Checks

Linode instances are assessed for disk encryption status. Disk encryption protects data at rest on the instance's underlying disks, keeping stored data unreadable without the encryption keys even if the physical media is accessed.

Compute Engine VM disks use Customer-Supplied Encryption Keys (CSEK) rather than provider-managed keys. The finding flags instances where any attached disk is not protected with the customer-provided key.

Managed Instance Groups (MIGs) should have autohealing enabled with a valid health check configured. Autohealing automatically recreates unhealthy instances based on application-level health checks, ensuring continuous availability.

Managed Instance Groups (MIGs) should be attached to load balancers via backend services to enable traffic distribution across instances. Load balancers provide health checking, autoscaling integration, and high availability features that are essential for production workloads.

Managed Instance Groups (MIGs) should be configured for multi-zone deployments to ensure high availability and fault tolerance. A multi-zone MIG distributes instances across multiple zones within a region, protecting applications from zonal failures.

OCI compute instances are evaluated for in-transit encryption on paravirtualized block or boot volume attachments, confirming that data exchanged between the instance and attached volumes is encrypted during transfer.

Compute Engine VM instances with canIpForward enabled are identified. This setting allows a VM to process packets not addressed to its own IP.

Instances created by GKE (gke- prefix) are excluded from this evaluation.

OpenStack compute instances (VMs) are evaluated to verify network isolation by ensuring they have private IP addresses without mixed public/private exposure. Proper network segmentation requires instances to be deployed in private networks and accessed via controlled entry points (bastion hosts, VPN, load balancers) rather than direct public exposure.

OpenStack compute instances (VMs) are evaluated to verify that SSH key-based authentication is configured by checking for an assigned keypair. Password-based authentication is vulnerable to brute-force attacks, credential stuffing, and phishing. SSH keys provide cryptographic authentication resistant to these attacks.

OCI compute instance metadata service is configured so legacy IMDS v1 endpoints are disabled, requiring session-authorized IMDS v2 requests for metadata access

OpenStack compute instances (VMs) are evaluated to verify that locked status is enabled. Locking an instance prevents unauthorized administrative operations (delete, resize, rebuild, etc.) without first unlocking it. This provides an additional layer of protection against accidental or malicious modifications.

Checks if NHN Compute instances have administrative login users.

OpenStack compute instance metadata is evaluated to detect sensitive data such as passwords, API keys, secrets, and private keys. Instance metadata is accessible via the metadata service (169.254.169.254) to any process inside the instance. Storing secrets in metadata exposes them to SSRF attacks, compromised applications, and unauthorized access.

Compute Engine VM instances should have their On Host Maintenance setting configured to MIGRATE for live migration during host maintenance events, ensuring continuous availability without downtime.

This check verifies that VM instances are not configured as preemptible or Spot VMs.

Both preemptible and Spot VMs can be terminated by Google at any time when resources are needed elsewhere, making them unsuitable for production and business-critical workloads. Spot VMs are the newer version of preemptible VMs and are Google's recommended approach for interruptible workloads.

Compute Engine VM instances with an assigned external (public) IP address on any network interface are identified.

Instances without an external IP are considered internal-only.

Check if a floating(public) IP is assigned to an NHN compute instance.

OpenStack compute instances are evaluated to verify they are not exposed to the internet via public IPs (floating IPs or access IPs). Instances with public IPs are directly reachable from the internet, increasing attack surface. Best practices recommend using bastion hosts, VPN gateways, or load balancers instead.

OCI compute instances have UEFI Secure Boot enabled so the platform firmware loads only trusted, signed bootloaders, kernels, and drivers at startup.

Checks if NHN Compute VM instances are using appropriate security group configurations. Using only the default security group can pose a security risk.

OpenStack compute instances (VMs) are evaluated to verify that at least one security group is attached. Security groups act as virtual firewalls, controlling ingress and egress traffic. Instances without security groups may have unrestricted network access, violating defense-in-depth principles.

Compute Engine VM instance with the interactive serial console enabled via metadata serial-port-enable (1/true). Instances with this flag disabled do not allow interactive serial console connections.

Compute Engine VM instances have vTPM and Integrity Monitoring enabled as part of Shielded VM configuration.

VM instances should be configured with only one network interface unless multiple interfaces are explicitly required for complex network configurations.

Multiple network interfaces expand the attack surface and create additional network pathways that may be exploited.