Checks

CloudTrail events for security group configuration changes are monitored using a CloudWatch Logs metric filter with an associated alarm. The filter targets actions like AuthorizeSecurityGroupIngress/Egress, RevokeSecurityGroupIngress/Egress, CreateSecurityGroup, and DeleteSecurityGroup to surface any security group modifications.

CloudTrail logs in CloudWatch are assessed for a metric filter and alarm that detect console logins where $.eventName = ConsoleLogin and $.additionalEventData.MFAUsed != \"Yes\".

This reflects whether alerting exists for sign-ins that occur without MFA.

CloudWatch Logs for CloudTrail include a metric filter that matches unauthorized API errors ($.errorCode="*UnauthorizedOperation" or $.errorCode="AccessDenied*") and a linked alarm that triggers when events match the filter.

MongoDB Atlas clusters enforce database authentication for client connections (authEnabled).

Identifies clusters where authentication is not required for access.

MongoDB Atlas clusters have automated backups enabled (cloudBackup/backup_enabled) to generate snapshots and support restore operations

MongoDB Atlas clusters are evaluated for encryption at rest. The check looks for a supported encryption provider configured (not NONE) or storage-level encryption enabled (e.g., encryptEBSVolume=true). Unsupported providers or explicit disablement are highlighted.

MongoDB Atlas clusters require TLS/SSL for client connections to encrypt data in transit (sslEnabled=true).

AWS CodeArtifact packages with an internal or unknown origin are evaluated for their package origin controls. The check identifies packages where the upstream setting allows ingesting versions from external or upstream repositories.

CodeBuild projects are assessed for logging configuration to Amazon CloudWatch Logs or S3, identifying when at least one destination is enabled for build logs and events.

AWS CodeBuild projects are inspected for plaintext environment variables (PLAINTEXT) that resemble secrets (keys, tokens, passwords).

Such values indicate sensitive data is stored directly in environment variables instead of being sourced securely.

AWS CodeBuild project visibility is assessed to identify projects exposed to the public. Projects with project_visibility set to PUBLIC_READ (or not PRIVATE) allow anyone to access build results, logs, and artifacts.

AWS CodeBuild projects are assessed for recent activity using the last build invocation timestamp. Projects not invoked within 90 days or never built are treated as inactive.

CodeBuild projects with S3 log delivery are evaluated for encryption at rest on their S3 log objects. Only projects that write logs to S3 are in scope.

AWS CodeBuild projects with Bitbucket sources are assessed to confirm repository URLs do not embed credentials (for example, x-token-auth:<token>@ or user:password@). The assessment includes both the primary source and all secondary sources.

AWS CodeBuild projects are evaluated for use of a user-controlled buildspec, identified when the project references a repository file like *.yml or *.yaml. Projects using non file-based build instructions are treated as centrally managed.

CodeBuild projects sourcing from GitHub/GitHub Enterprise with a service role that trusts CodeBuild are evaluated by deriving the repository's organization from its URL and comparing it to an allowed organizations list.

AWS CodeBuild webhook filters using ACTOR_ACCOUNT_ID, HEAD_REF, or BASE_REF have regex patterns anchored with ^ (start) and $ (end) to enforce exact matching and prevent substring bypass attacks.

CodeBuild report groups with export type S3 are evaluated to confirm their exported test results are encrypted at rest with a KMS key.

Report groups configured with NO_EXPORT are out of scope.

AWS CodeCommit repositories are scanned for hardcoded secrets such as API keys, tokens, and passwords in every file tracked at the tip of the default branch. CodeCommit repositories, including their branches and commit history, are a top source of leaked credentials, and secrets can persist in history even after being removed from HEAD.

CodePipeline pipeline should configure its source stage to use a private repository with authenticated connection rather than a public GitHub or GitLab repository. This ensures deployment configurations, build artifacts, and CI/CD logic remain protected from unauthorized access.

Amazon Cognito identity pools are evaluated for guest access to unauthenticated identities. The assessment considers the allow_unauthenticated_identities setting and whether an unauthenticated role can be assumed by guests.

Amazon Cognito user pools are evaluated for Threat protection (advanced security) mode: ENFORCED (full-function) vs AUDIT or disabled. This indicates whether adaptive risk responses and compromised-credential checks are applied during authentication.

Amazon Cognito user pool threat protection blocks sign-ins when compromised credentials are detected. Advanced security is ENFORCED, and the compromised-credentials policy applies a BLOCK action to sign-in events.

Amazon Cognito user pool with threat protection in ENFORCED mode and adaptive authentication actions set to BLOCK for low, medium, and high account-takeover risk levels.

Evaluates the user pool's risk configuration to confirm risky sign-in attempts are blocked across all severities.