every query, overriding client-side options for results location, expected bucket owner, encryption, and control of objects written to the results bucket.

Athena workgroups publish query metrics to CloudWatch. This evaluation determines whether each workgroup has query activity logging enabled in CloudWatch.

[DEPRECATED] EC2 Auto Scaling launch configurations are analyzed for secrets embedded in User Data, such as passwords, tokens, or API keys in bootstrapping scripts.

EC2 Auto Scaling groups use Capacity Rebalancing to act on EC2 rebalance recommendations by launching replacement Spot instances and terminating at-risk ones after they are healthy.

Assesses whether this proactive replacement behavior is enabled.

EC2 Auto Scaling groups attached to a load balancer are evaluated for ELB-based health checks that use the load balancer's target health instead of instance-only checks.

Amazon EC2 Auto Scaling groups are evaluated to determine whether their associated launch configuration assigns public IP addresses to instances (e.g., AssociatePublicIpAddress=true).

Amazon EC2 Auto Scaling launch configurations are evaluated for Instance Metadata Service settings. Instances should have the metadata endpoint enabled with http_tokens=required (enforcing IMDSv2), or have the metadata service disabled.

Allowing http_tokens=optional or omitting the version leaves legacy access enabled.

EC2 Auto Scaling groups use multiple Availability Zones within a Region, with instances distributed across more than one zone rather than confined to a single zone.

EC2 Auto Scaling groups are evaluated for using multiple instance types in each Availability Zone and spanning more than one AZ.

Groups are identified when every AZ defines at least two instance types; groups with any AZ using a single or no type, or confined to one AZ, are noted.

EC2 Auto Scaling groups use an EC2 launch template directly or via a mixed instances policy to define instance configuration and versioned settings.

AWS Lambda function environment variables are encrypted at rest using a customer-managed KMS key (CMK) rather than the default AWS-managed Lambda service key.

The presence of a KMSKeyArn on the function configuration indicates CMK-based encryption is active.

AWS Lambda function uses VPC networking with specified subnets and security groups, rather than the default Lambda-managed network.

Presence of a VPC association (vpc_id) indicates private connectivity to VPC resources.

AWS Lambda function invocations are recorded as CloudTrail data events when trails include AWS::Lambda::Function resources.

The finding reflects whether a function's Invoke activity is being logged by an eligible trail.

AWS Lambda functions have a Dead Letter Queue (DLQ) configured — an SQS queue or SNS topic that receives records of failed asynchronous invocations.

Without a DLQ, failed invocations are silently discarded after exhausting retries.

Lambda function code is analyzed for embedded secrets across files in the deployment package, detecting patterns like API keys, passwords, tokens, and connection strings. Findings reference file names and line numbers where potential secrets appear.

AWS Lambda function environment variables are analyzed for content that resembles secrets (API keys, tokens, passwords). Pattern-based detection highlights potential hardcoded credentials present in the function's environment.

AWS Lambda function resource-based policies are assessed for public access. The finding identifies policies with wildcard or empty Principal that allow actions like lambda:InvokeFunction to any principal.

Lambda function URL CORS policy is reviewed for AllowOrigins. The presence of * indicates a wide origin allowance in the CORS configuration.