Checks

This check identifies VM instances in a SUSPENDED or SUSPENDING state with persistent disks still attached.

Persistent disks on suspended VMs remain accessible through the GCP API and could contain sensitive data while the instance is inactive, potentially creating security blind spots in long-forgotten infrastructure.

OpenStack compute instances (VMs) are evaluated to verify that trusted image certificates are configured. Trusted image certificates enable cryptographic validation of image signatures using Glance image signing (OpenStack Image Signature Verification). This ensures instances are launched from verified, untampered images signed by trusted authorities.

Linode instances are assessed for Watchdog (Lassie) status. Watchdog is Linode's automatic recovery feature that monitors an instance and reboots it if it powers off unexpectedly, helping maintain availability without manual intervention.

Application Load Balancer (HTTP/S) backend services have Cloud Logging for requests enabled at the backend service level.

Only load balancers with a backend service support this setting.

Projects are assessed for a VPC network named default (the pre-created, auto-mode network).

VPC networks are assessed for a DNS policy that enables Cloud DNS query logging. When present, resolvers record queries for the network from VMs, GKE, peering, and inbound forwarding, with entries written to Cloud Logging.

Google Cloud networks are evaluated for legacy mode (subnet_mode: legacy). The finding highlights networks using the older, non-subnetted design instead of VPC with regional subnets.

OS Login Two-Factor Authentication (2FA) requires users to verify their identity with a second factor when connecting via SSH to VM instances.

This provides an additional security layer beyond passwords or SSH keys, significantly reducing the risk of unauthorized access even if credentials are compromised.

Project metadata has OS Login enabled (enable-oslogin), so VM SSH access uses IAM-linked Linux identities instead of static project or instance keys.

Compute Engine public IP addresses are cross-checked with Shodan to identify Internet-exposed hosts that have been indexed, including observed open ports and metadata.

Only EXTERNAL addresses are evaluated.

Compute Engine disk snapshots are evaluated against a configurable age threshold (default 90 days) to identify snapshots exceeding the organization's retention policy.

GCP VPC subnets have VPC Flow Logs enabled at the subnet scope to capture connection metadata for traffic to and from VM interfaces.

AWS Config has a delegated administrator registered via AWS Organizations and at least one Configuration Aggregator with an OrganizationAggregationSource that covers all AWS regions, ensuring centralized org-wide configuration visibility.

AWS accounts have AWS Config recorders active and healthy in each Region. It identifies Regions with no recorder, a disabled recorder, or a recorder in a failure state.

AWS Config recorders are evaluated for use of the service‑linked IAM role AWSServiceRoleForConfig linked to config.amazonaws.com rather than a custom role.

The evaluation inspects active recorders and their role ARN to confirm the AWS‑managed service‑linked role is in use.

Azure Container Registry admin account configuration, confirming the built-in admin user is disabled so access relies on Microsoft Entra-based RBAC identities and scoped roles.

Azure Container Registry configuration indicates whether the registry permits unrestricted public access based on the Public network access setting.

Azure Container Registry access via Private Endpoints (Azure Private Link). Registries with private endpoint connections use private IPs; others rely on the public endpoint.

Kubernetes controller manager uses the loopback bind address 127.0.0.1 via --bind-address or --address, keeping its health, metrics, and debug endpoints reachable only from the host

Kubernetes Controller Manager is evaluated for the --profiling argument. --profiling=false disables runtime profiling; absence or a different value means profiling is enabled.

Kubernetes controller manager terminated Pod garbage collection threshold is evaluated. The finding highlights use of the default --terminated-pod-gc-threshold=12500 instead of a value tuned to cluster size and workload churn. The threshold controls when terminated Pods are automatically removed.

Kubernetes Controller Manager uses --root-ca-file to reference a certificate bundle so pods get a ca.crt for validating the API server's TLS certificate.

Kubernetes controller manager configuration includes the RotateKubeletServerCertificate=true feature gate for automatic rotation of kubelet server certificates

Evaluates whether the Kubernetes controller manager uses per-controller service account credentials via --use-service-account-credentials=true, meaning each controller runs with its own identity rather than a shared credential.