Checks

Amazon Cognito app clients use PreventUserExistenceErrors to suppress user-existence disclosures, keeping authentication, confirmation, and recovery responses generic rather than indicating whether a username exists.

Amazon Cognito user pool app clients are evaluated for token revocation being enabled via EnableTokenRevocation.

This identifies whether each client can invalidate refresh tokens and the access/ID tokens derived from them to end user sessions.

Amazon Cognito user pools have deletion protection set to ACTIVE. The evaluation inspects each user pool's deletion protection status.

Amazon Cognito user pools with MFA set to ON, indicating an additional factor is enforced during authentication

Amazon Cognito user pools are assessed for a password policy that includes a lowercase character requirement. Pools with require_lowercase set are distinguished from those without a policy, which inherently lack this requirement.

Amazon Cognito user pools should have a password policy requiring a minimum length of 14.

This evaluation detects pools without a policy or with minimum_length below 14.

Amazon Cognito user pools are evaluated for a password policy that requires at least one number. The assessment checks whether the policy enforces a numeric character via RequireNumbers and also identifies pools with no password policy configured.

Amazon Cognito user pool password policy includes a symbol requirement for user passwords.

Assesses the presence of a policy and whether require_symbols is configured.

Amazon Cognito user pool password policy is evaluated for an uppercase character requirement (require_uppercase). The check also identifies user pools that have no password policy configured.

Amazon Cognito user pools are evaluated for self-service sign-up. The expected configuration is AllowAdminCreateUserOnly=true so only administrators create accounts.

When self sign-up is allowed, the check also highlights any linked identity pools and the authenticated role(s) that new users could assume.

Amazon Cognito user pools use administrator-issued temporary passwords. This evaluates whether a user pool defines a password policy and sets the temporary password validity to 7 days or fewer.

Amazon Cognito user pools are evaluated for an association with an AWS WAFv2 web ACL that filters and controls requests to the hosted UI and public user pool API endpoints.

VPC firewall rules permitting inbound RDP (TCP 3389) from 0.0.0.0/0 are flagged, including ingress rules that allow all TCP ports or all protocols

VPC firewall rules allowing Internet-sourced ingress (0.0.0.0/0) to TCP port 22 (SSH) are identified, including rules using protocol all or tcp whose ports or ranges include 22.

Custom disk images should not be shared publicly with allAuthenticatedUsers. Per Google Cloud API restrictions, allUsers cannot be assigned to Compute Engine images. The concern is allAuthenticatedUsers, which grants access to anyone with a Google account, potentially exposing application snapshots and sensitive data.

Google Compute Engine virtual machine instances are evaluated to ensure that Automatic Restart is enabled. This feature allows the Google Cloud Compute Engine service to automatically restart VM instances when they are terminated due to non-user-initiated reasons such as maintenance events, hardware failures, or software failures.

Linode instances are assessed for enrollment in the Linode Backup service, which performs automatic daily and weekly snapshots of an instance's disks. Without it enabled, there is no managed recovery point to restore from after a data-loss event.

Compute Engine VMs are evaluated for the metadata key block-project-ssh-keys set to true, indicating project-wide SSH keys are blocked and only instance-level or OS Login credentials are honored.

Google Compute Engine VMs configured as Confidential VMs encrypt data in use with hardware-based memory protection and per-instance keys.

This assessment identifies whether Confidential Computing is enabled on each VM instance.

OpenStack compute instances (VMs) are evaluated to verify that config drive is enabled. Config drive provides metadata and user data via a virtual CD-ROM device instead of the metadata service (169.254.169.254). This improves security by eliminating network-based metadata access, which can be vulnerable to SSRF attacks and metadata service exploitation.

Compute Engine VMs are evaluated for use of the default service account ([PROJECT_NUMBER]-compute@developer.gserviceaccount.com). The finding highlights instances configured with that account rather than a workload-specific service account. GKE node VMs are ignored.

Compute Engine VM instances using the default service account with the cloud-platform scope (Allow full access to all Cloud APIs) are identified. GKE nodes are excluded.

This check verifies whether GCP Compute Engine VM instances have deletion protection enabled to prevent accidental termination of production or critical workloads.

This check verifies whether GCP Compute Engine VM instances have auto-delete disabled for their attached persistent disks.

When auto-delete is enabled, persistent disks are automatically removed when the associated VM instance is deleted, which can lead to unintended data loss.