Checks

Cloud SQL for SQL Server instances are evaluated to ensure the user connections database flag is set to 0 (unlimited), avoiding any artificial cap on concurrent user sessions

Cloud SQL for SQL Server instances are evaluated for the user options database flag configured with any value.

This flag sets global defaults for session SET behaviors; the check identifies instances where this global override is present.

Cloud SQL instances enforce SSL/TLS-only connections, rejecting plaintext traffic. The connection policy requires encryption for all clients (e.g., ENCRYPTED_ONLY or TRUSTED_CLIENT_CERTIFICATE_REQUIRED) instead of allowing both encrypted and unencrypted connections.

Data Access audit logs (DATA_READ and DATA_WRITE) are enabled for Cloud Storage at the project level. Unlike Admin Activity logs (enabled by default), Data Access logs must be explicitly configured to track read and write operations on Cloud Storage objects.

Cloud Storage buckets use Object Lifecycle Management with at least one valid rule (supported action and non-empty condition) to automatically transition storage class or delete objects.

Google Cloud Storage buckets are evaluated to ensure that Usage and Storage Logs are enabled. Enabling these logs provides detailed visibility into access requests, usage patterns, and storage activity within each bucket.

Cloud Storage log sink buckets have a configured retention period with Bucket Lock applied, ensuring the retention policy cannot be shortened or removed.

Cloud Storage buckets are assessed for anonymous or public access by detecting permissions granted to broad principals like allUsers or allAuthenticatedUsers that make bucket data reachable without authentication.

Google Cloud Storage buckets are assessed for Soft Delete being enabled with a non-zero retention window, meaning deleted objects are temporarily preserved and can be restored until the window expires.

Cloud Storage bucket has a bucket-level Retention Policy with a retentionPeriod that meets or exceeds the organization-defined minimum, preventing deletion or modification of objects before the required time.

Cloud Storage buckets have uniform bucket-level access (UBLA) enabled so object permissions are controlled solely by bucket-level IAM, with object ACLs disabled.

Cloud Storage buckets with Object Versioning keep prior object generations. The finding indicates whether the bucket's versioning setting is enabled.

GCP Projects are evaluated to ensure they have VPC Service Controls enabled for Cloud Storage. VPC Service Controls establish security boundaries by restricting access to Cloud Storage resources to specific networks and trusted clients, preventing unauthorized data access and exfiltration.

At least one actively logging CloudTrail trail records Amazon Bedrock API activity through management events or advanced event selectors targeting Bedrock resources.

This check covers control-plane operations such as configuration changes through CloudTrail management events and can also cover data-plane Bedrock events when advanced event selectors target Bedrock resource types.

CloudTrail log buckets for actively logging trails are evaluated for MFA Delete on the associated S3 bucket. The assessment determines whether MFA Delete is configured on the in-account log bucket; if the bucket resides in another account, its configuration should be verified separately.

CloudTrail trails are configured to send events to CloudWatch Logs, and show recent delivery within the last 24h. Trails without integration or without recent CloudWatch delivery are identified, across single-Region and multi-Region trails.

CloudTrail trails that are logging are evaluated for Insights via insight selectors, which enable anomaly detection on management-event patterns (API call and error rates). The finding pinpoints logging trails where these selectors are missing.

AWS CloudTrail trails are evaluated for use of SSE-KMS with a customer-managed KMS key to encrypt delivered log files at rest in S3. Trails without a configured KMS key are identified. Applies to single-Region and multi-Region trails.

AWS CloudTrail trails are evaluated for log file integrity validation being enabled (LogFileValidationEnabled).

When enabled, CloudTrail generates signed digest files to verify that S3-delivered log files remain unchanged.

CloudTrail trails deliver logs to an S3 bucket; this evaluates whether that bucket has S3 server access logging enabled to record requests against it.

If the destination bucket is outside the account or audit scope, a manual review is indicated.

CloudTrail log destination S3 buckets are inspected for ACL grants that expose data to the public AllUsers group.

Buckets hosted in other accounts are flagged for out-of-scope review.

AWS CloudTrail has at least one trail with logging enabled in every region. A multi-region trail or a regional trail counts for coverage in that region.

CloudTrail trails record management events (read and write) in every AWS region and are actively logging, using a multi-region trail or per-region coverage.

CloudTrail trails log S3 object-level read data events for all buckets, capturing object access (for example GetObject) via selectors targeting AWS::S3::Object